systex | ab1fc9fc100c80e5acea02db7ce9412d8bb8f2458c7f70635d56017cce8349cd

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260819-ebsv8sdj7v
SHA256 ab1fc9fc100c80e5acea02db7ce9412d8bb8f2458c7f70635d56017cce8349cd
MD5 f729ea72b24150b13cad37242e6cf616
SHA1 96ee3f687adcb9d370ec8fefd6f9d1e746d735b3
SHA512 a747951b11cbea0a1931defded16b37fefaaade5b52e99eadea650d8384fe77a9689f720eacbb0727cf47baeab2a770d8516b7775fb3a52746492d89eef98747
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3652	nlgdyvqoigayvqni.exe
3080	nlgdyvqoigayvqni.sys
3180	CreateProcess.exe
3508	qoigaytnlv.exe
1668	CreateProcess.exe
5096	CreateProcess.exe
1296	i_qoigaytnlv.exe
2948	axvtnlfdxv.sys
3676	CreateProcess.exe
3456	sqkicavsnl.exe
1764	CreateProcess.exe
5224	CreateProcess.exe
5412	i_sqkicavsnl.exe
4080	fdxvpnhfax.sys
2596	CreateProcess.exe
4316	xspkfcxvpn.exe
5100	CreateProcess.exe
4800	CreateProcess.exe
1960	i_xspkfcxvpn.exe
1508	pmkeczxrpm.sys
4532	CreateProcess.exe
4580	uspkhfzxrp.exe
5944	CreateProcess.exe
4428	CreateProcess.exe
5260	i_uspkhfzxrp.exe
4552	hczusmkecz.sys
5412	CreateProcess.exe
6088	urmkecwupj.exe
3160	CreateProcess.exe
1476	CreateProcess.exe
3208	i_urmkecwupj.exe
5520	wuomgecwur.sys
1596	CreateProcess.exe
2068	rpjhezwurm.exe
2604	CreateProcess.exe
2588	CreateProcess.exe
1392	i_rpjhezwurm.exe
4144	wuomgeywro.sys
3948	CreateProcess.exe
5748	uomgeywroj.exe
4212	CreateProcess.exe
5776	CreateProcess.exe
1104	i_uomgeywroj.exe
5200	qljdbywqoi.sys
3052	CreateProcess.exe
3332	nljdbvtolg.exe
3272	CreateProcess.exe
4080	CreateProcess.exe
5404	i_nljdbvtolg.exe
2412	tnljgeywqo.sys
2312	CreateProcess.exe
6084	gdyvqoigay.exe
3844	CreateProcess.exe
1808	CreateProcess.exe
1480	i_gdyvqoigay.exe
3376	idavtnlfdx.sys
3468	CreateProcess.exe
4780	aysqkigays.exe
4748	CreateProcess.exe
5488	CreateProcess.exe
5360	i_aysqkigays.exe
4072	spnifaxsqk.sys
1804	CreateProcess.exe
4600	qkicavsnki.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1112092788\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1841824693\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1112092788\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_658246991\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_658246991\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1746456503\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1746456503\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1112092788\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1112092788\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqoigayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytnlv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhezwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhezwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytnlv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqojgbztrl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3464	ipconfig.exe
1264	ipconfig.exe
1692	ipconfig.exe
3608	ipconfig.exe
2056	ipconfig.exe
4352	ipconfig.exe
1140	ipconfig.exe
996	ipconfig.exe
5044	ipconfig.exe
2896	ipconfig.exe
4212	ipconfig.exe
4252	ipconfig.exe
3360	ipconfig.exe
3376	ipconfig.exe
268	ipconfig.exe
5256	ipconfig.exe
1212	ipconfig.exe
5772	ipconfig.exe
5116	ipconfig.exe
6116	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315847938687619"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{01374917-DD6D-42EB-A6B2-1E2406CD874A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe
3652	nlgdyvqoigayvqni.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	i_qoigaytnlv.exe
Token: SeDebugPrivilege	5412	i_sqkicavsnl.exe
Token: SeDebugPrivilege	1960	i_xspkfcxvpn.exe
Token: SeDebugPrivilege	5260	i_uspkhfzxrp.exe
Token: SeDebugPrivilege	3208	i_urmkecwupj.exe
Token: SeDebugPrivilege	1392	i_rpjhezwurm.exe
Token: SeDebugPrivilege	1104	i_uomgeywroj.exe
Token: SeDebugPrivilege	5404	i_nljdbvtolg.exe
Token: SeDebugPrivilege	1480	i_gdyvqoigay.exe
Token: SeDebugPrivilege	5360	i_aysqkigays.exe
Token: SeDebugPrivilege	1508	i_qkicavsnki.exe
Token: SeDebugPrivilege	1796	i_causpkhcau.exe
Token: SeDebugPrivilege	6008	i_zxrpmhezxr.exe
Token: SeDebugPrivilege	264	i_xrpjhbztrm.exe
Token: SeDebugPrivilege	3804	i_rojgbztrlj.exe
Token: SeDebugPrivilege	4184	i_tqojgbztrl.exe
Token: SeDebugPrivilege	5376	i_ljdbytqljd.exe
Token: SeDebugPrivilege	5048	i_qnigaysqki.exe
Token: SeDebugPrivilege	5272	i_ifaxvsqkic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3652	3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3452 wrote to memory of 1484	3452	2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 1484 wrote to memory of 1368	1484	iexplore.exe	92
PID 1368 wrote to memory of 1072	1368	msedge.exe	93
PID 1368 wrote to memory of 4956	1368	msedge.exe	95
PID 1368 wrote to memory of 1156	1368	msedge.exe	96
PID 1368 wrote to memory of 4956	1368	msedge.exe	95
PID 1368 wrote to memory of 4956	1368	msedge.exe	95
PID 1368 wrote to memory of 4088	1368	msedge.exe	97
PID 1368 wrote to memory of 4088	1368	msedge.exe	97
PID 1368 wrote to memory of 4976	1368	msedge.exe	99
PID 1368 wrote to memory of 4616	1368	msedge.exe	98
PID 1368 wrote to memory of 4976	1368	msedge.exe	99
PID 1368 wrote to memory of 4976	1368	msedge.exe	99
PID 1368 wrote to memory of 4616	1368	msedge.exe	98
PID 1368 wrote to memory of 4616	1368	msedge.exe	98
