systex | bf2664b844074c119be87c770efeef9b8e43b9fb92110634cec0270fb86a6dde

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260815-fx5ycsfk4x
SHA256 bf2664b844074c119be87c770efeef9b8e43b9fb92110634cec0270fb86a6dde
MD5 d8188f04da5e2dd161e876a049baa159
SHA1 04301e26be73820439e9d941b9956e3c77d23283
SHA512 e141c6d14b3a311a00d8556def747ad69cf5846d65cf0b1a1ad831a05edf3725224d6749d700b667231b97e005040f0250f7b11ce76705f43ec84d8ce21f2577
SSDEEP 3072:YuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3236	pkhcausmkifdxvpn.exe
5832	pkhcausmkifdxvpn.sys
1532	CreateProcess.exe
2832	nkfcausnkf.exe
4080	CreateProcess.exe
5036	CreateProcess.exe
4368	i_nkfcausnkf.exe
5832	cxupmkfcwu.sys
5744	CreateProcess.exe
3700	wupmhezxrp.exe
5396	CreateProcess.exe
4144	CreateProcess.exe
1092	i_wupmhezxrp.exe
4984	jhbzxrojhe.sys
2460	CreateProcess.exe
3792	hbzurpjhbw.exe
2936	CreateProcess.exe
1220	CreateProcess.exe
1168	i_hbzurpjhbw.exe
5296	rljhbztrmj.sys
3132	CreateProcess.exe
4692	omjebwromg.exe
1472	CreateProcess.exe
5716	CreateProcess.exe
2864	i_omjebwromg.exe
484	ywqomgebwt.sys
6000	CreateProcess.exe
5664	oigdbvtqlj.exe
1732	CreateProcess.exe
5192	CreateProcess.exe
2108	i_oigdbvtqlj.exe
3076	idbvtnlgdy.sys
4844	CreateProcess.exe
4492	gayqolgdyw.exe
5048	CreateProcess.exe
3020	CreateProcess.exe
3884	i_gayqolgdyw.exe
4540	ysqkidaysq.sys
124	CreateProcess.exe
1476	fdbvtnlfdx.exe
2728	CreateProcess.exe
4296	CreateProcess.exe
5808	i_fdbvtnlfdx.exe
4608	ifdavsnkfc.sys
5144	CreateProcess.exe
5732	fcavsnkfcx.exe
3104	CreateProcess.exe
1668	CreateProcess.exe
2488	i_fcavsnkfcx.exe
392	kicspnhfzx.sys
1488	CreateProcess.exe
3704	xvpmkfcxvp.exe
2412	CreateProcess.exe
5000	CreateProcess.exe
4688	i_xvpmkfcxvp.exe
5824	xrpnhfzxrp.sys
2580	CreateProcess.exe
248	keczxupmhc.exe
1328	CreateProcess.exe
2516	CreateProcess.exe
5808	i_keczxupmhc.exe
4044	mkecwupmhe.sys
4308	CreateProcess.exe
5800	jhezxrmkec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1528733076\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_652563011\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_652563011\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1915117441\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1915117441\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_268401280\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1528733076\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1915117441\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1915117441\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayqolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfcaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnhfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmhecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurpjhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcavsnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczxupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbywqgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurpjhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcavsnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbywqgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oifdyvqnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfcaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oifdyvqnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwtoljhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmkifdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczxupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwtoljhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnhfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmhecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayqolgdyw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
952	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4136	ipconfig.exe
2652	ipconfig.exe
5316	ipconfig.exe
3632	ipconfig.exe
1068	ipconfig.exe
2780	ipconfig.exe
1264	ipconfig.exe
4500	ipconfig.exe
4160	ipconfig.exe
5756	ipconfig.exe
4784	ipconfig.exe
3836	ipconfig.exe
5724	ipconfig.exe
4772	ipconfig.exe
6112	ipconfig.exe
4636	ipconfig.exe
2384	ipconfig.exe
3976	ipconfig.exe
4564	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312445783901966"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F4F91349-35CB-4016-995D-3D7A1765CB3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe
3236	pkhcausmkifdxvpn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	i_nkfcausnkf.exe
Token: SeDebugPrivilege	1092	i_wupmhezxrp.exe
Token: SeDebugPrivilege	1168	i_hbzurpjhbw.exe
Token: SeDebugPrivilege	2864	i_omjebwromg.exe
Token: SeDebugPrivilege	2108	i_oigdbvtqlj.exe
Token: SeDebugPrivilege	3884	i_gayqolgdyw.exe
Token: SeDebugPrivilege	5808	i_fdbvtnlfdx.exe
Token: SeDebugPrivilege	2488	i_fcavsnkfcx.exe
Token: SeDebugPrivilege	4688	i_xvpmkfcxvp.exe
Token: SeDebugPrivilege	5808	i_keczxupmhc.exe
Token: SeDebugPrivilege	4436	i_jhezxrmkec.exe
Token: SeDebugPrivilege	2616	i_ecwtoljhbw.exe
Token: SeDebugPrivilege	2276	i_vtoljdbvto.exe
Token: SeDebugPrivilege	5872	i_igbywqgdyw.exe
Token: SeDebugPrivilege	3472	i_oifdyvqnlg.exe
Token: SeDebugPrivilege	3664	i_davtnlfdxv.exe
Token: SeDebugPrivilege	4112	i_vpnkfcaxvp.exe
Token: SeDebugPrivilege	1428	i_vsnhfzxvpn.exe
Token: SeDebugPrivilege	4132	i_usmhecwurp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 3236	6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 6084 wrote to memory of 3624	6084	2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 3624 wrote to memory of 1096	3624	iexplore.exe	90
PID 1096 wrote to memory of 4880	1096	msedge.exe	91
PID 1096 wrote to memory of 952	1096	msedge.exe	92
PID 1096 wrote to memory of 6124	1096	msedge.exe	93
PID 1096 wrote to memory of 6124	1096	msedge.exe	93
