systex | f8a8253deb27b437d2814b8d6a8bd3303489428817e94c7ac293174b21cfd949

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260819-eap3yscg74
SHA256 f8a8253deb27b437d2814b8d6a8bd3303489428817e94c7ac293174b21cfd949
MD5 f9742946334b2bf9524bd7f0509e4208
SHA1 9fb245f6163750a4bdf865407bf9035f2e14c918
SHA512 b9474334eb58fe8d802c7cef868ad5bc3190320924c6b00c9bc75ee840c2de824621e105669fc121c5c1ffd62eb40e749f7dcb151829aa2384613903cd278b98
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6640	ywrojgbztrljetol.exe
3300	ywrojgbztrljetol.sys
6700	CreateProcess.exe
3132	wtrljhbztr.exe
1972	CreateProcess.exe
7096	CreateProcess.exe
3304	i_wtrljhbztr.exe
3060	olgdbztrlj.sys
2240	CreateProcess.exe
4700	gbywtolgey.exe
6064	CreateProcess.exe
7072	CreateProcess.exe
2364	i_gbywtolgey.exe
4340	tnlgdywtnl.sys
3408	CreateProcess.exe
3100	qlidbvtnlg.exe
5784	CreateProcess.exe
7112	CreateProcess.exe
4896	i_qlidbvtnlg.exe
5652	nifdxvqnlf.sys
5668	CreateProcess.exe
3644	nlfdavtnlf.exe
616	CreateProcess.exe
1092	CreateProcess.exe
4332	i_nlfdavtnlf.exe
3544	nifaysqnif.sys
6396	CreateProcess.exe
120	fdxvsnkfdx.exe
4396	CreateProcess.exe
1436	CreateProcess.exe
2116	i_fdxvsnkfdx.exe
2532	auspnkfdxv.sys
3520	CreateProcess.exe
4548	cxvsnkfdxv.exe
5848	CreateProcess.exe
5600	CreateProcess.exe
4692	i_cxvsnkfdxv.exe
2788	smkhczusmk.sys
6072	CreateProcess.exe
6032	pmkecwupmh.exe
4760	CreateProcess.exe
3304	CreateProcess.exe
1272	i_pmkecwupmh.exe
4444	jhbzwuomjh.sys
1872	CreateProcess.exe
1076	omhezxrpjh.exe
5128	CreateProcess.exe
3216	CreateProcess.exe
2132	i_omhezxrpjh.exe
4904	ztrmjebwtr.sys
4508	CreateProcess.exe
6864	jdbztrljeb.exe
5704	CreateProcess.exe
6304	CreateProcess.exe
1100	i_jdbztrljeb.exe
5364	gbywuomgeb.sys
6196	CreateProcess.exe
3752	dbwtolgebw.exe
5064	CreateProcess.exe
5888	CreateProcess.exe
2204	i_dbwtolgebw.exe
6920	qoigaytqol.sys
256	CreateProcess.exe
5136	oljdbytqol.exe