PID 1368 wrote to memory of 4552	1368	msedge.exe	100
PID 1368 wrote to memory of 5744	1368	msedge.exe	101
PID 1368 wrote to memory of 4552	1368	msedge.exe	100
PID 1368 wrote to memory of 4552	1368	msedge.exe	100
PID 1368 wrote to memory of 5744	1368	msedge.exe	101
PID 1368 wrote to memory of 5744	1368	msedge.exe	101
PID 1368 wrote to memory of 5556	1368	msedge.exe	103
PID 1368 wrote to memory of 5556	1368	msedge.exe	103
PID 1368 wrote to memory of 4624	1368	msedge.exe	106
PID 1368 wrote to memory of 1264	1368	msedge.exe	107
PID 1368 wrote to memory of 4624	1368	msedge.exe	106
PID 1368 wrote to memory of 1264	1368	msedge.exe	107
PID 1368 wrote to memory of 3576	1368	msedge.exe	109
PID 1368 wrote to memory of 4212	1368	msedge.exe	110
PID 1368 wrote to memory of 4212	1368	msedge.exe	110
PID 3652 wrote to memory of 3180	3652	nlgdyvqoigayvqni.exe	111
PID 3508 wrote to memory of 1668	3508	qoigaytnlv.exe	116
PID 1368 wrote to memory of 1100	1368	msedge.exe	119
PID 1368 wrote to memory of 1100	1368	msedge.exe	119
PID 3652 wrote to memory of 5096	3652	nlgdyvqoigayvqni.exe	120
PID 3652 wrote to memory of 3676	3652	nlgdyvqoigayvqni.exe	124
PID 3456 wrote to memory of 1764	3456	sqkicavsnl.exe	126
PID 3652 wrote to memory of 5224	3652	nlgdyvqoigayvqni.exe	129
PID 3652 wrote to memory of 2596	3652	nlgdyvqoigayvqni.exe	133
PID 4316 wrote to memory of 5100	4316	xspkfcxvpn.exe	135
PID 3652 wrote to memory of 4800	3652	nlgdyvqoigayvqni.exe	138
PID 3652 wrote to memory of 4532	3652	nlgdyvqoigayvqni.exe	143
PID 4580 wrote to memory of 5944	4580	uspkhfzxrp.exe	145
PID 3652 wrote to memory of 4428	3652	nlgdyvqoigayvqni.exe	148
PID 1368 wrote to memory of 3544	1368	msedge.exe	150
PID 1368 wrote to memory of 5776	1368	msedge.exe	151
PID 1368 wrote to memory of 1832	1368	msedge.exe	152
PID 3652 wrote to memory of 5412	3652	nlgdyvqoigayvqni.exe	155
PID 6088 wrote to memory of 3160	6088	urmkecwupj.exe	157
PID 3652 wrote to memory of 1476	3652	nlgdyvqoigayvqni.exe	160
PID 3652 wrote to memory of 1596	3652	nlgdyvqoigayvqni.exe	164
PID 2068 wrote to memory of 2604	2068	rpjhezwurm.exe	166
PID 3652 wrote to memory of 2588	3652	nlgdyvqoigayvqni.exe	169
PID 3652 wrote to memory of 3948	3652	nlgdyvqoigayvqni.exe	173
PID 5748 wrote to memory of 4212	5748	uomgeywroj.exe	175
PID 3652 wrote to memory of 5776	3652	nlgdyvqoigayvqni.exe	178
PID 3652 wrote to memory of 3052	3652	nlgdyvqoigayvqni.exe	182
PID 3332 wrote to memory of 3272	3332	nljdbvtolg.exe	184
PID 3652 wrote to memory of 4080	3652	nlgdyvqoigayvqni.exe	187
PID 1368 wrote to memory of 3168	1368	msedge.exe	189
PID 1368 wrote to memory of 3168	1368	msedge.exe	189
PID 3652 wrote to memory of 2312	3652	nlgdyvqoigayvqni.exe	195
PID 6084 wrote to memory of 3844	6084	gdyvqoigay.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f729ea72b24150b13cad37242e6cf616_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Temp\nlgdyvqoigayvqni.exe
  C:\Temp\nlgdyvqoigayvqni.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytnlv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\Temp\qoigaytnlv.exe
      C:\Temp\qoigaytnlv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaytnlv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5096
  - - C:\Temp\i_qoigaytnlv.exe
      C:\Temp\i_qoigaytnlv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3676
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5224
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2596
  - - C:\Temp\xspkfcxvpn.exe
      C:\Temp\xspkfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4800
  - - C:\Temp\i_xspkfcxvpn.exe
      C:\Temp\i_xspkfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4532
  - - C:\Temp\uspkhfzxrp.exe
      C:\Temp\uspkhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Temp\i_uspkhfzxrp.exe
      C:\Temp\i_uspkhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwupj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\urmkecwupj.exe
      C:\Temp\urmkecwupj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwupj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1476
  - - C:\Temp\i_urmkecwupj.exe
      C:\Temp\i_urmkecwupj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhezwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1596
  - - C:\Temp\rpjhezwurm.exe
      C:\Temp\rpjhezwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhezwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2588
  - - C:\Temp\i_rpjhezwurm.exe
      C:\Temp\i_rpjhezwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3948
  - - C:\Temp\uomgeywroj.exe
      C:\Temp\uomgeywroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5776
  - - C:\Temp\i_uomgeywroj.exe
      C:\Temp\i_uomgeywroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\nljdbvtolg.exe
      C:\Temp\nljdbvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4080
  - - C:\Temp\i_nljdbvtolg.exe
      C:\Temp\i_nljdbvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2312
  - - C:\Temp\gdyvqoigay.exe
      C:\Temp\gdyvqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1808
  - - C:\Temp\i_gdyvqoigay.exe
      C:\Temp\i_gdyvqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3468
  - - C:\Temp\aysqkigays.exe
      C:\Temp\aysqkigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5488
  - - C:\Temp\i_aysqkigays.exe
