systex | f93b16ca93d83c073cba44a461d890635131bb55dd77aa73445d6e80b493461a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260816-tyjy6sel2y
SHA256 f93b16ca93d83c073cba44a461d890635131bb55dd77aa73445d6e80b493461a
MD5 f3dcf872ab7600c846ae0e3c11908991
SHA1 54ce55dd40dcfc549c5c62fdd973a93a32b5bc54
SHA512 f699c72e1002c04d80fee1855c0ad22da2c84cb407aac21c9a89a657851c6e1f71938ef32b903994c04f1c31a610878eba6d5c0a1f7d9ca77a9000128bd9af89
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BA847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1476	gaytqljdbvtnlgdb.exe
5816	gaytqljdbvtnlgdb.sys
5296	CreateProcess.exe
3156	idbvtnlgay.exe
5828	CreateProcess.exe
1028	CreateProcess.exe
3148	i_idbvtnlgay.exe
5816	avsqlfdbvs.sys
2264	CreateProcess.exe
4324	sqnifaxvtn.exe
5208	CreateProcess.exe
2024	CreateProcess.exe
2608	i_sqnifaxvtn.exe
4900	fdxvqnlfdx.sys
4492	CreateProcess.exe
5064	snkfcausqk.exe
2892	CreateProcess.exe
2080	CreateProcess.exe
5760	i_snkfcausqk.exe
696	spkhfaxspk.sys
4708	CreateProcess.exe
4924	spnhfaxvpn.exe
5188	CreateProcess.exe
4868	CreateProcess.exe
248	i_spnhfaxvpn.exe
5596	usmkeczxup.sys
5356	CreateProcess.exe
948	usmhecxupn.exe
1892	CreateProcess.exe
5452	CreateProcess.exe
2532	i_usmhecxupn.exe
4992	urpjhezxrp.sys
5016	CreateProcess.exe
2360	urmkecwuom.exe
4556	CreateProcess.exe
2852	CreateProcess.exe
3280	i_urmkecwuom.exe
4684	pjhbztrmjh.sys
4780	CreateProcess.exe
5752	bywrljhbzt.exe
1576	CreateProcess.exe
5136	CreateProcess.exe
2748	i_bywrljhbzt.exe
1804	ebwuomgdbw.sys
5440	CreateProcess.exe
2104	jdbwtoljdb.exe
5524	CreateProcess.exe
1716	CreateProcess.exe
5484	i_jdbwtoljdb.exe
4460	igbytqoidb.sys
5936	CreateProcess.exe
3716	dbvtqljgbv.exe
2520	CreateProcess.exe
5536	CreateProcess.exe
2220	i_dbvtqljgbv.exe
3280	yvtnlgdxvs.sys
4604	CreateProcess.exe
200	bvtnlfdxvq.exe
1252	CreateProcess.exe
4572	CreateProcess.exe
4700	i_bvtnlfdxvq.exe
1248	lfdbvsnlfd.sys
5912	CreateProcess.exe
5224	axsqkicavs.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5488_1119981339\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5488_383096425\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5488_383096425\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5488_284614767\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5488_284614767\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromgebtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcausqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnicaxsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbvtnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifaxvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupjhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromgebtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmhecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmhecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnicaxsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupjhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifaxvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcausqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6052	ipconfig.exe
4900	ipconfig.exe
1540	ipconfig.exe
2460	ipconfig.exe
1464	ipconfig.exe
1200	ipconfig.exe
1260	ipconfig.exe
2588	ipconfig.exe
1708	ipconfig.exe
4416	ipconfig.exe
4532	ipconfig.exe
4152	ipconfig.exe
5380	ipconfig.exe
6108	ipconfig.exe
1700	ipconfig.exe
944	ipconfig.exe
2988	ipconfig.exe
3396	ipconfig.exe
3372	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313712852413890"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{61E26D9A-C312-4FEE-B3CF-A9417C071FCF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe
1476	gaytqljdbvtnlgdb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	i_idbvtnlgay.exe
Token: SeDebugPrivilege	2608	i_sqnifaxvtn.exe
Token: SeDebugPrivilege	5760	i_snkfcausqk.exe
Token: SeDebugPrivilege	248	i_spnhfaxvpn.exe
Token: SeDebugPrivilege	2532	i_usmhecxupn.exe
Token: SeDebugPrivilege	3280	i_urmkecwuom.exe
Token: SeDebugPrivilege	2748	i_bywrljhbzt.exe
Token: SeDebugPrivilege	5484	i_jdbwtoljdb.exe
Token: SeDebugPrivilege	2220	i_dbvtqljgbv.exe
Token: SeDebugPrivilege	4700	i_bvtnlfdxvq.exe
Token: SeDebugPrivilege	4976	i_axsqkicavs.exe
Token: SeDebugPrivilege	5448	i_qnicaxsqkf.exe
Token: SeDebugPrivilege	5328	i_hcausmhfzx.exe
Token: SeDebugPrivilege	5252	i_zwupjhfzxr.exe
Token: SeDebugPrivilege	1640	i_uomgeywroj.exe
Token: SeDebugPrivilege	3420	i_tromgebtro.exe
Token: SeDebugPrivilege	1712	i_lgdbvtoljd.exe
Token: SeDebugPrivilege	3368	i_aywqoigdys.exe
Token: SeDebugPrivilege	2760	i_ifaxvtnlfd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1476	4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4560 wrote to memory of 4960	4560	2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4960 wrote to memory of 5488	4960	iexplore.exe	91
PID 5488 wrote to memory of 3424	5488	msedge.exe	92
PID 5488 wrote to memory of 2340	5488	msedge.exe	93
PID 5488 wrote to memory of 3548	5488	msedge.exe	94
PID 5488 wrote to memory of 2340	5488	msedge.exe	93
PID 5488 wrote to memory of 2340	5488	msedge.exe	93
PID 5488 wrote to memory of 708	5488	msedge.exe	95
PID 5488 wrote to memory of 708	5488	msedge.exe	95
PID 5488 wrote to memory of 3008	5488	msedge.exe	97
PID 5488 wrote to memory of 3008	5488	msedge.exe	97
PID 5488 wrote to memory of 3088	5488	msedge.exe	98
PID 5488 wrote to memory of 3008	5488	msedge.exe	97
PID 5488 wrote to memory of 3088	5488	msedge.exe	98