PID 1096 wrote to memory of 6124	1096	msedge.exe	93
PID 1096 wrote to memory of 2532	1096	msedge.exe	95
PID 1096 wrote to memory of 2532	1096	msedge.exe	95
PID 1096 wrote to memory of 4068	1096	msedge.exe	96
PID 1096 wrote to memory of 3552	1096	msedge.exe	97
PID 1096 wrote to memory of 4068	1096	msedge.exe	96
PID 1096 wrote to memory of 4068	1096	msedge.exe	96
PID 1096 wrote to memory of 3552	1096	msedge.exe	97
PID 1096 wrote to memory of 3552	1096	msedge.exe	97
PID 1096 wrote to memory of 576	1096	msedge.exe	98
PID 1096 wrote to memory of 576	1096	msedge.exe	98
PID 1096 wrote to memory of 576	1096	msedge.exe	98
PID 1096 wrote to memory of 2124	1096	msedge.exe	99
PID 1096 wrote to memory of 2124	1096	msedge.exe	99
PID 1096 wrote to memory of 2124	1096	msedge.exe	99
PID 1096 wrote to memory of 2660	1096	msedge.exe	101
PID 1096 wrote to memory of 2660	1096	msedge.exe	101
PID 1096 wrote to memory of 1340	1096	msedge.exe	104
PID 1096 wrote to memory of 4208	1096	msedge.exe	105
PID 1096 wrote to memory of 1340	1096	msedge.exe	104
PID 1096 wrote to memory of 4208	1096	msedge.exe	105
PID 3236 wrote to memory of 1532	3236	pkhcausmkifdxvpn.exe	106
PID 2832 wrote to memory of 4080	2832	nkfcausnkf.exe	110
PID 1096 wrote to memory of 1880	1096	msedge.exe	113
PID 1096 wrote to memory of 6036	1096	msedge.exe	114
PID 1096 wrote to memory of 6036	1096	msedge.exe	114
PID 1096 wrote to memory of 2908	1096	msedge.exe	117
PID 1096 wrote to memory of 2908	1096	msedge.exe	117
PID 3236 wrote to memory of 5036	3236	pkhcausmkifdxvpn.exe	119
PID 3236 wrote to memory of 5744	3236	pkhcausmkifdxvpn.exe	123
PID 3700 wrote to memory of 5396	3700	wupmhezxrp.exe	125
PID 3236 wrote to memory of 4144	3236	pkhcausmkifdxvpn.exe	128
PID 3236 wrote to memory of 2460	3236	pkhcausmkifdxvpn.exe	132
PID 3792 wrote to memory of 2936	3792	hbzurpjhbw.exe	134
PID 3236 wrote to memory of 1220	3236	pkhcausmkifdxvpn.exe	137
PID 3236 wrote to memory of 3132	3236	pkhcausmkifdxvpn.exe	142
PID 4692 wrote to memory of 1472	4692	omjebwromg.exe	144
PID 3236 wrote to memory of 5716	3236	pkhcausmkifdxvpn.exe	147
PID 1096 wrote to memory of 5548	1096	msedge.exe	149
PID 1096 wrote to memory of 1008	1096	msedge.exe	150
PID 1096 wrote to memory of 1668	1096	msedge.exe	151
PID 3236 wrote to memory of 6000	3236	pkhcausmkifdxvpn.exe	154
PID 5664 wrote to memory of 1732	5664	oigdbvtqlj.exe	156
PID 3236 wrote to memory of 5192	3236	pkhcausmkifdxvpn.exe	159
PID 3236 wrote to memory of 4844	3236	pkhcausmkifdxvpn.exe	163
PID 4492 wrote to memory of 5048	4492	gayqolgdyw.exe	165
PID 3236 wrote to memory of 3020	3236	pkhcausmkifdxvpn.exe	168
PID 3236 wrote to memory of 124	3236	pkhcausmkifdxvpn.exe	172
PID 1476 wrote to memory of 2728	1476	fdbvtnlfdx.exe	174
PID 3236 wrote to memory of 4296	3236	pkhcausmkifdxvpn.exe	177
PID 3236 wrote to memory of 5144	3236	pkhcausmkifdxvpn.exe	181
PID 5732 wrote to memory of 3104	5732	fcavsnkfcx.exe	183
PID 1096 wrote to memory of 3284	1096	msedge.exe	186
PID 1096 wrote to memory of 3284	1096	msedge.exe	186
PID 3236 wrote to memory of 1668	3236	pkhcausmkifdxvpn.exe	187
PID 3236 wrote to memory of 1488	3236	pkhcausmkifdxvpn.exe	194
PID 3704 wrote to memory of 2412	3704	xvpmkfcxvp.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_d8188f04da5e2dd161e876a049baa159_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Temp\pkhcausmkifdxvpn.exe
  C:\Temp\pkhcausmkifdxvpn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1532
  - - C:\Temp\nkfcausnkf.exe
      C:\Temp\nkfcausnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5036
  - - C:\Temp\i_nkfcausnkf.exe
      C:\Temp\i_nkfcausnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5744
  - - C:\Temp\wupmhezxrp.exe
      C:\Temp\wupmhezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\i_wupmhezxrp.exe
      C:\Temp\i_wupmhezxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurpjhbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2460
  - - C:\Temp\hbzurpjhbw.exe
      C:\Temp\hbzurpjhbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurpjhbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Temp\i_hbzurpjhbw.exe
      C:\Temp\i_hbzurpjhbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3132
  - - C:\Temp\omjebwromg.exe
      C:\Temp\omjebwromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebwromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5716
  - - C:\Temp\i_omjebwromg.exe
      C:\Temp\i_omjebwromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigdbvtqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6000
  - - C:\Temp\oigdbvtqlj.exe
      C:\Temp\oigdbvtqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigdbvtqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\i_oigdbvtqlj.exe
      C:\Temp\i_oigdbvtqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayqolgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4844
  - - C:\Temp\gayqolgdyw.exe
      C:\Temp\gayqolgdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayqolgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3020
  - - C:\Temp\i_gayqolgdyw.exe
      C:\Temp\i_gayqolgdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdbvtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:124
  - - C:\Temp\fdbvtnlfdx.exe
      C:\Temp\fdbvtnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdbvtnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\i_fdbvtnlfdx.exe
      C:\Temp\i_fdbvtnlfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcavsnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5144
  - - C:\Temp\fcavsnkfcx.exe
      C:\Temp\fcavsnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcavsnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1668
  - - C:\Temp\i_fcavsnkfcx.exe