      C:\Temp\i_aysqkigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1804
  - - C:\Temp\qkicavsnki.exe
      C:\Temp\qkicavsnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnki.exe ups_ins
    3⤵
    PID:4468
  - - C:\Temp\i_qkicavsnki.exe
      C:\Temp\i_qkicavsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhcau.exe ups_run
    3⤵
    PID:1544
  - - C:\Temp\causpkhcau.exe
      C:\Temp\causpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhcau.exe ups_ins
    3⤵
    PID:2008
  - - C:\Temp\i_causpkhcau.exe
      C:\Temp\i_causpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmhezxr.exe ups_run
    3⤵
    PID:2680
  - - C:\Temp\zxrpmhezxr.exe
      C:\Temp\zxrpmhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmhezxr.exe ups_ins
    3⤵
    PID:2992
  - - C:\Temp\i_zxrpmhezxr.exe
      C:\Temp\i_zxrpmhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbztrm.exe ups_run
    3⤵
    PID:3632
  - - C:\Temp\xrpjhbztrm.exe
      C:\Temp\xrpjhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbztrm.exe ups_ins
    3⤵
    PID:3824
  - - C:\Temp\i_xrpjhbztrm.exe
      C:\Temp\i_xrpjhbztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgbztrlj.exe ups_run
    3⤵
    PID:3896
  - - C:\Temp\rojgbztrlj.exe
      C:\Temp\rojgbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgbztrlj.exe ups_ins
    3⤵
    PID:3924
  - - C:\Temp\i_rojgbztrlj.exe
      C:\Temp\i_rojgbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqojgbztrl.exe ups_run
    3⤵
    PID:4776
  - - C:\Temp\tqojgbztrl.exe
      C:\Temp\tqojgbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqojgbztrl.exe ups_ins
    3⤵
    PID:5392
  - - C:\Temp\i_tqojgbztrl.exe
      C:\Temp\i_tqojgbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbytqljd.exe ups_run
    3⤵
    PID:6008
  - - C:\Temp\ljdbytqljd.exe
      C:\Temp\ljdbytqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbytqljd.exe ups_ins
    3⤵
    PID:2876
  - - C:\Temp\i_ljdbytqljd.exe
      C:\Temp\i_ljdbytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    PID:264
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    PID:2628
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvsqkic.exe ups_run
    3⤵
    PID:1264
  - - C:\Temp\ifaxvsqkic.exe
      C:\Temp\ifaxvsqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvsqkic.exe ups_ins
    3⤵
    PID:4772
  - - C:\Temp\i_ifaxvsqkic.exe
      C:\Temp\i_ifaxvsqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxvpnkfc.exe ups_run
    3⤵
    PID:1916
  - - C:\Temp\hfcxvpnkfc.exe
      C:\Temp\hfcxvpnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1692
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ff98a3ac188,0x7ff98a3ac194,0x7ff98a3ac1a0
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,15319414519516215534,12191183050926690052,262144 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,8510718222063841831,9346176467558598964,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
      4⤵
      System Time Discovery
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,7495223248364378497,6376610432701762118,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13511348015701046037,6011765575618515718,2097152 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3848709832462872611,11902613392087643953,2097152 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10172404458931073295,16492751686725694119,2097152 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,6059962790214342278,11882505373686983627,2097152 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,8402548038141942454,7927325782106322186,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,706872022799491248,16915679780263662173,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15721693617996140736,3845916749697444275,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6711641921607458414,12241248460422409732,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6711641921607458414,12241248460422409732,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9057051810391825250,14878856163734356779,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,7423102587076320901,5080009644782294347,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,10605397557022959525,8050152999341740784,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6537602280506443716,14753619159974593258,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6282163778228715052,1894221203714597520,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,4131156046118916131,6926951538823006234,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,364167239653271824,11647321096920467412,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,15657561108074213445,15232183576694119358,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,2539156972414198446,11697461425615775329,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:14
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,13799734739756344191,3503083302675741473,262144 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:10
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,8373700585808131321,14448430414148861773,524288 --field-trial-handle=2640,i,1336640557386286602,14958536029116207860,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

