systex | 8a530ce074781492809a8814091789231f9a679b67570435749fafb4b62d3b89

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260817-gnsr4seq6w
SHA256 8a530ce074781492809a8814091789231f9a679b67570435749fafb4b62d3b89
MD5 aa836911745689ac25b40971ca59ac80
SHA1 c007b9ad6a548dd9ae9f47abc62b4791e0880e77
SHA512 9d9ee4dc879811a1319dc3200ae9da3d30aa347fbeafba0aecdce10bdd40b1e7820f5d9a6cc024da442815d5370acd396c30e3caddcd7cae4e1fa11eaa62be5b
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXe:YflfAsiVGjSGecvX
TLSH
T15A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4500	smkecxupmhfzxrpk.exe
6128	smkecxupmhfzxrpk.sys
3212	CreateProcess.exe
3488	usmkecxupm.exe
3168	CreateProcess.exe
5760	CreateProcess.exe
2180	i_usmkecxupm.exe
2772	zwuomhezxr.sys
1884	CreateProcess.exe
6096	trmjebwuom.exe
3664	CreateProcess.exe
2444	CreateProcess.exe
4948	i_trmjebwuom.exe
5728	mgeywuomge.sys
4404	CreateProcess.exe
3724	eywrojgbzt.exe
1656	CreateProcess.exe
1116	CreateProcess.exe
4324	i_eywrojgbzt.exe
4992	vtrljdbwto.sys
6048	CreateProcess.exe
3188	wtolgeywqo.exe
6040	CreateProcess.exe
2384	CreateProcess.exe
5216	i_wtolgeywqo.exe
5256	igbytqljdb.sys
592	CreateProcess.exe
816	aysqoigdbv.exe
1812	CreateProcess.exe
5520	CreateProcess.exe
3576	i_aysqoigdbv.exe
5728	vtnlfdxvqn.sys
5316	CreateProcess.exe
2124	sqkicavsnl.exe
704	CreateProcess.exe
5324	CreateProcess.exe
1280	i_sqkicavsnl.exe
5680	pnifayspni.sys
1480	CreateProcess.exe
3532	icaxvpnkfc.exe
5768	CreateProcess.exe
5224	CreateProcess.exe
2840	i_icaxvpnkfc.exe
5908	kicaxvsnkf.sys
2788	CreateProcess.exe
4616	qkhfzxspki.exe
2508	CreateProcess.exe
6024	CreateProcess.exe
292	i_qkhfzxspki.exe
3576	xrpjhczusm.sys
4428	CreateProcess.exe
4468	rpkhcaupjh.exe
1996	CreateProcess.exe
3824	CreateProcess.exe
3892	i_rpkhcaupjh.exe
5968	mkhcztrmjh.sys
240	CreateProcess.exe
5960	mkhbzwromj.exe
3408	CreateProcess.exe
4196	CreateProcess.exe
6084	i_mkhbzwromj.exe
1492	rojhbztrmj.sys
5256	CreateProcess.exe
5624	jhbztrmjey.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhbzwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhbzwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqoigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzwurlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcaupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcaupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzwurlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqomgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqoigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4272	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1296	ipconfig.exe
5924	ipconfig.exe
5048	ipconfig.exe
2656	ipconfig.exe
4620	ipconfig.exe
5796	ipconfig.exe
2984	ipconfig.exe
4380	ipconfig.exe
200	ipconfig.exe
3744	ipconfig.exe
4352	ipconfig.exe
4368	ipconfig.exe
5380	ipconfig.exe
1872	ipconfig.exe
560	ipconfig.exe
3268	ipconfig.exe
2648	ipconfig.exe
4792	ipconfig.exe
2864	ipconfig.exe
4548	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314198561181389"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{63DF6721-45BC-4E98-A3D6-B1D8267EA6F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe
4500	smkecxupmhfzxrpk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	i_usmkecxupm.exe
Token: SeDebugPrivilege	4948	i_trmjebwuom.exe
Token: SeDebugPrivilege	4324	i_eywrojgbzt.exe
Token: SeDebugPrivilege	5216	i_wtolgeywqo.exe
Token: SeDebugPrivilege	3576	i_aysqoigdbv.exe
Token: SeDebugPrivilege	1280	i_sqkicavsnl.exe
Token: SeDebugPrivilege	2840	i_icaxvpnkfc.exe
Token: SeDebugPrivilege	292	i_qkhfzxspki.exe
Token: SeDebugPrivilege	3892	i_rpkhcaupjh.exe
Token: SeDebugPrivilege	6084	i_mkhbzwromj.exe
Token: SeDebugPrivilege	3240	i_jhbztrmjey.exe
Token: SeDebugPrivilege	3492	i_ljhbztrlje.exe
Token: SeDebugPrivilege	1872	i_igaytqlidb.exe
Token: SeDebugPrivilege	3720	i_ysqnlidbvt.exe
Token: SeDebugPrivilege	5048	i_vsnkicausn.exe
Token: SeDebugPrivilege	120	i_icausnkfdx.exe
Token: SeDebugPrivilege	1804	i_zxrpmkfcxu.exe
Token: SeDebugPrivilege	4284	i_xrpjhbzxrp.exe
Token: SeDebugPrivilege	2616	i_pjhbzwurlj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4500	4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4704 wrote to memory of 4200	4704	2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4200 wrote to memory of 856	4200	iexplore.exe	91
PID 856 wrote to memory of 4228	856	msedge.exe	92
PID 856 wrote to memory of 1332	856	msedge.exe	94
PID 856 wrote to memory of 4272	856	msedge.exe	93
PID 856 wrote to memory of 1332	856	msedge.exe	94
PID 856 wrote to memory of 1332	856	msedge.exe	94
PID 856 wrote to memory of 5028	856	msedge.exe	95
PID 856 wrote to memory of 5028	856	msedge.exe	95
PID 856 wrote to memory of 3260	856	msedge.exe	97
PID 856 wrote to memory of 1140	856	msedge.exe	96
PID 856 wrote to memory of 3260	856	msedge.exe	97
PID 856 wrote to memory of 3260	856	msedge.exe	97
PID 856 wrote to memory of 1140	856	msedge.exe	96
PID 856 wrote to memory of 1140	856	msedge.exe	96
PID 856 wrote to memory of 3236	856	msedge.exe	98
PID 856 wrote to memory of 3236	856	msedge.exe	98
PID 856 wrote to memory of 3236	856	msedge.exe	98
PID 856 wrote to memory of 6112	856	msedge.exe	99