      C:\Temp\i_fcavsnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpmkfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1488
  - - C:\Temp\xvpmkfcxvp.exe
      C:\Temp\xvpmkfcxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpmkfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5000
  - - C:\Temp\i_xvpmkfcxvp.exe
      C:\Temp\i_xvpmkfcxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\keczxupmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2580
  - - C:\Temp\keczxupmhc.exe
      C:\Temp\keczxupmhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_keczxupmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\i_keczxupmhc.exe
      C:\Temp\i_keczxupmhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezxrmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\jhezxrmkec.exe
      C:\Temp\jhezxrmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezxrmkec.exe ups_ins
    3⤵
    PID:4888
  - - C:\Temp\i_jhezxrmkec.exe
      C:\Temp\i_jhezxrmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwtoljhbw.exe ups_run
    3⤵
    PID:1556
  - - C:\Temp\ecwtoljhbw.exe
      C:\Temp\ecwtoljhbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwtoljhbw.exe ups_ins
    3⤵
    PID:392
  - - C:\Temp\i_ecwtoljhbw.exe
      C:\Temp\i_ecwtoljhbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtoljdbvto.exe ups_run
    3⤵
    PID:3724
  - - C:\Temp\vtoljdbvto.exe
      C:\Temp\vtoljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtoljdbvto.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_vtoljdbvto.exe
      C:\Temp\i_vtoljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbywqgdyw.exe ups_run
    3⤵
    PID:1740
  - - C:\Temp\igbywqgdyw.exe
      C:\Temp\igbywqgdyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbywqgdyw.exe ups_ins
    3⤵
    PID:5128
  - - C:\Temp\i_igbywqgdyw.exe
      C:\Temp\i_igbywqgdyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oifdyvqnlg.exe ups_run
    3⤵
    PID:3432
  - - C:\Temp\oifdyvqnlg.exe
      C:\Temp\oifdyvqnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oifdyvqnlg.exe ups_ins
    3⤵
    PID:1424
  - - C:\Temp\i_oifdyvqnlg.exe
      C:\Temp\i_oifdyvqnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    PID:2268
  - - C:\Temp\davtnlfdxv.exe
      C:\Temp\davtnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    PID:6052
  - - C:\Temp\i_davtnlfdxv.exe
      C:\Temp\i_davtnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkfcaxvp.exe ups_run
    3⤵
    PID:2908
  - - C:\Temp\vpnkfcaxvp.exe
      C:\Temp\vpnkfcaxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnkfcaxvp.exe ups_ins
    3⤵
    PID:4044
  - - C:\Temp\i_vpnkfcaxvp.exe
      C:\Temp\i_vpnkfcaxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnhfzxvpn.exe ups_run
    3⤵
    PID:3032
  - - C:\Temp\vsnhfzxvpn.exe
      C:\Temp\vsnhfzxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnhfzxvpn.exe ups_ins
    3⤵
    PID:5864
  - - C:\Temp\i_vsnhfzxvpn.exe
      C:\Temp\i_vsnhfzxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmhecwurp.exe ups_run
    3⤵
    PID:5804
  - - C:\Temp\usmhecwurp.exe
      C:\Temp\usmhecwurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmhecwurp.exe ups_ins
    3⤵
    PID:4836
  - - C:\Temp\i_usmhecwurp.exe
      C:\Temp\i_usmhecwurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffdbb2ac188,0x7ffdbb2ac194,0x7ffdbb2ac1a0
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2384031634536678041,988592395950957020,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16420315823668932517,12598458475909097398,262144 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,11390145714188610015,9355214164237044131,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,2729471236704448707,16464372756954601336,2097152 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,17562945887443476861,417728493058716362,2097152 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,4728916697404005741,11202378041630213990,2097152 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,14389758773118414242,50789875845995254,2097152 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,7694740211458826616,10684391049840973075,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,6103810522186345615,6088075401431352890,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,12011809479821033482,232522425748037793,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14646785793966911155,9955581443046798143,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14646785793966911155,9955581443046798143,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12710796221484338145,15110996202671906589,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14595532229860097401,12898923159151389203,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,3184801288837669608,4103298013270777334,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,2580754411791646799,1245414730384258926,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,15532039361190823900,5370127029712551254,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,376748129529100132,10511223105147696785,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,1456438888366849511,12866234690059200197,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,6564018238156701079,5323280881090338834,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,1127165177893106576,13656181944189240794,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6356,i,3344923847579922410,116811848694899449,262144 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:10
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,6629593562663719407,12725640166744465193,524288 --field-trial-handle=2300,i,14661009138187807004,14511019203768943016,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