C:\Temp\nlgdyvqoigayvqni.sys
C:\Temp\nlgdyvqoigayvqni.sys
1⤵
- Executes dropped EXE
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2780

C:\Temp\axvtnlfdxv.sys
C:\Temp\axvtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2948

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:4080

C:\Temp\pmkeczxrpm.sys
C:\Temp\pmkeczxrpm.sys
1⤵
- Executes dropped EXE
PID:1508

C:\Temp\hczusmkecz.sys
C:\Temp\hczusmkecz.sys
1⤵
- Executes dropped EXE
PID:4552

C:\Temp\wuomgecwur.sys
C:\Temp\wuomgecwur.sys
1⤵
- Executes dropped EXE
PID:5520

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
- Executes dropped EXE
PID:4144

C:\Temp\qljdbywqoi.sys
C:\Temp\qljdbywqoi.sys
1⤵
- Executes dropped EXE
PID:5200

C:\Temp\tnljgeywqo.sys
C:\Temp\tnljgeywqo.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:3376

C:\Temp\spnifaxsqk.sys
C:\Temp\spnifaxsqk.sys
1⤵
- Executes dropped EXE
PID:4072

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:3296

C:\Temp\keczxupmkh.sys
C:\Temp\keczxupmkh.sys
1⤵
PID:5404

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
PID:4656

C:\Temp\ojgeywtrlj.sys
C:\Temp\ojgeywtrlj.sys
1⤵
PID:5880

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
PID:4136

C:\Temp\wqoigdbytq.sys
C:\Temp\wqoigdbytq.sys
1⤵
PID:3840

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
PID:5288

C:\Temp\nigaysqkic.sys
C:\Temp\nigaysqkic.sys
1⤵
PID:2924

C:\Temp\caxspnkfca.sys
C:\Temp\caxspnkfca.sys
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvtnlfdxv.sys

Path C:\Temp\axvtnlfdxv.sys
Size 293KB
SHA256 ee6081dc78bc18cda30eb5409356285245fd75fd7129c58422a03cb67e2c41d9
MD5 ce9e5a377d4ac4dd8851a0ae45b44714
SHA1 804b4b904c07fa8bdc3ccee39773bec2eb5f9ccd
SHA512 43d9a857df21674628c3e08e28045c78eabc464b6590a4c3413b86964bf5385d441985a8c63a951aa5ecb42c299251f8bd430fc244333366c6fe8c9a1e67c49b
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfax.sys

Path C:\Temp\fdxvpnhfax.sys
Size 293KB
SHA256 c36b4fac3c04693e39bbb2a603d9c0a9f9ccc52ae840b5b2b09e81aa58d39c2e
MD5 2d466347fd47605356df379307364220
SHA1 fa6aea78b961050141add1815f5bc06b67afa6ba
SHA512 d289f8655e709ca4210b5527dcf2280f45b99d5119f7b8074290dc96ad24809a8e63eca654728a057afc445bad33e4eeba5c962951b05b04cb3903ef4dfe3bdc
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T10C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecz.sys

Path C:\Temp\hczusmkecz.sys
Size 293KB
SHA256 95ceab9c1ccfe5b038a9cf0b81e0122465667e74a60beccf6512f5c30c8aeb6b
MD5 5276c143b6a44dde557bc95ed4656786
SHA1 23ba7c0ed43ef84a1beaaa5bb3fffc941a6a4049
SHA512 5561f5989de68d4e7f902378e575d8e30a1ab421d19d8e89d0007c2171d5e680f8ab83187ffc7867cc9ba49f3f8af7d13aace98f213e6d147abc9034717fbefb
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T101545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaytnlv.exe