Loads dropped DLL 1 IoCs

pid	Process
5756	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1565659955\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1565659955\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1565659955\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_819277017\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1636264043\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1636264043\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_609996528\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_609996528\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1565659955\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_819277017\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgecwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbztrljetol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgecwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwromjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtolgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtolgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwromjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvsnkfdxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2712	ipconfig.exe
3988	ipconfig.exe
4160	ipconfig.exe
4892	ipconfig.exe
3672	ipconfig.exe
2244	ipconfig.exe
3040	ipconfig.exe
4660	ipconfig.exe
5436	ipconfig.exe
1208	ipconfig.exe
1928	ipconfig.exe
3032	ipconfig.exe
7140	ipconfig.exe
5680	ipconfig.exe
1704	ipconfig.exe
4816	ipconfig.exe
5740	ipconfig.exe
4240	ipconfig.exe
5544	ipconfig.exe
4260	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315846792152747"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{6F8E94C1-6A0E-47D7-AE32-7D04EFC39BDF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe
6640	ywrojgbztrljetol.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5756	msedge.exe
5756	msedge.exe
5756	msedge.exe
5756	msedge.exe
5756	msedge.exe
5756	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	i_wtrljhbztr.exe
Token: SeDebugPrivilege	2364	i_gbywtolgey.exe
Token: SeDebugPrivilege	4896	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	4332	i_nlfdavtnlf.exe
Token: SeDebugPrivilege	2116	i_fdxvsnkfdx.exe
Token: SeDebugPrivilege	4692	i_cxvsnkfdxv.exe
Token: SeDebugPrivilege	1272	i_pmkecwupmh.exe
Token: SeDebugPrivilege	2132	i_omhezxrpjh.exe
Token: SeDebugPrivilege	1100	i_jdbztrljeb.exe
Token: SeDebugPrivilege	2204	i_dbwtolgebw.exe
Token: SeDebugPrivilege	1124	i_oljdbytqol.exe
Token: SeDebugPrivilege	7088	i_vtnlfdyvqn.exe
Token: SeDebugPrivilege	1360	i_nifaxsqkic.exe
Token: SeDebugPrivilege	3560	i_qkicspkhfz.exe
Token: SeDebugPrivilege	1060	i_mkecausmkf.exe
Token: SeDebugPrivilege	7108	i_urmkecwupm.exe
Token: SeDebugPrivilege	5644	i_uomgecwtom.exe
Token: SeDebugPrivilege	2136	i_ezwromjebw.exe
Token: SeDebugPrivilege	1064	i_wqoigaywqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 6640	4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4788 wrote to memory of 1412	4788	2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 1412 wrote to memory of 5756	1412	iexplore.exe	92
PID 5756 wrote to memory of 1308	5756	msedge.exe	93
PID 5756 wrote to memory of 6092	5756	msedge.exe	94
PID 5756 wrote to memory of 780	5756	msedge.exe	95
PID 5756 wrote to memory of 6092	5756	msedge.exe	94
PID 5756 wrote to memory of 6092	5756	msedge.exe	94
PID 5756 wrote to memory of 204	5756	msedge.exe	96
PID 5756 wrote to memory of 204	5756	msedge.exe	96
PID 5756 wrote to memory of 704	5756	msedge.exe	98
PID 5756 wrote to memory of 4396	5756	msedge.exe	99
PID 5756 wrote to memory of 704	5756	msedge.exe	98
PID 5756 wrote to memory of 704	5756	msedge.exe	98
PID 5756 wrote to memory of 4396	5756	msedge.exe	99
PID 5756 wrote to memory of 4396	5756	msedge.exe	99
PID 5756 wrote to memory of 1260	5756	msedge.exe	100
PID 5756 wrote to memory of 1260	5756	msedge.exe	100
PID 5756 wrote to memory of 1260	5756	msedge.exe	100
PID 5756 wrote to memory of 2884	5756	msedge.exe	103
PID 5756 wrote to memory of 2884	5756	msedge.exe	103
PID 5756 wrote to memory of 2884	5756	msedge.exe	103
PID 6640 wrote to memory of 6700	6640	ywrojgbztrljetol.exe	105
PID 5756 wrote to memory of 3964	5756	msedge.exe	106
PID 3132 wrote to memory of 1972	3132	wtrljhbztr.exe	110
PID 5756 wrote to memory of 1824	5756	msedge.exe	114
PID 5756 wrote to memory of 1824	5756	msedge.exe	114
PID 5756 wrote to memory of 620	5756	msedge.exe	115
PID 5756 wrote to memory of 620	5756	msedge.exe	115
PID 6640 wrote to memory of 7096	6640	ywrojgbztrljetol.exe	116
PID 5756 wrote to memory of 2984	5756	msedge.exe	118
PID 5756 wrote to memory of 2984	5756	msedge.exe	118
PID 5756 wrote to memory of 2984	5756	msedge.exe	118
PID 6640 wrote to memory of 2240	6640	ywrojgbztrljetol.exe	121
PID 4700 wrote to memory of 6064	4700	gbywtolgey.exe	123
PID 6640 wrote to memory of 7072	6640	ywrojgbztrljetol.exe	126
PID 6640 wrote to memory of 3408	6640	ywrojgbztrljetol.exe	130
PID 3100 wrote to memory of 5784	3100	qlidbvtnlg.exe	132
PID 6640 wrote to memory of 7112	6640	ywrojgbztrljetol.exe	135
PID 6640 wrote to memory of 5668	6640	ywrojgbztrljetol.exe	140
PID 3644 wrote to memory of 616	3644	nlfdavtnlf.exe	142
PID 6640 wrote to memory of 1092	6640	ywrojgbztrljetol.exe	145
PID 5756 wrote to memory of 368	5756	msedge.exe	147
PID 5756 wrote to memory of 6160	5756	msedge.exe	148
PID 5756 wrote to memory of 3736	5756	msedge.exe	149
PID 6640 wrote to memory of 6396	6640	ywrojgbztrljetol.exe	152
PID 120 wrote to memory of 4396	120	fdxvsnkfdx.exe	154
PID 6640 wrote to memory of 1436	6640	ywrojgbztrljetol.exe	157
PID 6640 wrote to memory of 3520	6640	ywrojgbztrljetol.exe	161
PID 4548 wrote to memory of 5848	4548	cxvsnkfdxv.exe	163
PID 6640 wrote to memory of 5600	6640	ywrojgbztrljetol.exe	166
PID 6640 wrote to memory of 6072	6640	ywrojgbztrljetol.exe	170
PID 6032 wrote to memory of 4760	6032	pmkecwupmh.exe	172
PID 6640 wrote to memory of 3304	6640	ywrojgbztrljetol.exe	175
PID 6640 wrote to memory of 1872	6640	ywrojgbztrljetol.exe	179
PID 1076 wrote to memory of 5128	1076	omhezxrpjh.exe	181
PID 6640 wrote to memory of 3216	6640	ywrojgbztrljetol.exe	184
PID 5756 wrote to memory of 6724	5756	msedge.exe	186
PID 5756 wrote to memory of 6724	5756	msedge.exe	186
PID 6640 wrote to memory of 4508	6640	ywrojgbztrljetol.exe	191
PID 6864 wrote to memory of 5704	6864	jdbztrljeb.exe	193
PID 6640 wrote to memory of 6304	6640	ywrojgbztrljetol.exe	196
PID 6640 wrote to memory of 6196	6640	ywrojgbztrljetol.exe	200
PID 3752 wrote to memory of 5064	3752	dbwtolgebw.exe	202