C:\Temp\pkhcausmkifdxvpn.sys
C:\Temp\pkhcausmkifdxvpn.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1748

C:\Temp\cxupmkfcwu.sys
C:\Temp\cxupmkfcwu.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\jhbzxrojhe.sys
C:\Temp\jhbzxrojhe.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\rljhbztrmj.sys
C:\Temp\rljhbztrmj.sys
1⤵
- Executes dropped EXE
PID:5296

C:\Temp\ywqomgebwt.sys
C:\Temp\ywqomgebwt.sys
1⤵
- Executes dropped EXE
PID:484

C:\Temp\idbvtnlgdy.sys
C:\Temp\idbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:3076

C:\Temp\ysqkidaysq.sys
C:\Temp\ysqkidaysq.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\ifdavsnkfc.sys
C:\Temp\ifdavsnkfc.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\kicspnhfzx.sys
C:\Temp\kicspnhfzx.sys
1⤵
- Executes dropped EXE
PID:392

C:\Temp\xrpnhfzxrp.sys
C:\Temp\xrpnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\mkecwupmhe.sys
C:\Temp\mkecwupmhe.sys
1⤵
- Executes dropped EXE
PID:4044

C:\Temp\gecwuomgez.sys
C:\Temp\gecwuomgez.sys
1⤵
PID:4480

C:\Temp\dbyojgeywq.sys
C:\Temp\dbyojgeywq.sys
1⤵
PID:1776

C:\Temp\jdbvtrljdb.sys
C:\Temp\jdbvtrljdb.sys
1⤵
PID:4444

C:\Temp\qlidavtqol.sys
C:\Temp\qlidavtqol.sys
1⤵
PID:2840

C:\Temp\icaysqkica.sys
C:\Temp\icaysqkica.sys
1⤵
PID:3452

C:\Temp\lfdxsqkica.sys
C:\Temp\lfdxsqkica.sys
1⤵
PID:1920

C:\Temp\ausnkecxup.sys
C:\Temp\ausnkecxup.sys
1⤵
PID:5796

C:\Temp\rpjhczusmk.sys
C:\Temp\rpjhczusmk.sys
1⤵
PID:484

C:\Temp\uomjhbzwro.sys
C:\Temp\uomjhbzwro.sys
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxupmkfcwu.sys

Path C:\Temp\cxupmkfcwu.sys
Size 293KB
SHA256 b721ca9801e5b407506f1389fdf00afafcd1c4380b65302f4981a3702d2be2da
MD5 7941166420a24224e7b9e418c3135691
SHA1 a9131ce4ab40f2ec617734672f297a72b059bc70
SHA512 911108983d0229ea6289049e05402b70e27566e9bd09633ccf8d98453e4cb6cd676ddccc2430346d80045e062c9c2fa5296e74d84bd61b4a02b56d9e371aff90
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayqolgdyw.exe