PID 856 wrote to memory of 6112	856	msedge.exe	99
PID 856 wrote to memory of 6112	856	msedge.exe	99
PID 856 wrote to memory of 2552	856	msedge.exe	102
PID 856 wrote to memory of 2552	856	msedge.exe	102
PID 856 wrote to memory of 1060	856	msedge.exe	106
PID 856 wrote to memory of 1992	856	msedge.exe	105
PID 856 wrote to memory of 1060	856	msedge.exe	106
PID 856 wrote to memory of 1992	856	msedge.exe	105
PID 4500 wrote to memory of 3212	4500	smkecxupmhfzxrpk.exe	107
PID 856 wrote to memory of 4412	856	msedge.exe	110
PID 3488 wrote to memory of 3168	3488	usmkecxupm.exe	112
PID 856 wrote to memory of 3320	856	msedge.exe	115
PID 856 wrote to memory of 3320	856	msedge.exe	115
PID 856 wrote to memory of 6048	856	msedge.exe	116
PID 856 wrote to memory of 6048	856	msedge.exe	116
PID 4500 wrote to memory of 5760	4500	smkecxupmhfzxrpk.exe	119
PID 4500 wrote to memory of 1884	4500	smkecxupmhfzxrpk.exe	123
PID 6096 wrote to memory of 3664	6096	trmjebwuom.exe	125
PID 4500 wrote to memory of 2444	4500	smkecxupmhfzxrpk.exe	128
PID 4500 wrote to memory of 4404	4500	smkecxupmhfzxrpk.exe	132
PID 3724 wrote to memory of 1656	3724	eywrojgbzt.exe	134
PID 4500 wrote to memory of 1116	4500	smkecxupmhfzxrpk.exe	137
PID 4500 wrote to memory of 6048	4500	smkecxupmhfzxrpk.exe	142
PID 3188 wrote to memory of 6040	3188	wtolgeywqo.exe	144
PID 4500 wrote to memory of 2384	4500	smkecxupmhfzxrpk.exe	147
PID 856 wrote to memory of 3216	856	msedge.exe	149
PID 856 wrote to memory of 4628	856	msedge.exe	150
PID 856 wrote to memory of 2828	856	msedge.exe	151
PID 4500 wrote to memory of 592	4500	smkecxupmhfzxrpk.exe	154
PID 816 wrote to memory of 1812	816	aysqoigdbv.exe	156
PID 4500 wrote to memory of 5520	4500	smkecxupmhfzxrpk.exe	159
PID 4500 wrote to memory of 5316	4500	smkecxupmhfzxrpk.exe	163
PID 2124 wrote to memory of 704	2124	sqkicavsnl.exe	165
PID 4500 wrote to memory of 5324	4500	smkecxupmhfzxrpk.exe	168
PID 4500 wrote to memory of 1480	4500	smkecxupmhfzxrpk.exe	172
PID 3532 wrote to memory of 5768	3532	icaxvpnkfc.exe	174
PID 4500 wrote to memory of 5224	4500	smkecxupmhfzxrpk.exe	177
PID 4500 wrote to memory of 2788	4500	smkecxupmhfzxrpk.exe	181
PID 4616 wrote to memory of 2508	4616	qkhfzxspki.exe	183
PID 4500 wrote to memory of 6024	4500	smkecxupmhfzxrpk.exe	186
PID 856 wrote to memory of 4520	856	msedge.exe	188
PID 856 wrote to memory of 4520	856	msedge.exe	188
PID 4500 wrote to memory of 4428	4500	smkecxupmhfzxrpk.exe	193
PID 4468 wrote to memory of 1996	4468	rpkhcaupjh.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_aa836911745689ac25b40971ca59ac80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Temp\smkecxupmhfzxrpk.exe
  C:\Temp\smkecxupmhfzxrpk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3212
  - - C:\Temp\usmkecxupm.exe
      C:\Temp\usmkecxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\i_usmkecxupm.exe
      C:\Temp\i_usmkecxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1884
  - - C:\Temp\trmjebwuom.exe
      C:\Temp\trmjebwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\i_trmjebwuom.exe
      C:\Temp\i_trmjebwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\eywrojgbzt.exe
      C:\Temp\eywrojgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1116
  - - C:\Temp\i_eywrojgbzt.exe
      C:\Temp\i_eywrojgbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6048
  - - C:\Temp\wtolgeywqo.exe
      C:\Temp\wtolgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2384
  - - C:\Temp\i_wtolgeywqo.exe
      C:\Temp\i_wtolgeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqoigdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:592
  - - C:\Temp\aysqoigdbv.exe
      C:\Temp\aysqoigdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqoigdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5520
  - - C:\Temp\i_aysqoigdbv.exe
      C:\Temp\i_aysqoigdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5316
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxvpnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1480
  - - C:\Temp\icaxvpnkfc.exe
      C:\Temp\icaxvpnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxvpnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5224
  - - C:\Temp\i_icaxvpnkfc.exe
      C:\Temp\i_icaxvpnkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkhfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2788
  - - C:\Temp\qkhfzxspki.exe
      C:\Temp\qkhfzxspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkhfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\i_qkhfzxspki.exe
      C:\Temp\i_qkhfzxspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhcaupjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Temp\rpkhcaupjh.exe
      C:\Temp\rpkhcaupjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhcaupjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3824
  - - C:\Temp\i_rpkhcaupjh.exe
      C:\Temp\i_rpkhcaupjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhbzwromj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:240
  - - C:\Temp\mkhbzwromj.exe
      C:\Temp\mkhbzwromj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhbzwromj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4196