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f9742946334b2bf9524bd7f0509e4208_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Temp\ywrojgbztrljetol.exe
  C:\Temp\ywrojgbztrljetol.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6700
  - - C:\Temp\wtrljhbztr.exe
      C:\Temp\wtrljhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7096
  - - C:\Temp\i_wtrljhbztr.exe
      C:\Temp\i_wtrljhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2240
  - - C:\Temp\gbywtolgey.exe
      C:\Temp\gbywtolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7072
  - - C:\Temp\i_gbywtolgey.exe
      C:\Temp\i_gbywtolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3408
  - - C:\Temp\qlidbvtnlg.exe
      C:\Temp\qlidbvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7112
  - - C:\Temp\i_qlidbvtnlg.exe
      C:\Temp\i_qlidbvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Temp\nlfdavtnlf.exe
      C:\Temp\nlfdavtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdavtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1092
  - - C:\Temp\i_nlfdavtnlf.exe
      C:\Temp\i_nlfdavtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvsnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6396
  - - C:\Temp\fdxvsnkfdx.exe
      C:\Temp\fdxvsnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvsnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1436
  - - C:\Temp\i_fdxvsnkfdx.exe
      C:\Temp\i_fdxvsnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvsnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\cxvsnkfdxv.exe
      C:\Temp\cxvsnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvsnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5600
  - - C:\Temp\i_cxvsnkfdxv.exe
      C:\Temp\i_cxvsnkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6072
  - - C:\Temp\pmkecwupmh.exe
      C:\Temp\pmkecwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3304
  - - C:\Temp\i_pmkecwupmh.exe
      C:\Temp\i_pmkecwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1872
  - - C:\Temp\omhezxrpjh.exe
      C:\Temp\omhezxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3216
  - - C:\Temp\i_omhezxrpjh.exe
      C:\Temp\i_omhezxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4508
  - - C:\Temp\jdbztrljeb.exe
      C:\Temp\jdbztrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbztrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6304
  - - C:\Temp\i_jdbztrljeb.exe
      C:\Temp\i_jdbztrljeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtolgebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6196
  - - C:\Temp\dbwtolgebw.exe
      C:\Temp\dbwtolgebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtolgebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5888
  - - C:\Temp\i_dbwtolgebw.exe
      C:\Temp\i_dbwtolgebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbytqol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:256
  - - C:\Temp\oljdbytqol.exe
      C:\Temp\oljdbytqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbytqol.exe ups_ins
    3⤵
    PID:2072
  - - C:\Temp\i_oljdbytqol.exe
      C:\Temp\i_oljdbytqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    PID:6952
  - - C:\Temp\vtnlfdyvqn.exe
      C:\Temp\vtnlfdyvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    PID:2636
  - - C:\Temp\i_vtnlfdyvqn.exe
      C:\Temp\i_vtnlfdyvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaxsqkic.exe ups_run
    3⤵
    PID:4244
  - - C:\Temp\nifaxsqkic.exe
      C:\Temp\nifaxsqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkic.exe ups_ins
    3⤵
    PID:1156
  - - C:\Temp\i_nifaxsqkic.exe
      C:\Temp\i_nifaxsqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicspkhfz.exe ups_run
    3⤵
    PID:2152
  - - C:\Temp\qkicspkhfz.exe
      C:\Temp\qkicspkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicspkhfz.exe ups_ins
    3⤵
    PID:7044
  - - C:\Temp\i_qkicspkhfz.exe
      C:\Temp\i_qkicspkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecausmkf.exe ups_run
    3⤵
    PID:2588
  - - C:\Temp\mkecausmkf.exe
      C:\Temp\mkecausmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecausmkf.exe ups_ins
    3⤵
    PID:3168
  - - C:\Temp\i_mkecausmkf.exe
      C:\Temp\i_mkecausmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwupm.exe ups_run
    3⤵
    PID:4704
  - - C:\Temp\urmkecwupm.exe
      C:\Temp\urmkecwupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwupm.exe ups_ins
    3⤵
    PID:7120
  - - C:\Temp\i_urmkecwupm.exe
      C:\Temp\i_urmkecwupm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgecwtom.exe ups_run
    3⤵
    PID:5672
  - - C:\Temp\uomgecwtom.exe
      C:\Temp\uomgecwtom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgecwtom.exe ups_ins
    3⤵
    PID:4332
  - - C:\Temp\i_uomgecwtom.exe
      C:\Temp\i_uomgecwtom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwromjebw.exe ups_run
    3⤵
    PID:1976
  - - C:\Temp\ezwromjebw.exe
      C:\Temp\ezwromjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwromjebw.exe ups_ins
    3⤵
    PID:704
  - - C:\Temp\i_ezwromjebw.exe
      C:\Temp\i_ezwromjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaywqo.exe ups_run
    3⤵
    PID:4644
  - - C:\Temp\wqoigaywqo.exe
      C:\Temp\wqoigaywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaywqo.exe ups_ins
    3⤵
    PID:6296
  - - C:\Temp\i_wqoigaywqo.exe
      C:\Temp\i_wqoigaywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqlidbvt.exe ups_run
    3⤵
    PID:6828
  - - C:\Temp\aytqlidbvt.exe
      C:\Temp\aytqlidbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe33f3c188,0x7ffe33f3c194,0x7ffe33f3c1a0
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2836269456165805643,14657432716312037904,262144 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14709985400809422430,6348332330072422085,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
      4⤵
      System Time Discovery
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,7558424110672786168,11266780282241789322,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,15757038427263649941,12313876117124955314,2097152 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,8288307978954322633,16211537297676724226,2097152 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5024,i,14472982170306005796,14115133140305866454,2097152 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3636,i,15153059157136795037,16060888304659540737,2097152 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,16098374133040005680,8361572840192616732,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,16098374133040005680,8361572840192616732,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1601411009741012975,10330892254449288037,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,8029677854426282891,2210396946781961421,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5104,i,9463282848499397406,356560235642410087,2097152 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5417891555581381821,5713322657860167739,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,11355790018990694999,996734491200258212,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16818006837658533428,10557020695682641684,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10442703000024199596,662533622334544383,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,17194018271268982963,1682335042107318522,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,16026946659556221953,209266957447993692,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17641429905188603473,16587272508255210620,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5380,i,15089794174637717176,2826929423818026130,262144 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,177683831838833860,3983715119758729572,524288 --field-trial-handle=2364,i,12656385033202856521,8414647527018671406,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:236