Path C:\Temp\i_qoigaytnlv.exe
Size 389KB
SHA256 ddb0662c67026220631bce63fe7514caca8bbf4140ad00efeec72a3c2cb80705
MD5 da2abfe29d6e047df836ba40ec2a974c
SHA1 7c1e1c2a2b1ce54b9f6bd08305f09d81e1d0b085
SHA512 3bf045b370d807c97d5b4ae8ff282f424517d7cbc41fd8af882b00ae767615f11f80c707f4c8e16a706fee821c3430a54f267f58019b8beacfdb194fc3fee72a
SSDEEP 3072:wuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhezwurm.exe

Path C:\Temp\i_rpjhezwurm.exe
Size 389KB
SHA256 52ce648648fdd031d082786d802535ce7faba9eefa291f64473b9167e4fe6412
MD5 ae44bfe026023dbd3c7ac424c93b065c
SHA1 44920b54f6e15331c63f89bc2d5861967fbdf3a3
SHA512 79583106910f07c7f9416b7138ba3717268dc3041868f32fd0cdd47bd26f5d647756e5bb2ca82fdd7afdc20a90166b47538d215b37b001e62c7217a3aede3e08
SSDEEP 3072:+uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnl.exe

Path C:\Temp\i_sqkicavsnl.exe
Size 389KB
SHA256 cfa32ccb55f6e2289683a91480584fd48f40a483a3f89abeec5298d373fde38a
MD5 11c249e9e4b0b6d9f24705a34f4d6c8a
SHA1 fecbff4ec44aba1726ec8551e0a213832328ba02
SHA512 b7575051822809bc56ad7906dc68c87d792c9216cabba0478538cb2c87b1b62897138a5b94928d0478cdf18e72b9a4ddcbe7afb8636a25b9ec371ce90e15a5fd
SSDEEP 3072:Quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwupj.exe

Path C:\Temp\i_urmkecwupj.exe
Size 389KB
SHA256 eca2107ace9f8a827347f5eb3c6e885806113f36c5e157f7b3b1296a5d2601e7
MD5 c3a9781f289cc594ce713c45d5c13093
SHA1 f2cec5b418c481e5d5192c4c8131d31a65634a71
SHA512 54c1891b5874d8cede544db01e96ee1af999fd057209e1ebbf37ab1fe9a901d1bd90efc9cc614580e72eb31d5ff250982d96c30bfa0e290c5b371421b8df9977
SSDEEP 3072:Xuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkhfzxrp.exe

Path C:\Temp\i_uspkhfzxrp.exe
Size 389KB
SHA256 65489555cb0030a7269a643663537f8e63ef185b57c94ff0e6c7e44a286f3536
MD5 164adae808c55ce54853359a33f03558
SHA1 986d989af3950cf27bf4738472521f3b7fc018f9
SHA512 e57dddc1c83daa2dd390bf28e67c314c26916be6034c6d3cd26af64af6e499cc7810b3fefd8d610fbcffa736bbfdd9765451e0b100536b75b58e3e8850753c96
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkfcxvpn.exe

Path C:\Temp\i_xspkfcxvpn.exe
Size 389KB
SHA256 4092188ab97c2a32c05853be3f25b97b2f5f3298f68226328d1821532f8f3bab
MD5 6f40ca16c72fef38448bee660c1fb7b6
SHA1 01c2320ba2a9a80fe9fd9fc532c12e110e92d125
SHA512 a303be3ca1e533d1f02b299c564d8c58eb963a424aae53215ec8c3cfdd13bf63b78562f4c864329cde8b05767238e6af97bf9bab90835856e0e10affbf16c059
SSDEEP 3072:Kuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoigayvqni.exe

Path C:\Temp\nlgdyvqoigayvqni.exe
Size 389KB
SHA256 f94b5d8e724afd0e2b6f129cd63006668353b8221673bec72fc3cffa022a0321
MD5 4eec4a8fcba04f8b254528b1f7cf9bd7
SHA1 29cdfc782ec75846c65939d5948b9bcde994d101
SHA512 f0daf94cb68a30324cd3a96dd599bb58e15c6aaca7853bf5924b46034ed4dc9cdf3baff3ccb99edf882a1b4e8ba26845565c8887caa49c272957a61109532688
SSDEEP 3072:zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoigayvqni.sys

Path C:\Temp\nlgdyvqoigayvqni.sys
Size 293KB
SHA256 818d949fbdb08d1474bf0501c5556342dd1dacf0513fc86f9d27466a4250e785
MD5 31a593a0faa99cbc9e8897df21437bdd
SHA1 5127643eccf6b5cfeb664dc10ca2de77b709ffc0
SHA512 730f71115f2084c39cd76931e86aa927528a017719838c40328aa492d30bf7add6a0917255b88cf31f25236112bcea3fdd20da513e6131b02bfeeb4cae9511bd
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkeczxrpm.sys