  - - C:\Temp\i_mkhbzwromj.exe
      C:\Temp\i_mkhbzwromj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5256
  - - C:\Temp\jhbztrmjey.exe
      C:\Temp\jhbztrmjey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjey.exe ups_ins
    3⤵
    PID:1600
  - - C:\Temp\i_jhbztrmjey.exe
      C:\Temp\i_jhbztrmjey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhbztrlje.exe ups_run
    3⤵
    PID:4568
  - - C:\Temp\ljhbztrlje.exe
      C:\Temp\ljhbztrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhbztrlje.exe ups_ins
    3⤵
    PID:3508
  - - C:\Temp\i_ljhbztrlje.exe
      C:\Temp\i_ljhbztrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqlidb.exe ups_run
    3⤵
    PID:4236
  - - C:\Temp\igaytqlidb.exe
      C:\Temp\igaytqlidb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqlidb.exe ups_ins
    3⤵
    PID:3296
  - - C:\Temp\i_igaytqlidb.exe
      C:\Temp\i_igaytqlidb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnlidbvt.exe ups_run
    3⤵
    PID:1924
  - - C:\Temp\ysqnlidbvt.exe
      C:\Temp\ysqnlidbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnlidbvt.exe ups_ins
    3⤵
    PID:5216
  - - C:\Temp\i_ysqnlidbvt.exe
      C:\Temp\i_ysqnlidbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkicausn.exe ups_run
    3⤵
    PID:3576
  - - C:\Temp\vsnkicausn.exe
      C:\Temp\vsnkicausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkicausn.exe ups_ins
    3⤵
    PID:5952
  - - C:\Temp\i_vsnkicausn.exe
      C:\Temp\i_vsnkicausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run
    3⤵
    PID:2316
  - - C:\Temp\icausnkfdx.exe
      C:\Temp\icausnkfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    PID:4132
  - - C:\Temp\i_icausnkfdx.exe
      C:\Temp\i_icausnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmkfcxu.exe ups_run
    3⤵
    PID:5832
  - - C:\Temp\zxrpmkfcxu.exe
      C:\Temp\zxrpmkfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmkfcxu.exe ups_ins
    3⤵
    PID:2448
  - - C:\Temp\i_zxrpmkfcxu.exe
      C:\Temp\i_zxrpmkfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzxrp.exe ups_run
    3⤵
    PID:3216
  - - C:\Temp\xrpjhbzxrp.exe
      C:\Temp\xrpjhbzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzxrp.exe ups_ins
    3⤵
    PID:4368
  - - C:\Temp\i_xrpjhbzxrp.exe
      C:\Temp\i_xrpjhbzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzwurlj.exe ups_run
    3⤵
    PID:2112
  - - C:\Temp\pjhbzwurlj.exe
      C:\Temp\pjhbzwurlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzwurlj.exe ups_ins
    3⤵
    PID:3240
  - - C:\Temp\i_pjhbzwurlj.exe
      C:\Temp\i_pjhbzwurlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqomgbztr.exe ups_run
    3⤵
    PID:4308
  - - C:\Temp\zwqomgbztr.exe
      C:\Temp\zwqomgbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4352
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff897f4c188,0x7ff897f4c194,0x7ff897f4c1a0
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,7760141607096868505,3166160999809971331,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13248534678863125099,10526605535975535583,262144 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,1953102961012694333,8026416571231483816,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,12128341924217617190,53070837460038640,2097152 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,3118739028462499736,17617877327131525144,2097152 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4124295570673100571,2647521663693956378,2097152 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,3343116277586237653,4996007370181802511,2097152 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,4230715107466771475,14778868663917264538,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16996718498930634351,5782170095369705386,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,8987867119512906592,6703365138902635491,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4411785284804519690,10482738431363515327,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4411785284804519690,10482738431363515327,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5804452518370516078,13696907868838953653,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2872359135364932669,16310612599855558160,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16775149414834469330,17975209357692433482,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,207673219422585262,17327717519969536596,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10681242480896702600,13823212319259910108,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9082084773683129048,14720839646037834996,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,14496964267443297495,1112606575094573951,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,11055419421655732666,4980117388576670827,524288 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5744,i,5632083953924853033,1293249501475893539,262144 --field-trial-handle=2332,i,9009169322415477711,9959361562423349016,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:10
      4⤵
      PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5452