C:\Temp\ywrojgbztrljetol.sys
C:\Temp\ywrojgbztrljetol.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5540

C:\Temp\olgdbztrlj.sys
C:\Temp\olgdbztrlj.sys
1⤵
- Executes dropped EXE
PID:3060

C:\Temp\tnlgdywtnl.sys
C:\Temp\tnlgdywtnl.sys
1⤵
- Executes dropped EXE
PID:4340

C:\Temp\nifdxvqnlf.sys
C:\Temp\nifdxvqnlf.sys
1⤵
- Executes dropped EXE
PID:5652

C:\Temp\nifaysqnif.sys
C:\Temp\nifaysqnif.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\auspnkfdxv.sys
C:\Temp\auspnkfdxv.sys
1⤵
- Executes dropped EXE
PID:2532

C:\Temp\smkhczusmk.sys
C:\Temp\smkhczusmk.sys
1⤵
- Executes dropped EXE
PID:2788

C:\Temp\jhbzwuomjh.sys
C:\Temp\jhbzwuomjh.sys
1⤵
- Executes dropped EXE
PID:4444

C:\Temp\ztrmjebwtr.sys
C:\Temp\ztrmjebwtr.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\gbywuomgeb.sys
C:\Temp\gbywuomgeb.sys
1⤵
- Executes dropped EXE
PID:5364

C:\Temp\qoigaytqol.sys
C:\Temp\qoigaytqol.sys
1⤵
- Executes dropped EXE
PID:6920

C:\Temp\vqnlfdyvqn.sys
C:\Temp\vqnlfdyvqn.sys
1⤵
PID:2136

C:\Temp\xvtndxvpni.sys
C:\Temp\xvtndxvpni.sys
1⤵
PID:5124

C:\Temp\khfdavsqnh.sys
C:\Temp\khfdavsqnh.sys
1⤵
PID:2776

C:\Temp\nkfcxupnhf.sys
C:\Temp\nkfcxupnhf.sys
1⤵
PID:5660

C:\Temp\pmheczurpm.sys
C:\Temp\pmheczurpm.sys
1⤵
PID:900

C:\Temp\ecwurmkecz.sys
C:\Temp\ecwurmkecz.sys
1⤵
PID:5156

C:\Temp\ezwrojhbzt.sys
C:\Temp\ezwrojhbzt.sys
1⤵
PID:612

C:\Temp\dywqolgdbw.sys
C:\Temp\dywqolgdbw.sys
1⤵
PID:7076

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

auspnkfdxv.sys

Path C:\Temp\auspnkfdxv.sys
Size 293KB
SHA256 ab9e78a9b91b1c75578845d5ac796f0b2ea64f55f122138cbf0a8eb61a6e180d
MD5 7671cfef62c792bfc6f1b1e5e222c61c
SHA1 03239402df09a5037b08f36377d9d0e1e389f86b
SHA512 4bc75f12365817a2b8d0804e7c9901d4b04692aa2a2e1aec82e0f93c240351ed951529985f292fd4b3baa3dcd3de1852ff247a8404fe057031058f2c7fabc697
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvsnkfdxv.exe

Path C:\Temp\cxvsnkfdxv.exe
Size 365KB
SHA256 74dc89bd5a442d3db7c83553db30dadb4286dbafefd57fac180108075b30d012
MD5 1d6f849528e9a1983412bf1a70b9a930
SHA1 be65f6051ed21e2990d6cc358dc61aeabe672242
SHA512 f0ca9a106a970b18d3024074c9b77e7b03b743f561bd3e235e2d3840fba0a3afaf07e810eafa993f51f4ca4c4e5674ad95efe047408f354f4930fb5e48045761
SSDEEP 3072:huxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvsnkfdx.exe

Path C:\Temp\fdxvsnkfdx.exe
Size 365KB
SHA256 1c1053271ea133d1a6a0be54379900850826a5a61495caf9e1eda720b21b08b2
MD5 76f6b08c7301ec30cf435e9a75d5709e
SHA1 b84d111f1460745b8810ebde8d8fb2ec598dbe9a
SHA512 fd9bd0ac3569cd4b5ed65e42a3df0d7dc9093b1471fa2b78013822becb137e947f44134197583a5ee53ec3c3d305abae486964360ebdf2a664ecd73a4e88755a
SSDEEP 3072:juxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:juxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywtolgey.exe