PID 5488 wrote to memory of 3088	5488	msedge.exe	98
PID 5488 wrote to memory of 1160	5488	msedge.exe	99
PID 5488 wrote to memory of 1160	5488	msedge.exe	99
PID 5488 wrote to memory of 1160	5488	msedge.exe	99
PID 5488 wrote to memory of 3936	5488	msedge.exe	100
PID 5488 wrote to memory of 3936	5488	msedge.exe	100
PID 5488 wrote to memory of 3936	5488	msedge.exe	100
PID 5488 wrote to memory of 796	5488	msedge.exe	102
PID 5488 wrote to memory of 796	5488	msedge.exe	102
PID 5488 wrote to memory of 2424	5488	msedge.exe	105
PID 5488 wrote to memory of 5644	5488	msedge.exe	106
PID 5488 wrote to memory of 2424	5488	msedge.exe	105
PID 5488 wrote to memory of 5644	5488	msedge.exe	106
PID 1476 wrote to memory of 5296	1476	gaytqljdbvtnlgdb.exe	107
PID 5488 wrote to memory of 2508	5488	msedge.exe	111
PID 3156 wrote to memory of 5828	3156	idbvtnlgay.exe	113
PID 5488 wrote to memory of 5536	5488	msedge.exe	117
PID 5488 wrote to memory of 5536	5488	msedge.exe	117
PID 5488 wrote to memory of 3364	5488	msedge.exe	118
PID 5488 wrote to memory of 3364	5488	msedge.exe	118
PID 1476 wrote to memory of 1028	1476	gaytqljdbvtnlgdb.exe	119
PID 1476 wrote to memory of 2264	1476	gaytqljdbvtnlgdb.exe	123
PID 4324 wrote to memory of 5208	4324	sqnifaxvtn.exe	125
PID 1476 wrote to memory of 2024	1476	gaytqljdbvtnlgdb.exe	128
PID 1476 wrote to memory of 4492	1476	gaytqljdbvtnlgdb.exe	132
PID 5064 wrote to memory of 2892	5064	snkfcausqk.exe	134
PID 1476 wrote to memory of 2080	1476	gaytqljdbvtnlgdb.exe	137
PID 1476 wrote to memory of 4708	1476	gaytqljdbvtnlgdb.exe	142
PID 4924 wrote to memory of 5188	4924	spnhfaxvpn.exe	144
PID 1476 wrote to memory of 4868	1476	gaytqljdbvtnlgdb.exe	147
PID 5488 wrote to memory of 3100	5488	msedge.exe	149
PID 5488 wrote to memory of 1000	5488	msedge.exe	150
PID 5488 wrote to memory of 3848	5488	msedge.exe	151
PID 1476 wrote to memory of 5356	1476	gaytqljdbvtnlgdb.exe	154
PID 948 wrote to memory of 1892	948	usmhecxupn.exe	156
PID 1476 wrote to memory of 5452	1476	gaytqljdbvtnlgdb.exe	159
PID 1476 wrote to memory of 5016	1476	gaytqljdbvtnlgdb.exe	163
PID 2360 wrote to memory of 4556	2360	urmkecwuom.exe	165
PID 1476 wrote to memory of 2852	1476	gaytqljdbvtnlgdb.exe	168
PID 1476 wrote to memory of 4780	1476	gaytqljdbvtnlgdb.exe	172
PID 5752 wrote to memory of 1576	5752	bywrljhbzt.exe	174
PID 1476 wrote to memory of 5136	1476	gaytqljdbvtnlgdb.exe	177
PID 1476 wrote to memory of 5440	1476	gaytqljdbvtnlgdb.exe	181
PID 2104 wrote to memory of 5524	2104	jdbwtoljdb.exe	183
PID 1476 wrote to memory of 1716	1476	gaytqljdbvtnlgdb.exe	186
PID 5488 wrote to memory of 2740	5488	msedge.exe	188
PID 5488 wrote to memory of 2740	5488	msedge.exe	188
PID 1476 wrote to memory of 5936	1476	gaytqljdbvtnlgdb.exe	194
PID 3716 wrote to memory of 2520	3716	dbvtqljgbv.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f3dcf872ab7600c846ae0e3c11908991_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Temp\gaytqljdbvtnlgdb.exe
  C:\Temp\gaytqljdbvtnlgdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlgay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5296
  - - C:\Temp\idbvtnlgay.exe
      C:\Temp\idbvtnlgay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\i_idbvtnlgay.exe
      C:\Temp\i_idbvtnlgay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifaxvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2264
  - - C:\Temp\sqnifaxvtn.exe
      C:\Temp\sqnifaxvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifaxvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2024
  - - C:\Temp\i_sqnifaxvtn.exe
      C:\Temp\i_sqnifaxvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfcausqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4492
  - - C:\Temp\snkfcausqk.exe
      C:\Temp\snkfcausqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfcausqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2080
  - - C:\Temp\i_snkfcausqk.exe
      C:\Temp\i_snkfcausqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4708
  - - C:\Temp\spnhfaxvpn.exe
      C:\Temp\spnhfaxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4868
  - - C:\Temp\i_spnhfaxvpn.exe
      C:\Temp\i_spnhfaxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmhecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\usmhecxupn.exe
      C:\Temp\usmhecxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmhecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5452
  - - C:\Temp\i_usmhecxupn.exe
      C:\Temp\i_usmhecxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5016
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2852
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywrljhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4780
  - - C:\Temp\bywrljhbzt.exe
      C:\Temp\bywrljhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywrljhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5136
  - - C:\Temp\i_bywrljhbzt.exe
      C:\Temp\i_bywrljhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtoljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5440
  - - C:\Temp\jdbwtoljdb.exe
      C:\Temp\jdbwtoljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtoljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1716
  - - C:\Temp\i_jdbwtoljdb.exe
      C:\Temp\i_jdbwtoljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqljgbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\dbvtqljgbv.exe