Path C:\Temp\gayqolgdyw.exe
Size 365KB
SHA256 2e411654a5da423ab000eb7462bd2c830cb74d122a1d9af4c60c1fa5638988e2
MD5 3b5e44c503ab5228893bcce5679ded45
SHA1 0cec1e37ab9ec77eca73b851c10f2a92db633b42
SHA512 16d7280a3633c0a50bb807059a9a26b3cbf4333bb4659572421622ee4d5d456e35f5ae1576a7c57616290528b32f9b4789bbc68619001c5d0e15005f7dbc4eb6
SSDEEP 3072:NuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurpjhbw.exe

Path C:\Temp\hbzurpjhbw.exe
Size 365KB
SHA256 9b29e82589d25105b4e7c666c8b802925df4f2825a62cc5fc334d0c37b7ce63c
MD5 57379db899fbf0aa73c8dbe722233228
SHA1 a8fe4bd64121b5fdd5fb5b48ed1cf133a322e8a9
SHA512 83c63bfaba39b5aef49994906d882aad5d17996e4cc1d60b4c33034752ed09e051a4ac67fb0888cbd71b0bbf87d51421729517d7204e46ab5ed9e3fc125ba20d
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzurpjhbw.exe

Path C:\Temp\i_hbzurpjhbw.exe
Size 365KB
SHA256 1a3656a92d4ddd86f3e753295faf98b4442b00e314be5afcc40d95a6d8f1173f
MD5 8a2a903e62f855b7ddcfcd0eb5c2661a
SHA1 c5eb7a6465035c040620ce58e1d0c16de76c3b04
SHA512 49acdeb9216777153d1e99d095d2f9aabe0ed3d102ee6f4db50a8eac5642c61a46eb3a9ed1794902376c53e76ab447f317605cc84685866e4a654cbfd9de6c5d
SSDEEP 3072:8uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcausnkf.exe

Path C:\Temp\i_nkfcausnkf.exe
Size 365KB
SHA256 2af54f5d263c37c0e2e5e1db3b5ef2bec59569cea3335f73f64c89c1204df183
MD5 b7836b965913b0ad4573c2896045ecbf
SHA1 c894e578d115c0f84d2e57a78afd1c346adbbc11
SHA512 534f1db9f926ccc7c75e8a49726730fad30e2419f3619d340abd3b4b8798082197fc5aea5e05304feb4556e8342f3a819591a79a78174ce1492dc43941ac6514
SSDEEP 3072:MuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigdbvtqlj.exe

Path C:\Temp\i_oigdbvtqlj.exe
Size 365KB
SHA256 a74c6e390f941be552433f7d4e21111ed0ef916e10ee3f2d367072451fccc0af
MD5 88b462c5255fd54bbe6b3861c96b8ee4
SHA1 d86e7e54725781383c2f1ce302c4f46a90a1b19c
SHA512 803356c41a998fd6fa2ac6c50f8fc335538ed6c7f1df6bbff81fbf98aa5ed83a033c05d141e7d1bc9e7da5653f1498ce474db2dec9bc3ed9778c49d0ff9eb6f6
SSDEEP 3072:nuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjebwromg.exe

Path C:\Temp\i_omjebwromg.exe
Size 365KB
SHA256 883d4f8e31c2981dcfdd3173e7a9404c0dbe44c8c571c16dd438aa345f41a9ae
MD5 0fdf3d30e4479e54d152642d79468ec4
SHA1 f220bcdf6d4abcfef524ca79e98dfc7b3439ff1e
SHA512 0c5f49b0afda7f1f25c7ff9f91cbfca5309855a68263def1675f7f8e310ea5a7cc77f6ba4274826c58bda454628a45ee44b00b30ae2d8e89ae6d282c9a9c2518
SSDEEP 3072:suxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wupmhezxrp.exe

Path C:\Temp\i_wupmhezxrp.exe
Size 365KB
SHA256 626686c1afd3ea4cc22cf29213ac6a4e0b3f803e0b5219ba131a558551144cde
MD5 0c8170256304023dcef0dd670a132fa1
SHA1 fdb91da6e6c660caa04d154b362944039b2ca72e
SHA512 5991ca30bea099170e5a09870add03009f2c7b35c10bebf2c1c3070e4d4c1a4874537c36747038ab6ed6ce429b85824d9c643e342b217727233aa40e0490b97b
SSDEEP 3072:TuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgdy.sys

Path C:\Temp\idbvtnlgdy.sys
Size 293KB
SHA256 e93cc46a6b1154ef00e390261ab6d62a0b8ac9bd984935ae23ca9b5b14191350
MD5 33050e9a55e3a396b71613cdda4ff29f
SHA1 b2053fae8276a4e5820ae848f529c1cfc5aa9919
SHA512 7879c5ba8ca58fa3c882c7a149f3394ce4abccef1e5405f045b31997fe074c07d8ee965861229e5c865a387388b171971e32bfbe154dd739fdc8bc82ca15dfd1
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzxrojhe.sys