C:\Temp\smkecxupmhfzxrpk.sys
C:\Temp\smkecxupmhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5820

C:\Temp\zwuomhezxr.sys
C:\Temp\zwuomhezxr.sys
1⤵
- Executes dropped EXE
PID:2772

C:\Temp\mgeywuomge.sys
C:\Temp\mgeywuomge.sys
1⤵
- Executes dropped EXE
PID:5728

C:\Temp\vtrljdbwto.sys
C:\Temp\vtrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4992

C:\Temp\igbytqljdb.sys
C:\Temp\igbytqljdb.sys
1⤵
- Executes dropped EXE
PID:5256

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:5728

C:\Temp\pnifayspni.sys
C:\Temp\pnifayspni.sys
1⤵
- Executes dropped EXE
PID:5680

C:\Temp\kicaxvsnkf.sys
C:\Temp\kicaxvsnkf.sys
1⤵
- Executes dropped EXE
PID:5908

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
- Executes dropped EXE
PID:3576

C:\Temp\mkhcztrmjh.sys
C:\Temp\mkhcztrmjh.sys
1⤵
- Executes dropped EXE
PID:5968

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\omgeywqomj.sys
C:\Temp\omgeywqomj.sys
1⤵
PID:3300

C:\Temp\ligaywtolg.sys
C:\Temp\ligaywtolg.sys
1⤵
PID:3416

C:\Temp\dyvqnlfdyv.sys
C:\Temp\dyvqnlfdyv.sys
1⤵
PID:1836

C:\Temp\davtnlicay.sys
C:\Temp\davtnlicay.sys
1⤵
PID:3240

C:\Temp\ifaxspkica.sys
C:\Temp\ifaxspkica.sys
1⤵
PID:2456

C:\Temp\axrpkhfcxu.sys
C:\Temp\axrpkhfcxu.sys
1⤵
PID:4332

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
PID:4956

C:\Temp\zwrpjhezwu.sys
C:\Temp\zwrpjhezwu.sys
1⤵
PID:1128

C:\Temp\zwromgebzt.sys
C:\Temp\zwromgebzt.sys
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqoigdbv.exe

Path C:\Temp\aysqoigdbv.exe
Size 361KB
SHA256 485a75d709aef15eff013274dca02348cfb3f64a32186aec03479eebdc8269c9
MD5 b5ca1e31e56fa8852d0b09b9af32da14
SHA1 6fd8710421e47c6e869b43af2a91960c9435be32
SHA512 afc3e08f0ec860b9cae9d0ecfdc322902463b38f2c102877884a5dd70007bb28293ec66e45445ed92deb855ae21aafdc5f6e0bdfc4542f3feabd992bbe1ce858
SSDEEP 6144:YflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:YflfAsiVGjSGecvX
TLSH
T19A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojgbzt.exe

Path C:\Temp\eywrojgbzt.exe
Size 361KB
SHA256 14367b4bf2effe1bc7633cf3a5b75db0b354255027738234579626f6567c0762
MD5 cacab438a1a14c3a512e35f16054e66a
SHA1 2451a15a05f85a2beaaefbe41e3c62f933982d5b
SHA512 8b2469252b6c5f8b14c127b6c2e5d403b99969c7f9d03640aadcba2a0b810b795e6bc29391b310ef5a91747b5905c30d2e26af9ed219a8bde6cc7bb25f932bf1
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T1CF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqoigdbv.exe

Path C:\Temp\i_aysqoigdbv.exe
Size 361KB
SHA256 026f38ba183394254364257ad3f0b278331a278eaaf60ee20343efbac6e94ae3
MD5 9b0580708cc1ed67a8c8b3a4da48ea28
SHA1 236e6cec8914c1511f006a0c3b8b19535f51653c
SHA512 fdc677074906f5f28dbc5644d7d9fe63e0db48615eed46d32c8526f6b36c60a71012dc81011febb41680f94cd8339f8a798d7dca3962ec18f2691ab9c89589c2
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T177747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywrojgbzt.exe