      C:\Temp\dbvtqljgbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqljgbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5536
  - - C:\Temp\i_dbvtqljgbv.exe
      C:\Temp\i_dbvtqljgbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4604
  - - C:\Temp\bvtnlfdxvq.exe
      C:\Temp\bvtnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\i_bvtnlfdxvq.exe
      C:\Temp\i_bvtnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5912
  - - C:\Temp\axsqkicavs.exe
      C:\Temp\axsqkicavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    PID:5732
  - - C:\Temp\i_axsqkicavs.exe
      C:\Temp\i_axsqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnicaxsqkf.exe ups_run
    3⤵
    PID:5408
  - - C:\Temp\qnicaxsqkf.exe
      C:\Temp\qnicaxsqkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnicaxsqkf.exe ups_ins
    3⤵
    PID:3032
  - - C:\Temp\i_qnicaxsqkf.exe
      C:\Temp\i_qnicaxsqkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcausmhfzx.exe ups_run
    3⤵
    PID:6108
  - - C:\Temp\hcausmhfzx.exe
      C:\Temp\hcausmhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcausmhfzx.exe ups_ins
    3⤵
    PID:2896
  - - C:\Temp\i_hcausmhfzx.exe
      C:\Temp\i_hcausmhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwupjhfzxr.exe ups_run
    3⤵
    PID:4136
  - - C:\Temp\zwupjhfzxr.exe
      C:\Temp\zwupjhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwupjhfzxr.exe ups_ins
    3⤵
    PID:3268
  - - C:\Temp\i_zwupjhfzxr.exe
      C:\Temp\i_zwupjhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run
    3⤵
    PID:4080
  - - C:\Temp\uomgeywroj.exe
      C:\Temp\uomgeywroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    PID:3864
  - - C:\Temp\i_uomgeywroj.exe
      C:\Temp\i_uomgeywroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromgebtro.exe ups_run
    3⤵
    PID:1300
  - - C:\Temp\tromgebtro.exe
      C:\Temp\tromgebtro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromgebtro.exe ups_ins
    3⤵
    PID:1772
  - - C:\Temp\i_tromgebtro.exe
      C:\Temp\i_tromgebtro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtoljd.exe ups_run
    3⤵
    PID:5008
  - - C:\Temp\lgdbvtoljd.exe
      C:\Temp\lgdbvtoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvtoljd.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_lgdbvtoljd.exe
      C:\Temp\i_lgdbvtoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aywqoigdys.exe ups_run
    3⤵
    PID:1580
  - - C:\Temp\aywqoigdys.exe
      C:\Temp\aywqoigdys.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aywqoigdys.exe ups_ins
    3⤵
    PID:2404
  - - C:\Temp\i_aywqoigdys.exe
      C:\Temp\i_aywqoigdys.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvtnlfd.exe ups_run
    3⤵
    PID:3612
  - - C:\Temp\ifaxvtnlfd.exe
      C:\Temp\ifaxvtnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvtnlfd.exe ups_ins
    3⤵
    PID:2400
  - - C:\Temp\i_ifaxvtnlfd.exe
      C:\Temp\i_ifaxvtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff4a00c188,0x7fff4a00c194,0x7fff4a00c1a0
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,17921955877247404007,11597359119178296541,262144 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,15495113521790028035,17624105126138691248,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
      4⤵
      System Time Discovery
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,14135097745925943650,1647161261044905651,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,446225357944059055,4148926521482858515,2097152 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15494362547396448497,8738030975899907656,2097152 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,13805935938426719264,10974091269524353341,2097152 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,8988696907271549716,4419880510903182945,2097152 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:9
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,6544179096718296729,11622062314320605897,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,42739887707504108,11834162718477110274,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,11633658993546252595,9175620944497516703,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3189223927735488305,6365581856588771365,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3189223927735488305,6365581856588771365,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,9589664906717829587,1317894443988786221,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3194195577473302500,739160823121676744,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13381027944650049207,5840790663296387749,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8529677241665056154,10629969257773235043,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,10884611283233437593,6470251258852041,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6947326354515171940,11532648549361664104,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10837834280567970131,12620516103510049862,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,14787012697626272399,16615153141177831282,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4980,i,15452260013255679003,10780435933818652766,262144 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:10
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,18382291141313181557,15252410580566209724,524288 --field-trial-handle=2408,i,16675927922117706630,17742396814468837881,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2852