Path C:\Temp\gbywtolgey.exe
Size 365KB
SHA256 de8eedfb4b858c55cda81a159af84c2a98e7dc52dffdabaed36ec007f6fb0fda
MD5 99f118bfbfa08d79cd29fd6ca901dd23
SHA1 aa779ce92a50f843887a3276ac3a1e7e0f3ff916
SHA512 390c2703d2c8d5676686dd36c15520803b3630db18543eefddb5212744484985e1a5900717ee66a29f10c245331d2149db7c98e96497422405de1bfbaf1471b0
SSDEEP 3072:9uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvsnkfdxv.exe

Path C:\Temp\i_cxvsnkfdxv.exe
Size 365KB
SHA256 0fdf522af2e9203a5401b144ba2e74ea18ac0c85023dd8c77422a61742c45f15
MD5 43d2a45a6d4520150b8ea96b64cb7f6a
SHA1 e8cbcab2e5cb4d79a060d420be49fdc38190c590
SHA512 ad6bf9b2eb9d0ae6a208e3078682194deb4754aca65ce81886fd9e3b26372c76600ea359c75c02600bb3f0432585f3871f4aff1ba28a45349a785f7673bf3f9c
SSDEEP 3072:vuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvsnkfdx.exe

Path C:\Temp\i_fdxvsnkfdx.exe
Size 365KB
SHA256 fb8609279c23d9b8ea89c23875f8edb9a2e17307c9daf056ae9b24673f960108
MD5 561429e56ba29d69f6d18fe713e36969
SHA1 243b635cc8091250ef2adf5b979dc113ff1c62e7
SHA512 5d3649543682bdb1ad91e94e4397607992ad7247024221a47342c527b4b96e5e13440b7e40a766591e2ea28def4ed3da8616eee04bdd36836e3bac9cd87062b9
SSDEEP 3072:4uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbywtolgey.exe

Path C:\Temp\i_gbywtolgey.exe
Size 365KB
SHA256 069b717293576bb704998c5350002a65ebbc811ea151088a5958e1863a90a200
MD5 6db4ad76b12862dea5d49569a9505da1
SHA1 f8bb7019577e2f06f0e0fcac3278d2e2164b5203
SHA512 f3a7bb1e5da0d6a81fb828939f2202c45251ff632ae0a333994333999060b36bf1fe8b3a705e567066ae1a42806ebcb81dd43878867fa0e0d57a4ff1f7e03acf
SSDEEP 3072:1uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdavtnlf.exe

Path C:\Temp\i_nlfdavtnlf.exe
Size 365KB
SHA256 0e348a85091c6332fe04d4814e228a4a39a4cd082e71a788e0421d4ce9b020c6
MD5 97bf2dd259da58d6b7e275e67a946094
SHA1 6f7f96001ea41287261f7df8d5fb1f5dfb625c64
SHA512 249aca4bea57350a0ac05e8d8064019d74e047c661c53890273f6c07dd237be7dd2af7e48aec875a70962a6c14cb8b27735eaf40b14dc7f56a44d7f8b01314cd
SSDEEP 3072:nuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbvtnlg.exe

Path C:\Temp\i_qlidbvtnlg.exe
Size 365KB
SHA256 6db75749eb7d089d3c6d87f2f2c261517ee20d7868e38e8bec26ee68d08971e5
MD5 def2aeea20994ad4cdcec5352b097525
SHA1 83978edad8c7af33d1ba60e14449ae6df057ac4c
SHA512 936abe4e501233d573af57e37a2150cf5a623f212418bd8861829f6361a55c82e51616465fcf59cd324983fe8a26367addd7723bbfa7975f1a664d45dcc55125
SSDEEP 3072:auxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljhbztr.exe

Path C:\Temp\i_wtrljhbztr.exe
Size 365KB
SHA256 91b10d2b7ab1ebb8175ec4e39c8bb1c47d38d342ab18262a7a4cbd9517372314
MD5 8f2fc8270353e1cade4e1cfa7a6623cc
SHA1 f7c3ba08168107bb889b8b2da4729474dce92e21
SHA512 4fc11bbc539f221a05b0d32847b04ba717211578e849acd7b0ed612aece4a8cde573f2031aca864a83d2a21277431f3d904b53da264bce6636c11692c17dff42
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqnif.sys

Path C:\Temp\nifaysqnif.sys
Size 293KB
SHA256 4d29e996c707b60a58520702e01b66b9f6b8b73c62f698cdf3cd8a44ad6940f4
MD5 21d633e042e4457a343c6e1356f4102d
SHA1 7aa0b009b85cf06cfe6f96c3250e93046bbb3c5c
SHA512 3daef0ff0f1698e8b356d57a0c97a9958bcf6eecf717c4c362fc6a66d786c77b31303d9d8ee832e3d9a73ddbab10e4bfb459c69cd3fd2a2c405271159bb0d703
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvqnlf.sys