Path C:\Temp\i_eywrojgbzt.exe
Size 361KB
SHA256 1ee1e410f5421f81cc381ed287d9765f54d82e16d644c221a33b3867751e3409
MD5 ceadb01fa94dea58292edb0aec935ddb
SHA1 f42abfcd3df7463c38a3ac00eada65af518ab630
SHA512 442e9933eadd0fda3c3e4521118d16a2b2aba7e006c3b8bc5e4bee2f48a97524fb3cb924fda4869f28f67528c0583be3d7effc557d11122c6b8f5c457c51a4a8
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1E8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnl.exe

Path C:\Temp\i_sqkicavsnl.exe
Size 361KB
SHA256 032056749866f89131b4aef8870d9845bae79be0475995920f5497591e86aaab
MD5 a81111f336b3ca39c8a6a8ca6887e1dd
SHA1 58e965a40787c63a3ca53740cee56f23b0ba82da
SHA512 b9d2579e36b62fe571adc8508a99f64738a8cf7107a8e6fd0b25ced49c9fd89ea9847fdbaeb30a053bf7dd5cf04cf0a6f7141b62a650db621b26e45c525dee14
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1E7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjebwuom.exe

Path C:\Temp\i_trmjebwuom.exe
Size 361KB
SHA256 bdcce881dd39f5c753ebfbd24ae37a9498afea9b61c5efdf08d7464a716949db
MD5 9a1142b82ac16e60e7ccc36c973a528e
SHA1 571ca206323dd2dd7f7434ff99a3057525971438
SHA512 1f91be8750facb7b60c89d54f8a2c2cadbed2a9cc6eb46534eb3ec3b6961a0a2e818174e337dedf8d889c29ab4c9126df72b76839eef7b1ca48ae6a81ec4ba2f
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T114747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecxupm.exe

Path C:\Temp\i_usmkecxupm.exe
Size 361KB
SHA256 553df1f2921d83823a220d73dde2f73d5f53052b5d49b09e6f271f8f1957a368
MD5 0938398a8a5c2d7f3a118c1d1bea4d4c
SHA1 92d6744be5975368a82d44c38f8c22bcbfde5acd
SHA512 7ec28406695f2cd388ed16c1deb2462e761cb89c710fd30fda52e9fb40bf353bed6f476b5cc0a692f127f3259f26f2177fbf606acc5e0413c6dee7a48fabff97
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T1FD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtolgeywqo.exe

Path C:\Temp\i_wtolgeywqo.exe
Size 361KB
SHA256 403d642b410d92f87e1f01394a5331348ecd93ea2519906a0e536c173a58611c
MD5 2aa883ce9fa847366347ac1ed1fba1d8
SHA1 5f88491293805a1533aba450ae6a5f35650fc363
SHA512 d4dbee784b12f2ef21f8a24a0ccc880944d6c0fb85439efa41843a61a7b8a79f91c59f7102162d0ed8939e521d27ec6d4435be362c6870dbc6407264622005c6
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T160747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytqljdb.sys

Path C:\Temp\igbytqljdb.sys
Size 293KB
SHA256 08bda349e555bcd74ae88087644f9876a7f7321be8129b5ae426626b02047ff0
MD5 e6a5a068942d59e6a888e0ff0b64f4a6
SHA1 a8b5429ce10edd7bd6654ba5c06b2a964b4cc8da
SHA512 ca959f0f74c1af9d0530430c376715623e94a2bc4df8bd90e0009c4a3ee79d81b6b08cdedb8a3f77e5894c4e13dd0deece5ba607ce651ce81b13eeb2f8f42cd7
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywuomge.sys

Path C:\Temp\mgeywuomge.sys
Size 293KB
SHA256 fe432e48dce288bc8e4e9ab6d901d257e52c3338f0a0e118e0c142af819be38e
MD5 d936344ec3e4f2849b108dcf71e66187
SHA1 3e0e4be3fc0733b6150c4249067f66c10c0c3e19
SHA512 73492eee8f4e45804e2955924e8a3e61cb69612889fc45c8ffd98cfc1c53e3fe3e49fd736d41361ca0a4b6f6bf5c0213c412183f54a98c67264217830f0383db
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifayspni.sys

Path C:\Temp\pnifayspni.sys
Size 293KB
SHA256 76e93a15e562f37567c66d5d94d529864b19800e4dd8c0d59f74a3c1786fc3cc
MD5 3328180d79e7ef6130e530abe997b676
SHA1 5777124389341c5c2b5823bd79cd1c2dee1c3473
SHA512 6c7cea98bee8c545005512c89047ae6b4c9c21b9481d76f1a599b4ed7bdc130403a157e62dc03bfe0c0baea581b6c4585d418435e33d78c2c1d357e60f44326a
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T169545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecxupmhfzxrpk.exe

Path C:\Temp\smkecxupmhfzxrpk.exe
Size 361KB
SHA256 faca4e6da34c522ff522aa189ced31cb5d69e83685863945b77f1f92165a4da7
MD5 b3790af06664a8d48429a6caae81d7fe
SHA1 5a87a10b053c9523b2fd2d6dd1fd348306647ae2
SHA512 acfa0080f0c3692add4a3c189414d0f2e499f445455b0d0dba69ffdb0dffb647cbd779cc53bf2504be3bc6015f00b22b1690e4e86d7b4bb13b921973f9424b26
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T111747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecxupmhfzxrpk.sys