C:\Temp\gaytqljdbvtnlgdb.sys
C:\Temp\gaytqljdbvtnlgdb.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4308

C:\Temp\avsqlfdbvs.sys
C:\Temp\avsqlfdbvs.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\fdxvqnlfdx.sys
C:\Temp\fdxvqnlfdx.sys
1⤵
- Executes dropped EXE
PID:4900

C:\Temp\spkhfaxspk.sys
C:\Temp\spkhfaxspk.sys
1⤵
- Executes dropped EXE
PID:696

C:\Temp\usmkeczxup.sys
C:\Temp\usmkeczxup.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\urpjhezxrp.sys
C:\Temp\urpjhezxrp.sys
1⤵
- Executes dropped EXE
PID:4992

C:\Temp\pjhbztrmjh.sys
C:\Temp\pjhbztrmjh.sys
1⤵
- Executes dropped EXE
PID:4684

C:\Temp\ebwuomgdbw.sys
C:\Temp\ebwuomgdbw.sys
1⤵
- Executes dropped EXE
PID:1804

C:\Temp\igbytqoidb.sys
C:\Temp\igbytqoidb.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\yvtnlgdxvs.sys
C:\Temp\yvtnlgdxvs.sys
1⤵
- Executes dropped EXE
PID:3280

C:\Temp\lfdbvsnlfd.sys
C:\Temp\lfdbvsnlfd.sys
1⤵
- Executes dropped EXE
PID:1248

C:\Temp\sqkifaxvpn.sys
C:\Temp\sqkifaxvpn.sys
1⤵
PID:4548

C:\Temp\kecausmkec.sys
C:\Temp\kecausmkec.sys
1⤵
PID:1704

C:\Temp\czxrpmhfzx.sys
C:\Temp\czxrpmhfzx.sys
1⤵
PID:3848

C:\Temp\cwurmjhezx.sys
C:\Temp\cwurmjhezx.sys
1⤵
PID:2604

C:\Temp\wtoljebwur.sys
C:\Temp\wtoljebwur.sys
1⤵
PID:3020

C:\Temp\rljgbywqoj.sys
C:\Temp\rljgbywqoj.sys
1⤵
PID:848

C:\Temp\yvtnligays.sys
C:\Temp\yvtnligays.sys
1⤵
PID:5572

C:\Temp\sqoigaysqn.sys
C:\Temp\sqoigaysqn.sys
1⤵
PID:5088

C:\Temp\nifaxspnif.sys
C:\Temp\nifaxspnif.sys
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqlfdbvs.sys

Path C:\Temp\avsqlfdbvs.sys
Size 293KB
SHA256 6347b3a0b64d26742465eb0f80a716fc0743485f4b6a931e96592de8602c0214
MD5 fc2000dec1656df2a94436155873e462
SHA1 f85c54da7289298c0eb5368611274b0ea7d420bb
SHA512 d63f86320a9410a5f74e03f081375b2cade8703c233595d4f20d0b13fcd186894a54682367c2f657e9c0d2114b6ccc86e1eac82c314230d1d1ab2b1cdee0fbb5
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnlfdx.sys

Path C:\Temp\fdxvqnlfdx.sys
Size 293KB
SHA256 7dfef6a694c393ce7a0d99df9fbb660dc05adeee3fe0b3d71460da4a02fea92e
MD5 da25e1e570de923db6aa5a7cfc539ca1
SHA1 d4fbff07f448d1df2c90fb8f057c8bd43de1dfe1
SHA512 63c2c10cf19358e51ecea24a35e4af47bab28ca2da5a17c7acb28612898a08aa6b146a101b2c92865a51315dfbcfc62595697e4c3e821ae58a61ebc26da5b4ba
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbvtnlgdb.exe