Path C:\Temp\pmkeczxrpm.sys
Size 293KB
SHA256 1269049e976f70049654121e06cc72293303036169b652a32e93de0f29102559
MD5 3fac646d9e38db9db50f3b286b47565f
SHA1 b60a8ae27b6d2fc2e37835d1fcd0e234e46daac7
SHA512 d308682751d4082114bd72721820a006d643a2f0961d79c5d0db2ae76cb2dd16576f7c21613d39ecca5518ef4aa973e8c77cd82ab9d7df70cbdabc9c947720e4
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1DB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytnlv.exe

Path C:\Temp\qoigaytnlv.exe
Size 389KB
SHA256 05b010d4281614ddeb95ef11681018f8f629511f23fdbdffb3f3dfc3ba667f65
MD5 f7a71bc6c5e50a4fc004196a1e9d7e3b
SHA1 99c033c98ec98f8863a90fb99643201d0c4548b3
SHA512 0c433367e6251b44f195a0a4206dd9cb330adf207ff1a854512efa0a9811c034f3475e59d5184622b3e48be11961bd2de7888b8117d067cb1ccb720aa1b6cfb0
SSDEEP 3072:ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhezwurm.exe

Path C:\Temp\rpjhezwurm.exe
Size 389KB
SHA256 05959b13d77d0749c228cb37834f0e877e9185b8c6a48315a4ab19b509be4b5c
MD5 1f0636fd4fd7672865a9723bfcc86937
SHA1 030724c91f0c623f3057cd96be675e58a4e0f5de
SHA512 7e943767e77d7a722cda76d14d2c601e7086ab61fad145d93adf40b2a5dde6673a7df857902ed936d1c0cbf3059e95b916a1be42f58a9c45b58c60bb221c856e
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.exe

Path C:\Temp\sqkicavsnl.exe
Size 389KB
SHA256 097ba3913e72223fbd28579b4b677f116e9bbaee2448f47579b86a3fe056773f
MD5 b834203c665ee3df21d3559bbbd2843f
SHA1 5255eca212ab2cec3460f176fb5aecfbf8115dd3
SHA512 6ecb29b19d6e8e0f71ad12495721de1040a0b85a8b53cfc089790ad46658152204338cca8063611d50149a93e5b77e68bf8291d12b285a5628c67ec2f24d0f8c
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupj.exe

Path C:\Temp\urmkecwupj.exe
Size 389KB
SHA256 dcbd0b3fcaeb7085613e8839e03ed69aea4a0053c26c4b3f42109cde29aa7b71
MD5 d26dea7da0032095b2c7239bb40c5bfe
SHA1 90634d1435cb3efdbcf986f8d9a18282606a6b50
SHA512 94575db2829034e1c72c31a83f29742d78ac7a3f648d444da334b68e9e8a0b94b9e42c9eb40401e87aecebf6fe352ceb6dc660938e13d1b26cfac0c70a5c7f07
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkhfzxrp.exe

Path C:\Temp\uspkhfzxrp.exe
Size 389KB
SHA256 1990ecf438fc4a7505a9a1b2e1ada220dbde490f1f14a1a05b05e1c8c0fbd19b
MD5 9b4d546969a126ecf8ffe34b3f03d8ce
SHA1 3097fb655d1e7993a932149afe4c74cf4c332253
SHA512 cceec286ee555d2974f797df297c9cb3b9a116d34da4519aa6d38ce5a559b518321dd5d5986c58bcabb46c15b704355ed05582355ca6eaec15690ed6fa939d00
SSDEEP 3072:Iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgecwur.sys

Path C:\Temp\wuomgecwur.sys
Size 293KB
SHA256 708f14d16d614fc0d18e7c2985415efe11ea9afeb766cf29f80cf124c46399e6
MD5 47feb81b4a96fac21d90f8306c08d453
SHA1 a2f9e5e3c1dcddeac14aa18bf3a8c3f981d740e1
SHA512 17dced428a37b53b873ab0d5f3ed5517fd0744b2f5d3c0e7f60a97c10628eeb90d8c7f94f746086213ee9e2e36b9f4572907da1f0de66c519e7821e01369901f
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkfcxvpn.exe