Path C:\Temp\smkecxupmhfzxrpk.sys
Size 293KB
SHA256 7e879069f97ba6e0dca310155ff788e941605fbc30dfaef322d6e39d7453eb09
MD5 35fde3b8712800390a2ee666593c6568
SHA1 c93d41635dc56217d2ca57142058628bf5ded505
SHA512 26726f547569499826c58f74a155c12dfa48bef7939d9a27110f46793a7fa1d2519702d6792eb0f0051e11593aac76f2c6a34bd5d1773e895039c05c7db7515e
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.exe

Path C:\Temp\sqkicavsnl.exe
Size 361KB
SHA256 84500e923c79d07efa647783ef34d2fb061ab656c05342d9ec662261127e9d84
MD5 9643014ac0b2e4324dd6ec6a0ab5decb
SHA1 ae6ce803b707e76fff5b88443df7dd16c49a4153
SHA512 856987f88ca75b95d8081fe73f21f5fabe41459c90c67eaffb016a90560874116332e4f26eb2f5e8b55e372f31585b9ca1825a274bdddbeb3e19061c9613f637
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T171747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjebwuom.exe

Path C:\Temp\trmjebwuom.exe
Size 361KB
SHA256 4307ee14e630fe7324e2342a573f79127bb908a5f0c4180408f86492fd65a476
MD5 4a07f95b45a9157f1a607fa65c74f7e3
SHA1 cf9b4e4d95afc181e5e01758f81a6ea27b0e0452
SHA512 3aceaacca5836e62bc8d30e17dc828383ef86a19ba0d0b51b616e147b4454baaca11d30c6f27db516767d74d1e2d1cece850f22841594d5436289f659be7c575
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T124747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxupm.exe

Path C:\Temp\usmkecxupm.exe
Size 361KB
SHA256 f805d4c04063160c7d616b15b3bed154896ab22fe132b9350fe99b07f1026b4c
MD5 9f180956394f9c1a33ee9c4adec3df28
SHA1 912df793ef9471afab9e40097a5cafeaee0253da
SHA512 9d59c42177ddc5b3dfd61c95726947ae5645f8511999ad55f120c39a00d97443224ba1cba152d113f6b70fdd3edcfba6255af8113cc4b6e4a581e59a7e2b5f03
SSDEEP 6144:zFflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXo:BflfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvqn.sys

Path C:\Temp\vtnlfdxvqn.sys
Size 293KB
SHA256 59357c74bb16ff5d090a8a7560237b22e8421f50e7cc5ac10bf2934b04199ed8
MD5 23013ef770b5d20908e1359335693e8f
SHA1 925d7c1879d32f9f1a2e3b50d875524f500b6cc1
SHA512 70082e8b028716bbf8c1331138e0b57b103b21df5ab632ddc952c8aa5ae186eb59b8dbe78e620441b280683be36ca6b1e3c8316e3981ef71c8d615a010da3fad
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T156545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrljdbwto.sys

Path C:\Temp\vtrljdbwto.sys
Size 293KB
SHA256 7ba07c93e6ad70d0695b47c07c97adf60b03a42a8716467f157f13f75a1ef30e
MD5 0366d26792429e5d85a38a2dc76a726a
SHA1 8bc0bf08cb089be7e79f3a692d3c4450da88455d
SHA512 6b2e83d1dbb8489ffe72b15aeb58fcddeca828c5923c6492251bee9e845752b4f792cad08571d573918e0fd0f7389c9fcd18bfc2254069732e2a7f3ece4c3af5
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywqo.exe

Path C:\Temp\wtolgeywqo.exe
Size 361KB
SHA256 762e9d6198a5b8fbc43022dabe7ed1d23717cd48e8f8ac88579d9e300cb674ad
MD5 2fcdb0feae9c0a08ba6a87498fb86162
SHA1 2e9f4b51cc7348e544e154e64a3d043f7eea4351
SHA512 5d7781ab2f19645a0a55f6b731765a6ef414de7522e481e0ca307bbe55feff20087ba197599bdefbe04ef2ad496742bd6992a4170a5e519812900880c52a252a
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T189747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomhezxr.sys