Path C:\Temp\gaytqljdbvtnlgdb.exe
Size 376KB
SHA256 e281dadf3cabe6333d2ae6c9e69a3d2e59396ae44d603799e3c300f162c7d23f
MD5 d3d3c82ef4a3976783be2f1983d80f2d
SHA1 d37a8550115b023418c49c6dd80fdf6a93e380d0
SHA512 8bdfc9673f51ef8b1c6e835358d41c38b57ca16cdd5cc72b04b08cc90310470d31d72c1f6489b0350367acbd6ef1f2225f90b6980700c833b4f0c8f02858da78
SSDEEP 3072:DFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbvtnlgdb.sys

Path C:\Temp\gaytqljdbvtnlgdb.sys
Size 293KB
SHA256 00fb718e9a6e0f5602417862579492df5534b3d7cecd53cae60b9ea0e52f30c6
MD5 6d6f8f631a697f3123ab97f5d2d982d8
SHA1 a144f1843b758d5bb9791474185e8d8e32197db4
SHA512 9ca4a3a9d3a01c26969d6bb292035acf0775e878b6fbedbfa430e1a5457d4e297c9e19aeab3ded28d33eee2fae9f99bd4f0550e40930d1c84fb7f23b14721ec5
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlgay.exe

Path C:\Temp\i_idbvtnlgay.exe
Size 376KB
SHA256 722fee5debf65e74b11511340898ba37c569f6131c44c9893457deaa5fbc54c7
MD5 dc8854595cb74b0276119197eefb9de2
SHA1 6a05bee61802ffb5b2623f445df99a2f7216ca61
SHA512 fa0749bb41c1eb0b288fbd35a64234283b063786743ce70c013b7bf4fc7b31e5e678b315ee5985da2ce5e652b0413b822c202416875a393ed0012bc2b9700bb1
SSDEEP 3072:LFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfcausqk.exe

Path C:\Temp\i_snkfcausqk.exe
Size 376KB
SHA256 915cafd9b6f35ca7b785f81905a4b6cd792d48abf573eb4452ad3e856888abab
MD5 0d15782898248f548e7b450645c798a7
SHA1 3b88f024d2dee06e34c833f3ac4d014f88df7e9b
SHA512 c5bf4cf293b58a03891dc559148cf04dc67a826ddf828b9f0f122561c6f7d6fea43deb718c6d896cf17738c027877a7739f753cf72e3e6479c513103f009fbac
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfaxvpn.exe

Path C:\Temp\i_spnhfaxvpn.exe
Size 376KB
SHA256 71415558fef1cab4fff3b8c7baf5af953e6457de641f27d31fd35c618be5da7b
MD5 1f2e68d67fd92200fcd349b3c7121f2a
SHA1 93b5331b36279d5d151e5571fa51e34b3c895247
SHA512 d5e9b552423d4bd3727829c336ce48a8e20eaa176fc5e4f17c8ce938b4cca95344d44c7f566d87a0c0e7ef540ddb83e0aab1e59667bafd7d854daeb53f3cd687
SSDEEP 3072:qFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnifaxvtn.exe

Path C:\Temp\i_sqnifaxvtn.exe
Size 376KB
SHA256 02e1092d9a8ff231148e257645712c9badcec8e7da8171783a4756dca4bbc335
MD5 ec7a3264e89342d51c4dba670b7e446b
SHA1 c781b756d349a698bfef942edd41ccd9fbf70459
SHA512 8aedbc801595cd6a6623a50229835dcc1d92de3a7d80490220b01285b9a2c50d996a503c82948aac235abafd4b6bb5dde337b0b20cd3b472c9607f8be1700322
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmhecxupn.exe

Path C:\Temp\i_usmhecxupn.exe
Size 376KB
SHA256 65fa24e3141aafe229addebc5e5ed57263fcf4dd0e96355073ab490f81b0b8a8
MD5 c8e61cdab9eee65efb6b30d80257b2f1
SHA1 911186f3472302e4edccd7fec5e767f2efbd948f
SHA512 1a4f42c4393604a1e6ce49c9a39e7c58b19660c5c9d57aa167719ce73fd4c8c5c3eb2642c066d800b4a3333299e55cc27a3e93b952833518b0d16665f6c4f250
SSDEEP 3072:SFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T135847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgay.exe

Path C:\Temp\idbvtnlgay.exe
Size 376KB
SHA256 a1fe30bf97a018f3fd381ddc9cdb318b421129c656d0cc740a3754fe600e7b24
MD5 f487a493f57252a7005c9a2ee235440c
SHA1 ca37cc6a5e3c265fa5faeac7d53575dd4137125a
SHA512 c84631976078e3500d6468ea01377ee5a5adcf0b5fa8a5f2b74a2f113596f11a2011f31f51bc4785a3d93aecd6142fb503e655a01c1a86dbf82a1ae7d50a69f7
SSDEEP 3072:lFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcausqk.exe

Path C:\Temp\snkfcausqk.exe
Size 376KB
SHA256 d2283130d324fb9d717e332660db1ab157c9da61ff82617e97056a192a240ace
MD5 a52c9442db20ec002d03fc8d4cfe6c40
SHA1 50758bb3477b361334379911bf69b122d865e22d
SHA512 0ccb221f457068eeef19e35108019a78626b93935bcc82a7e32580264ae803b3f2a1958dfd4f91dcdf7f64dc4f5f47757a273f2b222075740a82fea4490925bb
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T137847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfaxspk.sys