Path C:\Temp\nifdxvqnlf.sys
Size 293KB
SHA256 9e51e242bf8308aee86790af891a5156c39f6655630dcf22efe7495aff86d2c0
MD5 959ba0fa9fa6f071a5b105d7453308c8
SHA1 928394b7ec551cbe4487d6452b5e4b0a350df62f
SHA512 25255d7659c6c1b458626a22aba63d844168bb1e9954ced9d3ef8649bf3f8d21d21c343853355c2a66a93e5d20a150018384efe514141e908ea7fd99d2661d47
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T102545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavtnlf.exe

Path C:\Temp\nlfdavtnlf.exe
Size 365KB
SHA256 bcc2ed9664bee1a45e3db86a3a8a71f9510d47550dad9724b55de0138daf0afa
MD5 37989e2715bd78214bc09b8244598310
SHA1 7a0623042d0a16fea080bc744b3da47f087f37de
SHA512 33f4a0e511c399936cf19f680dfe8c75fee48ba3e23c3e0e19d83dd7c7d12164cdc36dcf9c0fdbebd436f7f4841a0effa36b839692c80db76fe9597f4a20abde
SSDEEP 3072:puxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdbztrlj.sys

Path C:\Temp\olgdbztrlj.sys
Size 293KB
SHA256 c4497fe10c8645bf39c0ffc7019963242e3a026928c37f8aa811e19dd39b62fc
MD5 08f7b7b0da28d7d9ff50439e6240d22d
SHA1 bf4efaf6ef53d0350dde1978cc01640fd967c747
SHA512 c0dec6996c302ca2334a1f5bf9067f4442b52d802d329ec2c528e36adfc660b87046ec15f4c927b9566679d5a5eca5611b7b5d24eaeb6b49501ca61d193263f9
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlg.exe

Path C:\Temp\qlidbvtnlg.exe
Size 365KB
SHA256 768553a9edc3f5dbe36eb0b0658547dfd58bfd60f8bd7f76eacadd5778f2614c
MD5 cf0cc9ed621dadd5186cf086b39a7840
SHA1 09e42b7ab17a850e99a962a71d0a0e9e2491a221
SHA512 4d93a79fe4e28b380076d2ca88d84a9321757082bdd457c12f22a9f6a8c210df0917fb14929e58a410ce6b7248e4c5a2331d5597c2286f2ef78e47984acac0f7
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywtnl.sys

Path C:\Temp\tnlgdywtnl.sys
Size 293KB
SHA256 23bc1da047bd752d7865ad85e5a6fbe5abecb387444f853abc9d01386661de45
MD5 1fd3d455ca017f9a49894e2370b7f376
SHA1 206558ed66019138bee7fb384f1b432801ee56d0
SHA512 a52426270b8a7438ca3a7a1dde0e8d7918730679fa6d025562a0a3689c98c9bcf8aabbbe82cefa3198f5bfcca0a7a889edc562edf969cdf0ff97c1f75b94d1aa
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljhbztr.exe

Path C:\Temp\wtrljhbztr.exe
Size 365KB
SHA256 da427be620cefe997f074c197fae78e787c4a83ae49e49fb0fe8f2b8a3977dca
MD5 621792790a2a04a4c05901f8cb22aa54
SHA1 907ab5452329f615a9fc12ef8cdad03a41ed869a
SHA512 77f8584ece485dec3e47c2d909d429e22b911defb03e94edec0ff49f0ff3d5e9fbb432a6e7862e393323378e8ad0ee618ed54504cb437cc508291a36eaad52c2
SSDEEP 3072:XuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T109847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbztrljetol.exe

Path C:\Temp\ywrojgbztrljetol.exe
Size 365KB
SHA256 89f4571f8efdf0b5b757e364d2cd029d0bc905b614eece87aed4ce7df88d5e27
MD5 e04bdb74a09c1242ef0933309bbcbba1
SHA1 b565244954e1bfe4111e377aa12450741592249e
SHA512 85b74d62d0d3d178d2c8b3f39c79e131b788158b2cd36da218f63aa5dc3e4ca14b8cc3fb827c53505664b234d12ce3372e8a7ee6f82687e9119c1e5156ef9e9c
SSDEEP 3072:JuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbztrljetol.sys