Path C:\Temp\zwuomhezxr.sys
Size 293KB
SHA256 c1cadf984f5935b284d86de6000bd0be0fe5b0f01e3f009097c66b2c989af440
MD5 25b34fecb6cda605510b9b151b0d89db
SHA1 5329c5b64caaff52cf2144e1d74d32507ce4ee38
SHA512 082dcbefab22704648e970bf0d48909ac08f50ccf549d2adeb7f5606c968941b4fa978d0866ece417ab1d766f74a1605603189885eff52bde77962501eb563e3
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dfc84e684fb18e8495c7da3718c813f740e4b56f0431c126f9f0d58ea498ecc9
MD5 5ec24f84908396f1b57a310f17033009
SHA1 e0acf9702cbd53cb1a9ce17d874bb06dc3e027f2
SHA512 ee2bb6c71ae851220e8e9afb3e228e7c240578493cce2a99ae5a0cd4505f4d45de1db42f53348eab46af1bdbe51f954eb8c61158905fc8c1f1122ca94f460d00
TLSH
T1EA4147A4F36609D2D7E5D8B119E2609531F88459750B6F39820D2EBC4A83F5CE3C90F3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5969ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5969ad.TMP
Size 1KB
SHA256 7ee4f71d08e4c4734887793c304fc3fdb02435a83e331bb2b5d20e4aebbec9b5
MD5 743ac087c05e044535602ac4a8fde584
SHA1 d6c43cbbe9b8ea5541f4392bfc15b80e07a9597b
SHA512 a5854cc387ae7d7140b7f03677cec7c286e2359820796d4cd239559640b54f533fc399a8308539d6782acb5e99347a94597a50fddd64e4d8b5d0ff4c09d40e6e
TLSH
T1984147A4F72609D2D7E5D8B169E2609931F88459750B6F39820D2EBD4A83F5CE3C90F3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 47149fd63dd24f5fb003437c60c9a8c6a516fc05aefe2baff30676ca332ec8c3
MD5 25618618207cf9508a7cf43130efe322
SHA1 c9fba04d9647306780e62256b4a8df05c7c284e8
SHA512 7498d418aba350c8b730868577787323a31dec762d16922b4cae60b566b7f8cc47afa815dc99934fd2d2b0405d2bec060dd43ae6bc72810e52f677e457830a6c
TLSH
T14D419EF783F4856E890156F0AB186E1BCE2D0515432C7D5AC9E4AE2793F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1e6e67b128a9d77e85037dc4fcde1fd541160b19956c50fb45715ea84ef1fdd7
MD5 a33cc6295fb962f3cf9de476ffd9055b
SHA1 71b1455a06f1b01f3e03d7286441660980ec1f74
SHA512 7eab5c90fe3a19dabc21996a5c182382cda782cc88fb6e31124b25957d1362209a7091778f4fa245e66f7cd115716c78f726086a1ab8fdc4a87985de459aa0c3
SSDEEP 192:sxR4RrWCf/fMsDrstZ3nwzoA8p9H/g6+WNCKX/Yb4AZ6utGiIgVXJ:sxR4Hf/fMsfsD3ph/5P/G6ab
TLSH
T10742D8156A28A97B4CCBE20DFA55BF53D6F91132A1D41E48FBFC961C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 41e2fcf9063138f8b664814b1b7f7fda9b53febb5855872e150ff1ae169c0dfb
MD5 801948882c815ea15251c2c96e7cf9d5
SHA1 bafb92d79ae57510415829357ec6cab2fd381852
SHA512 01d27bcba0a0e9eb54096b79ce836e3c1e36e71124f9a1e414c5e8269d12b34fec28afcdea387a373fce22c61b47e3cce2a8e738fe9d17dc6a3d1f0e17179ec8
SSDEEP 192:sxRLRrWCf/fMsarstZ3nwzoA8p9H/g6+WNCKX/Yb4AZ6utGiIgD9XJ:sxRLHf/fMsKsD3ph/5P/G6aH
TLSH
T16942D9156A28A97B4CCBE20DFB55BF53D6F9113291D01E48BBFC9A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6b4b9d60b4145a436d91cbe018822b3d62b8d59c393f401b031086f2e63434e3
MD5 a02e211fb835540db190ac924c320f0e
SHA1 222a656bf0c541f0cefb01f05b096b5529278178
SHA512 15a5650e40694b5d8a585c20609f4a587ee6871910ab7b66ff9edaec23d6ed6db0ebc6d189303c57a850ee2f05b71e0077eb0a1ae81a3d0fc1e0ff360c5138a6
SSDEEP 192:sxRLRrWCf/fMsarttZ3nwzoA8p9H/g6+WNCKX/YbWiZ6utGiIgDnXJ:sxRLHf/fMsKtD3ph/5P/M6ad
TLSH
T1D842E9156A28A97B5CCBE209FB55BF53E7F9513291D01E48BBFC9A1C04E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ee5e361b4540a1caafdddf570159659822777a533ff091da297474fed3155a48
MD5 8415149e956b2a272bcfecfb2713f7a7
SHA1 bd958dce23699283bd9637305b3e0b0adba20885
SHA512 d5e71af6784a4f9eabd7e01b9b932dc72a670d297c2413b5794180502ef129267d9480c0e36b2b8ef541cd4eccb560ce193d9357aabf57a185aba9caa1ff951d
SSDEEP 768:Fb1pGD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVSIpJ8ImroSyQ:Fb1pG1E7otWgikfq4u1jaNIpyIds
TLSH
T194D2DA3B640DCA7F4F804ADDEC19BE9B6D6802CB96D8CD8047FA951C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0870c79e9d8b90e6ffd41395daa30c4ada3390545f679af92a5c19ef942ddb2
MD5 e15c914a23c26e6b7a970a39a304fb09
SHA1 c308d5d142076d1cdd10400848e174f389a86d94
SHA512 c4624cb7c181af9a99668e20c38b8ecb1f2aa2b7e0567b2cedb2bc53623949bef9c7f635a3dec38d4681d377aec52fa7756af7a6eaaeb8fee7bdafb960c1445d
SSDEEP 96:KRstY826ucWKHHgEcK4JgOccM8nmMBHc9oMmqesWa33gUgRkQiOCYWm++sKbK2s:CstY826uDKHAEgJgODM8nmMBHc9oMmqB
TLSH