Path C:\Temp\spkhfaxspk.sys
Size 293KB
SHA256 d0c52fe060b68ccbdb25f780661f5406756f77c669d02d67508cfc886da99fb0
MD5 f38bce05b490eee0ce80788013bfff1f
SHA1 4b5bbe2dda576ab03d1cc8bd861e694a90a4b34a
SHA512 951ba5ca468255b5da75efdd3f2f0fc1b11354bd1bb3a3da2f03fd1fd54072f47e5c3ac51c825c0a9361c5015780b259ae245ee1da53276753c060c5beaad47f
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed6:fIJjiJcbI03GBc3ucY5DCSjB
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfaxvpn.exe

Path C:\Temp\spnhfaxvpn.exe
Size 376KB
SHA256 409c2aa92293af676af42cb2910af5dd7e3c9441a9b772ba3653aa84ece63986
MD5 558243dc0ef4ecd2b327465bdd73bf62
SHA1 85b492d98c8bf0ae9522a7b271a8772a25007028
SHA512 4efb2b7d69d62153f07894d118f98cb7ea6d7c88c7609e435c4ffd85199411bf797b896cb50b37651e4c1f05a2129f6705daf2a57b5d036e4c03b9940dd7173e
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifaxvtn.exe

Path C:\Temp\sqnifaxvtn.exe
Size 376KB
SHA256 e15174340f04df50a06195df8a66ff1d4ea1db1c071bfa0afd2b33989fa071ba
MD5 aa546cb057fcd61f9cb5b2514ae40ce1
SHA1 73272cb749f755a692892d283d43319b9a8ac7cf
SHA512 5241f22788d893e4bf1fee80075bb0bb10e0070e30fb6adf38482898abba8303c5b5bb80c7de195568a17bdcd6b4977fc7a2ac75686bcd2246ce262cabd8d859
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwuom.exe

Path C:\Temp\urmkecwuom.exe
Size 376KB
SHA256 a8d6185290a542ab871b41fee4fa44e4d2c6a84e444991e2b7983ea6db784a07
MD5 51941f5a6be97eefd1d3b7d98a286919
SHA1 bd1d67a66398a583cf3a82857fd0a1bd63177c66
SHA512 a66bdbf0bb70509dba0ef578d86b576a2ecc97d64e594ea6755b6d8d4502113f168d177b593a040bbf3f0034b0714c9a965a6c0619e3d2c56e6a010bdd88f3e2
SSDEEP 3072:KFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhezxrp.sys

Path C:\Temp\urpjhezxrp.sys
Size 293KB
SHA256 817d7a87cae88d9559245a9a42d8076c608150a183fa0b2647ae55e68c73e0fb
MD5 1248f4e809437969d89d5c5049779841
SHA1 87924dc0e83a245182a960ec98d88c2d3b2bafca
SHA512 ad405ced6d8f57bb4a317a2f3e995b31af7d3bd83d63270b5bb50e1f21c8383b0890da049035f0ceb7088cfcac37a2a49d111f787b297ef82330b5d69a2d631d
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmhecxupn.exe

Path C:\Temp\usmhecxupn.exe
Size 376KB
SHA256 07f55319212054de9e59fa66d9a020d4b2258780b013f66cefe8afc26899d0dd
MD5 ce7fb626d14ad4d86a137ef015b73b98
SHA1 9b3f4cb54aada1b083e5751bc2dcec1bc01e78a8
SHA512 b36b96f558fa3976cdc160cb37ce3256970144e6de570ace4e043cc399b2c5a4fabf4d1f452414ec5d2cc13c8e8762d4240b9e24a3bcef9192c5b6c577be26ba
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkeczxup.sys