Path C:\Temp\ywrojgbztrljetol.sys
Size 293KB
SHA256 6e463129f6b3f28f2b9bf5d9b86e9cf7273f302bae6f36e2eed632cdef9e9432
MD5 5d9856b3eaac8716eef776ec4cfe7983
SHA1 ffc26557a6eb00a8b7ec52c4dbe1f5d028a6a2ab
SHA512 8c28bbd2151c74d2e22b3bb16426b35495b37da2258543efdad6f80e34b24e5887a401e2f0291948f4715f0ede3715a10c7b29324b19771e4eff160c911bbfd7
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T16C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 30fce574a2a6d1c4742cf630c318ec78c241023cea5c5191c4fce5d2625a567e
MD5 c6a6a0860d9f8af8a8ed2b51fa328a75
SHA1 3f8810a5d65e3ffce8f3e2f61c81ecea6094ca70
SHA512 c87d70a47eea8be77b0db5092281b1e31a94c1cca200e6427c4a3d12b1993d776824f0e193bc6571e42eace9d3324fcc1c801c24bb48279ec7af79b2ec4ded1e
TLSH
T1D3E0E565D920AC2759F81B18A194464BE740132B3B41884F7A3C822D4FB063B428685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 098dcfbec5e17625fc04e06df8fef4fe5502cc77babb4fc8542e058bab03acf9
MD5 26c8b2f01700877c08bd8f40f2da1e12
SHA1 9c5358b346cd54fd447b522c4716e45561b4ee43
SHA512 b1acaa30d69a647280794f99347a4422574dbc7594947e826a4d95d4c7e4037f024da9c46529d8cdcf7ed344f2038a92098968f6bc27429e1a83bcbe02d1c0d7
TLSH
T14241B2F783F4866EDA1196F0AA18BE1FCE1D0515432C7DAAC9E0AE1793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d880d1b4046f5a1ea82795fb88234cc3241172c168922dc3425ebaa30dd4665d
MD5 6173ab64e498a01cab48d6fbf377e849
SHA1 136fe38d00aec61c2e93856607ffb555e3c58fbd
SHA512 1cb040081b33e059f3c098a1120f5d744183be6e7c864bbba8d995d6b6206e8799bd542e06c18691e04d98a94eca9bf8d8aa7c19d91b687b9672058250574f10
SSDEEP 384:sxRS18o/frsyrN/RIlKG/5K/W9/sGQELj5:seqo/f7BWF/5wW9/sGQE5
TLSH
T11C72E815AA249D7B8CDBD319FA557F63D3F81173A6905E44AAFC8A0C04E67ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e949c911b2d34aa0ee8e96fcfb3db8b50b95fb0f9063c48141fd53480fb1aa6e
MD5 f61f698dbbff9ea967329296cd5360cf
SHA1 469178c2a6474fdf905433a0bfc486492a429a50
SHA512 fdd45323314e89cc56e67331d3cd0ef3d03e1c5b0fc26998f46a9926fd9a92fe941bd9d37139a32bba10ca5a57315bdb190f4817847aa223997f445d9e982060
SSDEEP 384:sxRS1qQo/frsWLN/RIlKG/5K/W98AsGQELDO:sekQo/fvhWF/5wW9lsGQEu
TLSH
T1AE72D815A9249D7B8CDBE219FA557FA3D3F8517395905E44AAFC8E0C00E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c18d5de947ea3280b6ae1edacc345dbbf4f7960480d3972350a40cf6234bf9f5
MD5 b651419624a950ed2880d6c0991782d8
SHA1 9e6c6e119afb67c5b40d9abdb2b081e4b8a5f845
SHA512 a0314ab4d2295e444700cb3256fa65183c44e3069cf0d8fabfa367b297bec9e94dd6911fc42da29395f6cb69b74ec86282bda9bb38e1317aba27dfddba978f95
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEobbDwzro24u:Ob4YZnE7yTWg1NfwBu1jajobHwARu
TLSH
T170E2EB3B280CCB7E4F804ADDEC29BD9A6DA8018F5AD8C95447FA450C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fdbd2afe0e75dbce839507cc77d5825b5fe1d5cc94dbb72fab9c1d427b97c284
MD5 038dbecc128dd29dfb8f8b644a9e13ad
SHA1 566c656cf42ecdd67474f7f8db7b407420c72dd3
SHA512 88a357a7b09d54e300c659c5f3aeb3af48e1fb0b6cddad4e661896135624697cc24a65ae7fa2e412b7c46d0ad7f5a9ad7402015e0ed28b39c64f0ed230d08395
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9R3W:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRl
TLSH
T170B25E11713F4290387EB90C91B8981F86C2B4A37519F52F7B6802A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0aceb335fd0397a9185dc173f584e0b840a73ca605f706dfb59fe2df41d08559
MD5 18a46072860f2d848ca8c9fdc9840635
SHA1 13f45140c7f4bb5fdf641ed79413423d3cc998d1
SHA512 d00722d4256048efe5cb7cbd647c368c87311548fc434f7b172b34d25bea7e000a4a98e19e006b95927e69de43ad9f01114829c110b3176a12c3129587f9d93a
SSDEEP 384:npwiFiZcIb8NL68TUNTUlIRsPvuTBcQEqfbYGTQR9XQjWELxIHvBQiY3Xq3/8LEG:pLFQbQ6wgmuyfGUIWELiHvBNYesBuA
TLSH
T189E2A1F198E78973E89E4B87637D6E469AFCC163B5884988B7D44D0DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 be2f1e8e5854a0cd1be1e6d91095d5aee54a84ea138cd53427390f32cd6ed3a3
MD5 f49285ac017efba8f3c3567c4553af46
SHA1 9b5db15e23a1f6f995ed8ffba96fcd257c77ef4b
SHA512 91c103f4f2ca6327c3585b67174be12d200e5750093f895fee6abbd77d03ac23cd0d72b23216cc4e43a6f5374d5d46c5903ef013a1bd9e08a434eb54acdf9cc9
SSDEEP 384:nCiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTuTREqfbYGTQR9XQpLHbOObjI9G6w7iz:JF1j+9SXswgUuuUGUaHb29Mi
TLSH
T139C25A36EC59CEB7ECE64FD8B34A7A5ADEE002A385985AC8DAD85E4C00C719D4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 22ee918973c4508ac4d641b7e597e2d0b77e3cebbd6db0adb06edeb4c44f3bb4