T1E0914FC535BA42503CFE7B0C817DC95A928275A37256E42A7BEC42A21F6BF424DFC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf98df5c-7095-4a76-879a-d405b27864b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bf98df5c-7095-4a76-879a-d405b27864b9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1aa8c20630b2c3aad7545b64bb9010d6282453c1004d009937cbddb254f7298c
MD5 deecfa3b7d1ff9d045c19db95bd80a36
SHA1 2dd1d58f7c01571aca96a3f3bad74859f7eaabef
SHA512 5c11d024a1397485e1e6fb1ee08a1d18d1079133259e506898d81a7797a83a4ac35e04ebaa4386adc52e0d47a614a3c3d149746dcab9b73b9a891a0162876d1f
SSDEEP 768:Kr3VeCBqobGSeGtZu4aWADIidy8LuP8pJ/rhvK:Kr3VtZzaNsuVLIoJ/rhvK
TLSH
T1DDF2C075FC169D7798EAB244B2833A46AEF8A173D4C80AC59CED5B0E00C35AD135BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d14f26014cd7ad54cca751805784782546609624640b4ca6da4c517465fd6a69
MD5 3e2e6f953790a46347dbe77116de5eaa
SHA1 d2283b4dea651d19767d933569d9821ff6a3086f
SHA512 5737fdcb2f4c423aae08050898f7cdfe571a14b1d9a9b6c83edaeb03a972044fa47eb41b42743f336ba84799c3f059ba494e46e9075789edc212780546315e7a
SSDEEP 768:9rv+4UNbdC39YEBqobGSgpZu4aWADIidy8LqjeVH1S1C:9bsbw3MpZzaNsuVLkEH1d
TLSH
T1F203B036E8599A779CF79284B1873A0B7EF89163C6890BD088DD1F4E41DB4AD130BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 25c5c95759eadacdacac42f1b3258e3474b098fd653a9b38c524e9c79d9815e5
MD5 c34d68b70dbc8e7c0174fc0ebf220903
SHA1 6e583a2334639d8e324d14b874c3c9083a5875e2
SHA512 4c6ed58023b48c4661828c7c6a6e02043a0c9f22b587484195565e956cb6c9b36aadd6b5c6ff2b921ba4a7ba91ec1c74145f937569579e9a0bb3dad4e08f19ce
SSDEEP 768:Wrv+4UNbdC3cZMBqobGSe7tZu4aWADIidy8LbPeVH1S1C:Wbsbw3atZzaNsuVLrEH1d
TLSH
T1B303C035E85ADE739CF7A244B1873A477EF861A384890B90C8DD1F8E41874AE131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b5d459d5d7ac9ca73c1150a00fb58b42a94bf5a38cbe2f22c33fab1845112553
MD5 45a570a4dde5b4393e129beee333a003
SHA1 96e926673581f05beb72f9151c037d80ef45d376
SHA512 30b22a92b23bd975fe6c9ff538f1d13f763685fea504d23b2aaf1a4db7066a257722f8f00024035456754ae043a577db408a10df22aabb02320b74a1c6c22f2f
SSDEEP 768:er3yuCBqobGSeGtZu4aWADIidy8LuP8pJ/rhvK:er3qtZzaNsuVLIoJ/rhvK
TLSH
T10CF2C074FC169D77D8AAB244B2833A46AEF8A173D4C80AC59CED1B0E00C75AD135BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e54b3ab4758d82c603e9fb821297f5f8297ab9216ef7fc6d7a2b593707239cd1
MD5 b731e2267eda52cdbd497bf394b5628b
SHA1 750932ad647454202c3bfb998aff015a65c747fe
SHA512 b916b2505075cad4b4c850f56467af8e5873bcea54e05e1dbf2adf86bfa1542ed2dcba2a4170b8e425ddd17fe851d12d568a43a91ae8a236ad1513b9d56c3e84
SSDEEP 768:0FQV3EwgBR54vSe/tZu4aWADIidy8LuP8pJ/rhvK:XV37tZzaNsuVLIoJ/rhvK
TLSH
T1FD2329F598D79977D8AE5387A37D2D069DBCD163B4884885BBD81E4DCC820BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

57650595-ca60-48ed-b37c-0672aa640f8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\57650595-ca60-48ed-b37c-0672aa640f8b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir856_280354227\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 85d55921aa8cc84c247ac44d6733a8666b34dc6e816790b4309b2b00d89ab6cc
MD5 37977939e1bd71e71af712a248f6444e
SHA1 4c714ab8b85bedda13bbcc0bdcbf0a8a7a28ccba
SHA512 c5b144b35142a19cf5d267bc50dcd3d0f89689a14b8bb75562a7edb7817a5f87471910c05916f6e33c9afe16221bbadc8630ed898db87c41185ed45ed48b750d
TLSH
T15B71238356B9C9F3C1DB5BF002835608F1FF2338072330244B555546AB30A7E54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1128-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1492-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1836-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2600-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2772-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3240-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4956-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4992-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5680-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5728-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5728-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5908-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5968-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download