Path C:\Temp\usmkeczxup.sys
Size 293KB
SHA256 2b46d4dffba2aa3212626a806e46aa2ddb140ec560029bf6f3b8474584ec4cf0
MD5 758722cea475e9585831d316ba3a32ad
SHA1 5c8a6aa014f6a8ce3989a8f429718943551032ef
SHA512 5a0966a1b7f8a9f0673aa5dd7641241065a30624d9540012f0deca4f147d58578bc37deb720af787ae84b5186da35b3901018f51dad69aa2476444cd80bee204
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24678119-67ba-41d6-a0af-d285ac5f31bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24678119-67ba-41d6-a0af-d285ac5f31bf.tmp
Size 38KB
SHA256 ce259dc2c4ba27b7dcac1996456506ba37acf076049dbf1a8dc32918b9363867
MD5 54ec503c78c152be04366f3ff2d8694e
SHA1 34e93ab5a8c549ece0c4fb02d3ef4aed7b98bb9f
SHA512 62381d7d99a855c4a657257a21f5f92d0ee953d3fd14fdbba8e487f4f60fcb292f7e0bcbb4e300c7b5e9ca9ff9bff05fe07c679665350161bbcaec1ea02a612e
SSDEEP 768:Irv+4UNbdD3Pc4Np8+p3bd66j+4BRv86aLIi32bwCl1:Ibsbp3FL8+p3Z6n4yR0ww
TLSH
T19B03CF73F8A8A9739CE6C644B24676437FF861A396C10EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e96211a557dda7e6d8c470a6a9ac060475e9ca6cef307a9b0d0acb561d1cf9e4
MD5 8b8dfdcbaaa9f1d526a69c9082cef99d
SHA1 a396b9e6ca2607df4f7c31925c288985f8900fc3
SHA512 09a829bf556a4358d90685155634dc3d6d81f416bef017396696263d7927fbdcc98de0726be8a2d9a6b623f92149dea738a240815fd6e4e30edc957bf30df7b3
TLSH
T1EB51B7E303271DC2C7E582B214E1ACFA7A3AC6FA41CF9E95788EA4B4864331E31D5124
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dad6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59dad6.TMP
Size 2KB
SHA256 295143986be78a6527345a70f3fcd764e144c95f796f9eec69a21fd179966539
MD5 aacfd1ffcda18ed9106aad788f961353
SHA1 ba8a3bee994e3fd4163e108601b45b7492a82c81
SHA512 d810ecc33a6ad69d4e012504fcc0754c92f008e7be06bd7542f854763712aa01833f39cbf39d1049942fbd1b38fb1eb2e35d06af60cb004f743f1fabd5f62db7
TLSH
T13F51B7E303171DC2C7E582B258E1ACFA7A3AC6FA41CF9E95788E94B4864231E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7db538c0e9f8ca37425dac622edb048e07b0def88bb160fd2dce38872a850f49
MD5 006dcaf845feb08b765b4b2ab6503c8a
SHA1 fd52a2fc2918458b5d5d3b820684318807a9ca42
SHA512 63b7eebd45eaa2682c1c28b26199d5cbdd2ce916ca20b19b62ca240070d93f03f4c3a3943bc2ab9d1bb2c7696c6f1970d503586cdd8d733cc3ac1c105676340d
TLSH
T18741CEF383F4853E8A0195F0BA046E2FDE2C0521532C7C6A84E0AE2B93F3471D18099F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 11d0cbd628448bafd314cf1ad67ccf9d965e46960f8965c03ec4f346b6d93fbf
MD5 227868b251602d0cfcb8c22028beffc4
SHA1 f0d88719146d529d9fe5ff5bc8e08db0421c875f
SHA512 c080bebebcaabf87f8e9751377ba78a586c54133fa8bc96d0be89b3941a0ead76a065c3f1c81bdb954eeaac9f5390695d1accea139182b2dd8257c4189bc2503
SSDEEP 192:sxRhRrCF/fzsz6pcTaAJZWezoD8p9X/g6+WNCRu/YCayuOQDG0IgVK4J:sxRhcF/fzsz6EaAHWiR/5J/dQ1kc
TLSH
T1AC42D9166A28AD3B9CC7E20DBA55BF53D7F9603291D01E44EEFC961C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f70bb504fb2df8cd82fc5efe1a0bed1ec7757893e13d354868042417a5e6174
MD5 ec775ece8c23cd865aabb8b1c670008a
SHA1 4d053070122a12626cbf3e06270c3790a6564ea7
SHA512 8a9fe2442941ce37d3481814f7a7675c5c078cc2b82d50a0a38bfd449f24ec415b1f4447bf36b3db5d772bbf79d5cac70fbfbc78d46048b8529472eb9ed583c5
SSDEEP 192:sxReRrCF/fzsQ6pcTaAJZWezoD8p9X/g6+WNCRu/YCayuOQDG0IgDxK4J:sxRecF/fzsQ6EaAHWiR/5J/dQ1sc
TLSH
T1DF42D9166A28AD3B9CCBE20DBA55BF53D7F9603291D01E44AEFC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17af029e0f3de4e275154976503e794c11a7fcacf360c4cce6795c6e7105b49f
MD5 4e50b5148c5dbd588a37eaeebfc0b99d
SHA1 2ce9e0c504df46462ec3301718d8aa039361b835
SHA512 a77315a589849842cd42b24c1801e6286b27aa0ec4f9dccbf7dbfdd0c018932223610a6cbc6bf56e8aa055d507410b034ccc9aec02908e6c12eaf3d0e3968696
SSDEEP 192:sxReRrCF/fzsQ6pcTadJZWezoD8p9X/g6+WNCRu/YCUGuOQDG0IgDbK4J:sxRecF/fzsQ6EadHWiR/5J/BQ1qc
TLSH
T17042CA566A28AD3B9CC7E21DBB55BF53D7F9603291D01E44AEFC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2904fbb2188f07597b21d47d63ae2e4cdac064a90a45fd5b904fd365f0ebe332
MD5 6510261c0c7e21bead27bd176703bf05
SHA1 0e1b2716520b137e4a1793a2b856ccf89ad7daef
SHA512 829a457120c78952277c95fe53a6ffb5bacbc70bb50d081f5d71633e99082ecd0d9570d5d9f9baea52660ce33870eaa1c42cc2aecdcb0bcee01733a74d1d5351