Path C:\Temp\xspkfcxvpn.exe
Size 389KB
SHA256 5ac519cad7d59d7ab61e3c1cff6657303dcd06f9067da0cb23450481ccaaa71c
MD5 f5ae0c67a08c65b52ec513355c545a43
SHA1 926bd7f28c209ccbe686d743736d2174f4e2c989
SHA512 53221ec187dc73468e57d62b0e4a43b736ada1637519f398abcb3a9e79b4e3a33e63067459ceb20877033df94922e2908cada6de4230266be00f95806f1b2da5
SSDEEP 3072:zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e9c4927b0271968147ca17836a803f7346657155f0904bb74cdf5f9c9c36c7df
MD5 2a7c09ebe37c47a8a0c9fb6b0371e7c2
SHA1 440273195fb8f8b2c9212e72b48ab5fe21f4a10b
SHA512 134120f48a05709b1e4294c2b30784714084449f6e6331ba4e8dcff8be9ece24b10dbe13b19a513cc402bd93ee1d673edd567905ad3a9d47c1caa48a482130e2
TLSH
T1C06185760BB2869AD7A6877A18EB9FB431F4F846454BAE0184645D3CCB07F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59efa6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59efa6.TMP
Size 3KB
SHA256 42006fe4d181413c033d822add02df35ee98b1075b718d4027decc98e19387dd
MD5 7a975280a00cc6ebbe0050c8ee84b7a6
SHA1 1a4e6fd6afd4fc24a448ab55dcd98e3551ac4079
SHA512 a28690b1df756dd3806b45fca4c2b7155ba30c5d1c87040cf378375aa2a5edf5ac4015f4a5d73f84cecdd38a803b86aaf1ace47bdb78748cebe04e51fa6bc64a
TLSH
T1576186760BF286DAD7A6877A18EB9FB431F4F8464407AE1184645D3CCB47F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6e1f34ea1fe6477d0ddb2c048d6ecab66635d2235a094eaa50f37b8462fb39d0
MD5 046ed086f967ed3c043996fdc63d2269
SHA1 565657fbc2a0b6b7b270f10a81d269e5f57fb36d
SHA512 b8f29fd164c94fbbc355809b57d78549babd3fbfc574b94bf809e9650a29f6703860f20dd5e4e9b994ef3df7bb3edbecb96cf3bc606322d65ca48d07bf3498d0
TLSH
T1DA41C0F783F8857E8A0156F0AA186E1FCE6D0515432C7D5688E0AE2BA3F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 68cb6d394b649f585eacb494eb81422352748aa0f2275a4223dbdf1ac100b4f6
MD5 1f112201f96b1d0077927554a4de7bc8
SHA1 85bff907c4ad9382938540b575b3aac094d8dfea
SHA512 d35052129f5ffe5743c318b786f5f3df3b386e83f90532c39f66fab7872e73c7b104b4981178c8c3ff13b6fa33fef56a5bc811216f11f37a7a4c36a6ee14e213
SSDEEP 192:sxRZReyM/jK1Ml8wCO/fusD5hZFNpzoA8p9H/g6+WNCzw/YEgNiKtuGnIgV6J:sxRZA8O/fusD5vUp/59/Jc8
TLSH
T1D062EA15AA349977CCDBE308FA557F93D6F8557392901E44AAFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 12b597bd17be18c25acffb44871b5924917e43e16c0e21c182086f0858f98b87
MD5 766877726ad58fb09b3bb76b0fd75401
SHA1 9a9ccd391a9eb465f6559ecf438b0308fde3c25e
SHA512 68f3022c606993806a9992aed097146990d5b720732b971ea29e713619e5e0ae9ba6e7980a9efca4edb0cf038ce8bb971a4aecf21ae4a03c1e42c6859ce5ae82
SSDEEP 192:sxRqReyM/jK1Ml8wCO/fusB5hZFNpzoA8p9H/g6+WNCzw/YEgNiKtuGnIgDq6J:sxRqA8O/fusB5vUp/59/JcN
TLSH
T14262EA15BA349977CCDBD308FA557F93D6F8547392901E44AAFC8A1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e2a343ac3ee90931dd2b965f71fd7cb7fe6bc53321cce9228fc28bec905eb90
MD5 3ef80043d4e9c7b29ce60d18f335a5e8
SHA1 a2b17a663a1aec843cf733006988bb316294619a
SHA512 32f114e274e1a8d78077778d40ce4754c9479ec4bb6075aaee068756a336d7b07044fd11df734d8fdc3d24c28cf6c747146bc5db6116dcfcf8a8449c67cc1ffd
SSDEEP 192:sxRqReyM/jK1Ml8UQTmCO/fusBwhZFNpzoA8prH/g6+WNCzw/YESdiKtuGnIgDQ2:sxRqAqTBO/fusBwvUz/59/lcz
TLSH
T15962E915AA349977CCDBE308FA557F93D6F8547392941E44AAFC8E1C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0eab49d78cbd5cec3e4e95f4d80e9002824102e16b48e792b2e8eb4cd69e496c
MD5 aa82e664b6587eeeb8f4b70be2f919be
SHA1 a8f47b4dee9dedacef26b26c6ad838c06b9bc34c
SHA512 eda8ab8a216c62a081702088c3c2514201f42f5b29e638068d61930d17fa92aa31785721fdc7943ef4574e619ad2851f28ab1b06f1a4d8637eefb75dedea0989
SSDEEP 768:0hii9W7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIyeOV89rob63:0hii92E7jaWgH7f3Qu1jaTyeI82u