Path C:\Temp\jhbzxrojhe.sys
Size 293KB
SHA256 5533c365c5bc7e9a9f4eaeb9cab0b3fba3f3c14e86ea5d5f5baaf16bd589ea72
MD5 ab6931d5c8b8025d7514d5223e2b24d2
SHA1 08bb4804b4d58b9d1013454bb0f90f9e451f873a
SHA512 5a5ea578738e88a9ec32b1efb66b51bec79ff566c3431f4523efb289e224b7b3942a39e3ab7b30c26855d0ef99d01c293177c07e69bde0428cbbf029f2eff45c
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcausnkf.exe

Path C:\Temp\nkfcausnkf.exe
Size 365KB
SHA256 1c0e064fb2169ec0be3a29f9fc9cfa6fd1002364abc48e332f47b92c0a54c99a
MD5 58c76f5fc11fe635202919cd74f859f4
SHA1 5507db9b31d857806612cb4da1270432ae64e9b7
SHA512 b5cf2f765cebecc96f41a5bc5f8d42e7c30b89570ee400873f8f9341ac65dcd3e2ae6661ce229dcfc7279ce092918e3188b2721ed46a8c4ad7bef8c9b5f7a98d
SSDEEP 3072:juxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:juxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdbvtqlj.exe

Path C:\Temp\oigdbvtqlj.exe
Size 365KB
SHA256 8032f58694a3a7397994217c573c8c355d39a4eb193eac89404fece687d70910
MD5 a4ec53ae2f1e9e23a34fbb11ae3b6da2
SHA1 545b00f09b96cc6b7afe9795d3634124fa5d92de
SHA512 cb307efa2f2c29f476208602f594969ae6f9beb771b1c65ad1772e1a6df80ce4c00ec82ca1536a567510578faeaedb55a3bc416f8df3db8422dcd438c9f389c2
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebwromg.exe

Path C:\Temp\omjebwromg.exe
Size 365KB
SHA256 0f48186f9a2ab15d8edd51418c5e007845b3b562ecbd38af37ecc8519e7206b9
MD5 f2157a7172fb4465ce79b7ec8f30ce4a
SHA1 b22d44481a96a9fd8ab1a5ddc77db6c0fae6bf11
SHA512 31c0a8a51c40c79c93766978b5cbbc078f2ab3c8de6283128093ba7b86c45cd9213d82358960ca06f2c920005d1732e120e9af75a0fdbdf3c6804c0777a0fb62
SSDEEP 3072:2uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkifdxvpn.exe

Path C:\Temp\pkhcausmkifdxvpn.exe
Size 365KB
SHA256 409189a399b2ff3ce986c798da79ecb5cc9de698d9c146f4a927a7328a6f6802
MD5 c6590fcd929b4edfafe1589065e6b66d
SHA1 7afcb457b9f628172d3215860c704742431b85a7
SHA512 d2b0d7ca952e18937abc89c5615c251b4e736e38c87c0fe83c33700d4fb7c18495db5a30a43ae3baedfb95b923284d14ff183853e8547bca4cd4c2374847c2ff
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkifdxvpn.sys

Path C:\Temp\pkhcausmkifdxvpn.sys
Size 293KB
SHA256 3a28c198a0b3cd954c33028281aa2cd4d4c0610b5d492297061c04cf1e7c9ce7
MD5 21c9261a067aec89cb8f39825d5489fb
SHA1 fa709edaa6331b9669eb137e9b31513b9d17cdc6
SHA512 9e9166d14248f3ba0145355692ecebbaf548caf2da5704e301fac47525489f749c2ef26b632d3bf028c7f2573da1ad8006b71b86a06c30b99e619b3d948a7794
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljhbztrmj.sys

Path C:\Temp\rljhbztrmj.sys
Size 293KB
SHA256 5c11de76eb7039f808ce4cbd38b43a69fbdd7050a7fd163a38d70f3460fcd20d
MD5 6addb57e2db0d57d42200e2bc214e5ba
SHA1 b087dce2bf7174c5e88ebd9de8dca584099d3d55
SHA512 829d402bcc85b402172d5059266c975f1b0791036d25750232227b4eb08b77194da4113a9b87c43d4bd99a7efb6e96bd6d61d2bce3a69ea3bbf99b8dd8e7084e
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhezxrp.exe

Path C:\Temp\wupmhezxrp.exe
Size 365KB
SHA256 3cef6ea0a220c2aed8f7ec5df68a6245a0d6a3a72ff2489943a0dfb861a3547f
MD5 2208a20ed625530e6ad0596f8251a379
SHA1 b2ad5e28137404152051dea52f371da08a6701df
SHA512 f3f6ee8cff3cdc6c9f4ef22f545a96f54b755bb949dd0fd5acccb81c6d0fa8d93dea70265cdae793173b996346bb3d19eb2f5c8c7b40855d5b4524e73a920b91
SSDEEP 3072:duxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T122847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgebwt.sys