SSDEEP 768:jC+v7N7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpa0QqcFroZj:jC+v77E7JQWgQ+f4+u1jama0Vc+Z
TLSH
T1F2D2EB7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff51d806-a60b-4593-8475-834ba2201d44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff51d806-a60b-4593-8475-834ba2201d44.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 12388e6315099b072e3a1aec3be2cc969ee0c617ff2ee682f7b021b56ee6b3fd
MD5 a3a134f4ec89851ea43aa4d6b56c24de
SHA1 081a44a19c584732c46140ecc4756eb91dc9fef6
SHA512 6f3b2ee104be49f901fa4bf3dbd49972e69fef0a7e46ee3294f957d8e4d27497416243bb4179b8827e13ef6a8f16f9f9b697d58e32ffdac6ff9f69ded66bdb82
SSDEEP 768:Zp3dOdJf3p8+p3bd66j+4BRv86aLIWQPi9PkW:Zp3QX58+p3Z6n4yWPq
TLSH
T1FFF2AFB1F8A9ED739CE5D744B29637836FF42563A5C00E98E8DCAB0D118625E170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f796e04777d90d13142c8406e69d5229071e723b1a9ac82de32a69a788b91353
MD5 abdbcb7c8d81ca7d5efee951b6d7fd34
SHA1 eabbd68d1f1ab250811982eb21c41ebb71859d30
SHA512 0afcdbaa50d709c42a0e08866879ed7a7f81be1493accd91965d3347a27a10afeb6fd38432bef908ac7473e094ecfec935516ce5428026ea1c363f5f73848a05
SSDEEP 768:jrv+4UNbdO3rOdJfjp8+p3bd66j+4BRv86aLIWQa5:jbsbQ3yX18+p3Z6n4yWa5
TLSH
T13E03BF72F869ED339DF6D604B28777837FB420A395C00E94E8D96B5D118A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2568b7b4cd959b1de5f5389068cedf92a690666db58f4fc41ef531428501ce4b
MD5 bb4a373ee8c6db2eeb1935e6d4142b13
SHA1 08bb9eb11adf6316501c59b0ae45d9292f5717a1
SHA512 27bf7e6fa9ac39185e82fd75f9ee6f985de9b3fa56874291fca82266024012b36e118b2399c2a4f4704e430749905cf43a7c603709fe9d86b2b5ee4c6aec770a
SSDEEP 768:Dp3aOdJf3p8+p3bd66j+4BRv86aLIWQPi9PkW:Dp3NX58+p3Z6n4yWPq
TLSH
T147F2AFB1F8A9ED739CE5D744B69637436FF42463E5C00E98E8DCAB0D118625E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 dfe08186e2d2d3632f67e273f5eed4ae94d3df8e6ce48be8599fc338b146dcc1
MD5 a2d6f392f066e69ae34c205a40f60f03
SHA1 edae3b008ec56d1a5e07d7551fd17352c4698759
SHA512 16a41e0c09d69cf668059f7527ef6e23139f16d0636c646e5ab3175f6fc4af52289909350b1d6b693c7cfee978a7b268e360285dc363924cdec624bbb9af4a91
SSDEEP 768:IFQU3hwgYOy0Yp8+p3bd66j+4BRv86aLIWQPi9PkW:rU33U8+p3Z6n4yWPq
TLSH
T1131318F294D79937E8AE9743637D2E429EBCD063B5844994BBC85E0CDC821BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dd5729c4e3ea9626b818a741878440cc4846a6a720a90d11703099100ad7169d
MD5 51ca34cb4ec8dfbe9a16eda08a294d23
SHA1 851e6abb4c4f9e5e66c91dac6bf641caf7b830c8
SHA512 2e038e01f7b445cd21ffdf383e3f59dcc5d59cc3710c2808ea7e139f571c01d71615c62f99484a71a7e7ad19714a7c3f192c45358e2691b6797cd85462852252
SSDEEP 768:arv+4UNbdD3nOnJfNp8+p3bd66j+4BRv86aLITQ2bwCl1:absbp3OlL8+p3Z6n4yp0ww
TLSH
T12C03BF72F4A8ED339DE6C644B14677837FF821A399C10EC4E8D96B4E405A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

2fa3efa6-da1a-4be0-aa14-9508c510409c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fa3efa6-da1a-4be0-aa14-9508c510409c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5488_629928205\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 9ffd3c41a3c0cc894d40e420ce52d0acbaf3f33f732bda0ea50a6286f9094b7d
MD5 a12a285d96da58bfce57baf94a3732b8
SHA1 259351f60814638da9fe5453a8a562056d83b5ab
SHA512 a33b7e65578618db17440909d48051db8cb62ffda081ac20e59cd91be0757631deb783428d605738b580370d21aaf97bc9f53e2c077c6f71dec6e00ce94e2d89
TLSH
T1EC71239356A9C9B2C5DE5FF102839244F2FF22380763302007965586EB70A7A64BCF14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/848-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1248-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1704-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1804-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2604-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3020-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3148-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3848-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4548-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4548-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4992-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5088-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5572-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download