MD5 4f69f391dcbada1a34ab0146bf1a0577
SHA1 9f246f2af580b76e6150ac297b4173f02881f55e
SHA512 649ced8365bfcba01f588ed7844cb61203ac8bf0f1f579cbd54e8e65bfec01326e51e057713545f449c9742c358549fb87802bc8053ff7fe0a1fe7759fd2ab81
SSDEEP 384:nRziF1tNn/s3n9Sn8Ng68TUNTUlIRiPvuTIyQEqfbYGTQR9XQjWEL4kHvBOObjIb:ReF1j+9SX6wgUuhfGUIWELxHvB29Mi
TLSH
T19FD25C36EC59CEB7ECE64FD8B34A769ADEE011A3898C8AC8E6D85D4C00C719D4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b737590204de436bb04c79a53a1f28eb1dcfab61aa56384bbcb98133872c06c4
MD5 e168fa73e230fddd056b923bcb05bdeb
SHA1 8065e2cbba6d76b629b091473cb6e1a836f2118a
SHA512 d32349c6b6dd5caff769085868c587e5c1e39c28403ff96394e2092588b5f13856daa3081dde21ee4f4298fe0d50e89edcd47262ae76cff77dba3fa4230bc687
SSDEEP 384:nfziF1tNn/s3n9SB8NL68TUNTUlIRePvuTY0QEqfbYGTQR9XQjWEL4AHvBcRb8LR:feF1j+9gQ6wgQujfGUIWELDHvBcRg
TLSH
T19DB23B36E855DEB7BCEA4FD8A74A7686DEE401A388888AD8D9D85D4D00C72DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 31716d013fd7ccb13652b60eed5bdbe727cc24f7dde9895f2e43a93d34b25aa4
MD5 06e6b14dc9c77f1ea05601523e4a0a25
SHA1 40a3eb0fd5ee29ea0c5601943eeb443b1b49409f
SHA512 65766458e8b2aa5f1dd2251c681b8cfdb55f643e19286b3abbdc2f862f71a3e909801409fa30cda8b7d21e014e01242018fa107c7b8f230bf17791ae0bd8ddb3
SSDEEP 384:npziFiZcIx8NL68TUNTUlIRsPvuTB0QEqfbYGTQR9XQjWEL4AHvBQiY3Xq3/8LEG:peFQxQ6wgmuafGUIWELDHvBNYesBuA
TLSH
T13AC26C72ECA4CDB7ECEA5FD4664A7656DEE441A3C98C8AD8DAD84D0D00C72ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d66651fd29bf1a088622362b4ccf426a96573e19d06ba8d7410c64eb6bf597bc
MD5 b1720b64de4d685e884c9f43b23d18a6
SHA1 a023aa2ac7a71c2f0cedaefeb517e24d36e7f0da
SHA512 88fd126d7236137b4a8dceb0132a23be5707baa6b2ef9183d4fce5628b6789fb6b1946c88792b158135f4cb17ccf0ece3b6075e5b8159f0746d624954ca80b09
SSDEEP 384:nfziFiZcIx8NL68TUNTUlIRsPvuTB0QEqfbYGTQR9XQjWEL4AHvBQiY3Xq3/8LEG:feFQxQ6wgmuafGUIWELDHvBNYesBuA
TLSH
T101C26C72ECA4CDB7ECEA5FD4664A7656DEE441A3C98C8AC8DAD84D0D00C72ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26b91053fa5665c7f9dfbb70dfa8cf3e30ff195b27be968ac53fffddc337337e
MD5 f36fd20686b0cd08c1cc0cc0d1748528
SHA1 40bbca940bb397d8fef4133608ca78249c95c275
SHA512 4fa2c486c992eca274f7376f10e9a676e97bac60efdc8a18b36871bcfed51fe128d520e6e1742bd6698b2073c0305ec0e71c7ef1aa6c873a54118b55d6f8a219
TLSH
T1D85150E04C3C16D1D4BD0E3EB08739FC81EC9725F890343C6859EA585A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 08a293f1583d129c9e975f00f9f365bb366b9023bcc15b3612fa8cb7a3ef3e15
MD5 6a812c11f55f0456e0e0b26731680073
SHA1 843157812ee131255015c3bfa9b8c1411934d3f9
SHA512 00f516a51d1a92f8d24d8bde435a82a3ad9996b99efbbc760c7c172fcd6bd4708c0c59832474b40d0c3b04625d3fa60050b627fe415365d339382115061f24d1
TLSH
T11C515FE04C381AD1D4FD0E7EB48B78FC81EC9726F890343C6858EA985A7A21D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0ea316bf6f07b5084eb2ea677698c11b979ea85bf674e5b2779c58827ca4adc5
MD5 ca19a26d78e7c54e6c5d60c3a7f447da
SHA1 bc71386f3f4bf915aa92f09c2e53b7e3948828fd
SHA512 e059a1d8f43228ae8055be6e26b618c99d96698e38ad73cdd98275b69d64f5a2d1bfb25ee677b07cce7105fbd2b79154dc2392b7fec2878f4ecb6a870dbad511
TLSH
T1B671238357B8C6F3C5DE5FF102835608F6FF2278472370204B916546AB30A7A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/900-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2136-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2532-228-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2776-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2788-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3060-145-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-52-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-214-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4340-201-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4340-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4444-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5156-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5156-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5364-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5652-200-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5652-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5660-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6920-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7076-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download