Path C:\Temp\ywqomgebwt.sys
Size 293KB
SHA256 049cf3aa81e6f48c006275c80743667eb976e650e3e403879890bcd2491a45d3
MD5 5427d001e7c0834deda131ef62b209b3
SHA1 6aca2d96a8956d0a63b8a2e4ab5fd350509a037e
SHA512 b4abc5e33b59cca4bd294c8f20d4407af554d7bfbe9a203a0d98171da81eff74bd5c093b0aa9a3b5228941737f603eef2e4c278cd387f6b46a33d92ab1273384
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1a7a7996e1f4e931b7603e1968fe12d9e39b9789e42743e5e19b2f038c0ae348
MD5 2259357275ce0c39a00843b9f64e5769
SHA1 cd85778832f9e038ae07db2e8655f0cf9b3094f3
SHA512 d566715ee256969a90a3e65507a8a652d87d50c7252ea34034960a55d37978db6c5ffdfcd65bc23ca38bea71ba0e4576ca1000bfad9642d5c4c9f3f46b6d3dba
TLSH
T1BD51D69E03321AC0E79760B664E4158933F6A60A0A0B5E335750AF337A4BF19E1FE103
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3efe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3efe.TMP
Size 3KB
SHA256 5c9b203e3b863a997cebd7e07e366e60871a94b2497108f23153a388c7823f2c
MD5 14d5d749a3d7f739d5bd99c05e7ef4f9
SHA1 6a59a4406a3490ba4531b371c0f15003898cf120
SHA512 0fb50566f0733305d63923e0a92aff18696d6eec3957086a41197a85b932baed555543c6522304ea7ee66ba51055380af9b1b6ac96b06be6525d7b763aaa5cd4
TLSH
T11D51B69E03221AC0E7A760B664E4558937F6A60A0A0B5E335754AF337A4BF19E1FE113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4808c908cf6ef3c0fd9624d032d037f7c4688f62404db8739d6149552819f363
MD5 4b2b07fc5e2b7fe7a7dc4bd2081c0487
SHA1 551c7e8d5ebdeab27e189ac6784a4fa7047040a9
SHA512 e804fca600c830fe5a36f05c918a726ac2537acafd5ffe05144cb8f5aa5ede71ba7d263dd69213bcdd1fda724b7a2b86271a0b69e1c3cf162e4b6a374ece9a54
TLSH
T11741DFF383F4852E8A1196F0AB186E1FCE1C0515432C7D5AC9E09E2B93E3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad05e2c63287dfd8e5a3c6dfcd45da3265ba5e321c602cd9134a421e823ab78d
MD5 ae1599150360d70c16acde72246e5f62
SHA1 2ebb1bd5f00b373ae4f64b6cf528dd5c5f440f72
SHA512 4a68b9d1151184084fa16d45d2f48d246d600529d36f9a4af3dbc467f991197aad9a7cb1719cc39cd8cf967a6981ea7baab7c533d6cb13cf2af497849fe886f9
SSDEEP 192:sxRQRjCG/fIsdEPZxt7zoD8p9U/g6+WNCdj/YCGMuOaGpIgV1J:sxRQwG/fIsdERTjq/5Q/7bh
TLSH
T1D742C9166D68AD3B8CD7E30DBA15BF53D6F95032A1D12E49EAFC8A1C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bb40e60243a2f27079a592082f17d8b75582fd53b4d17e288f84b7962d01c3af
MD5 44e925bd096b697a38f51b0cfc3effcf
SHA1 aaa371ded8580a4b613d737e45c47870a976fdb8
SHA512 5cf821ae115cce5e373227868fbc9c75ef3aa94b0f426ecbdb8272c0f4f8ad67a273986a54550b2a20670d6976b66bbadfe90e452a572f6dca5d0f1644be3562
SSDEEP 192:sxRPRjCG/fIsQEPZxt7zoD8p9U/g6+WNCdj/YCGMuOaGpIgDh1J:sxRPwG/fIsQERTjq/5Q/7bZ
TLSH
T1DD42D8166D68AD3B8CD7E30DBB55BF53D2F95032A1D12E48AAFC8B1C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4ded4953537bd7bdcdb4ff69c48f8c66e8264465063952e38cdd846082ac6dcf
MD5 1778616686ccd70a7858957bcb7e564f
SHA1 25df003b1aa88d0b85775737a7f33e8b3e63c79f
SHA512 eb7dc9116e355d1c2ef91620f169fcbb456ed4810966f6e88c8800b800011b7661baf8424521998b53f3e1e5baa091a043178bca5abe2b683e942971a3dfd50e
SSDEEP 192:sxRPRjCG/fIsQ/PZxt7zoD8p9U/g6+WNCdj/YCGcuOaGpIgDL1J:sxRPwG/fIsQ/RTjq/5Q/lb/
TLSH
T10C42C7166D68AD3B9CD7E20DBB55BF53D3F9503291D12E48AAFC8B1C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2929c79e44d4fee7729cf5dd6fb2d53d4ef86f31833150eeba56dbe905683e18
MD5 78d9c68f9329666b67df1f3a1c42e116
SHA1 d8a1e3464fb1e1b183c6be297c07b6025faa08a5
SHA512 9256b5f5165cdafdb2d70437b6d6738051970f65d7439ced55ac70af8b48e0852e7a0d71d743a14fb942eedf52fd6cb3bef369d6b4177f2d0d091829ed60c46b
SSDEEP 768:jC+v3N7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUL0QqcaroZJD:jC+v37E7JQWgQ+f4+u1ja3L0VcRzD
TLSH
T104D2EA7B640DCB7F4F804A9DEC197ADF6DA802CB9698CD4047FA941C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad9a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad9a8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 30b013a5a9c66429117e255742a1ec568b27d6a47c392715ea1e1a12b4edeb54
MD5 728a9c2cd7c182245fcdabdb27b6df02
SHA1 da6fa9a06120bd8fffcc2f2fce1161f72753c68c
SHA512 1834602b9695bee79a1372888def344038935da9c919c34194820c9a642257f338c2b8245e8c1bb5c025cfcd582723d8d75b4400985e7d9720225e773c5611d8
SSDEEP 768:Irv+4UNbdD3MceNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp3aL8+p3Z6n4yu0ww
TLSH
T12203CE73F8A899739CF6C644B2467A437FF821A396C10EC4D5DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 840e413dfb4ef82a38066ead36615f0fe1a5dd764d41233709b12fe0e3f9c492
MD5 3f0fdabd9d7e97065c7861ecb74964a3
SHA1 7925d72fe008989d42baa2c3c985978c9748b44d
SHA512 77f59f6c461fc94b915161014c547e107dee0f4d9072586805f7c2807f322c6d440048689caa5f004592d317da7996242376a7f89a7da557df078cd10ba09d5e
SSDEEP 768:9FQA3Iwglbm7p8+p3bd66j+4BRv86aLIWlPi9P0tp:MA3hd8+p3Z6n4y7Pjtp
TLSH
T1251338F198D7D936D8AD8783A37D6E429EBCC163B5845894B7C85E0CCC861BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a5295edc4508d2a8c2f32ca9582e21e6b19039365dd12ab9c32e540bfc6d337a
MD5 8be3dd23bbe2ef0fac61a60ef242bfe2
SHA1 caa1730edf8dd2e1df8f5ba9be8e591dd8ea3476
SHA512 01499af7ca04e232f82181a041f111294ec97a856592a2c79b86facde943ed004f00ae36c852729756fcf9ed39b9cffcd49f27fa21d3707b85974aa286e62cc7
SSDEEP 768:Frv+4UNbdE3PsHa2p8+p3bd66j+4BRv86aLIWl2bwClP:Fbsby3Gag8+p3Z6n4y70w6
TLSH
T1F013BF72F8ACED738CFAD604B15676837FB821A399C10ED4D5D96B4E004A19F270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 52718422eea1e4bfd762cf8543ca9b37882105ce8d5632bccbfa8a84d9f06cf0
MD5 7d291135691d62b097f9f6b1da269aae
SHA1 5acb05c98fbbea724aa81f1e33682a3f39e11f1a
SHA512 9e43efc607cf782e2e130be5859636da3ac59c3f4637f2ea567505ea79588978e81cc29b86823ea57c9ced0e6f230e75743394e46a1514fdc2e7dbb7900be4b7
SSDEEP 768:Xrv+4UNbdD3faHaNp8+p3bd66j+4BRv86aLITl2bwCl1:Xbsbp3waL8+p3Z6n4yI0ww
TLSH
T1C403BF72F498E9739CEAC644B14677837FF821A399C10EC4D9D96B4E004A29E370B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f9c8b7cdf0d081c7d3ac4f1955364bd0a8a3a8d2270af25b9dabd09cf426c7f4
MD5 c96cc99d820fbb91d45f47b0e241c26f
SHA1 37e0803b449dfdc64afbc1bc6598a7ef1ee01966
SHA512 a37a75d541b1bd83f262245dfd0a40bd526ac27c4ef1cab9d1e67c1425a819c683b33192506dee9d1f72498d773fb42e6a16034e60912ed33c3fec56448066fd
SSDEEP 768:zz3ssHa1p8+p3bd66j+4BRv86aLIWlPi9P0tp:zz3XaD8+p3Z6n4y7Pjtp
TLSH
T12DF2AEB1F8A9ED638CF9D744B2963743AFF41163A5C01D98D5DCAB0D018715E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1096_1597821631\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 306b83380d1666da235f02600c9e0553c4b117e7833e938bd2c3883c99e572f3
MD5 920119208ceb0523a8fda957356009ee
SHA1 d2df2664902aecca2f0a15653472cac9406a34db
SHA512 62c86595cbb33c863d9d8eba50222a4e61bb09a52e959b3aa850ea3911bb55893b5478dc514e3e45635955180dfe15c864fc99487cc9f15ab19346b3224a8ce6
TLSH
T17071009356ADDAB2C1DA5BF203835644F6BF22380B23702447555986AA34A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/484-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/484-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/908-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1920-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2840-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3076-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3452-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4044-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4444-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4984-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5296-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5796-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download