TLSH
T13BE2EC3B680CCB7E4F404EDCEC29BD9AADE801CF56D8899447EA884C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d1b2a08-192a-4ba6-8e95-72d622c73efb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3d1b2a08-192a-4ba6-8e95-72d622c73efb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1c43259eb8ba1e68fcc3455b69b44142fad9c851322c2bc0543d7c1dcfea0c5f
MD5 6bdf15bbc228ebc33d445711b0fd8736
SHA1 7ee6f8a99cbac34219b6eeb7b4d2d822fe7a10a7
SHA512 ab477c7a5fbc53e8d48b61d2cd93fe509bf72027e602d073a54d9942b59994a1cbcf66cf824fe63c6497c258bfd44a05060e30b73b5c8a66a73a6cd46527d3b9
SSDEEP 768:zs37g5qG0U7D0cK48dHeByERRFzjK3YDdqYWrBuy:zs3UsG0o0p48dHSyw/VdYBv
TLSH
T1A8F29DB06CA59D774CEBE24976437397EEF0416385D46E58D9DDAA0F44832EC070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6f2dc29fe7dabf7b43d537d1bffd137ccfbcb4f90c94a5cc9c4c5f098046282d
MD5 dad2bf2df1e2cec2427da37f5403e9c3
SHA1 64a8fcc4b4ca0d12bf7a235d27ac3979953c249f
SHA512 3058c1b5e6c5bed1d656744b19219ac23cfa8c6d0ee3151a43cfd463c8eba8b41155e8230d1c03e772bfc7f4c850ad89b62670ce97ca1326045b20ac9c99ba5b
SSDEEP 768:arv+4UNbdv3725qGzS7D0TK48dHeByERRFzjK3YDdwk:absbx3qsGzu0248dHSyw/Vdwk
TLSH
T12303BE70A9A8AE734CFBE249B2477797BFF0016384C41B64D9C96A4E45870DD270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 636c46097b71919b6f193171aa218044ab66c8014d4e217bb18c8632648617cc
MD5 544809a84f54b95f0a1be5fbbd1a68df
SHA1 bc451a1071b6dbef7fd97fce6e1328fe66fb7fff
SHA512 725ae4b69e7543ed9c4eb70a97ca01b74b288eaf97b4beed945a04b444aa2685753b986fcd2d10c913f469e1c67ce0da16d0054ee7835732258c6bb7b87a78d1
SSDEEP 768:Qrv+4UNbdf3fqGB/DxK48dHeByERRFzjK3YJeVH1SCj:QbsbJ3SGJ448dHSyw/LEH1Z
TLSH
T15803BE71A8A85E774CE792897683B657BFF4811382C41BA4C4DD6F4E828B4DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 75050e0b5d2ba05ea1948571df19201f6a42899cd71b908ea3b31fc091534e87
MD5 1e25f40bdc05a1cb1ab6d338bd687d35
SHA1 460e3c3a1864fe223d6c9994584292c7c8dc22cf
SHA512 1a98b26849c11af5b720806ede90da9a1caf9083b0799bbfd561151cd4394f77ae6b2520795e9c0f6a50b49c013589b78a7108707abece2ba7699ce137ae3174
SSDEEP 768:erv+4UNbdf3SKqGGMpD0OK48dHeByERRFzjK3JDdeVH1SCj:ebsbJ3yGGy0H48dHSyw/gdEH1Z
TLSH
T1EE03BE70A9A89E734CEBE249B183B79BBFF4412385C40B64D5C9AF4E45860DD170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 23122cb6d07dc363cd8c0f4bee23cda89adfe4d5df882b872ad094ca96ec4f5a
MD5 0fdbb692a4adc26b349259161a2b1c72
SHA1 af84dbbb452899177387ad12701ec62c94f2cc92
SHA512 a39d16641ff0f308aba4bc143a26cf29d96231993b7817a4493eddc9a94aa075f0d2b6c318216cd716be75bedb2a44a80e0d37338932f3c94efd062b316fdb6d
SSDEEP 768:es37F5qG0U7D0cK48dHeByERRFzjK3YDdqYWrBuy:es3RsG0o0p48dHSyw/VdYBv
TLSH
T1DDF29DB0ACA59D774CABE24976437397EFF0416385D46E58D9DDAA0E44832EC070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5ab7941a09dc0947beb4703340314b2e6d834cef29087f3dace169536d3d85e4
MD5 013dce12699f59760372e6a41a630649
SHA1 9077c858b8f6f6ec6c615b7f4ef9e5036626c1f8
SHA512 d9285b5dbbe557793f3dd6bd2cf6f662d44a2789eb795dda75a2f8722c0749e97fc1c3f8c81b81617f655c9c62fd068e8f8922dc7915775817f5430f5259fb24
SSDEEP 768:HFQu37Nwgq5qG0/z6kK48dHeByERRFzjK3YDdqYWrBuy:au3qsG0uB48dHSyw/VdYBv
TLSH
T1821329F098D39976C8AE9387673E7E469ABCC063B5885994B7C85D0DCC821BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

fabb90fb-f07a-4f74-b97d-d481e63336df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fabb90fb-f07a-4f74-b97d-d481e63336df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_190091616\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 af01e41d6448224dc7e9298c5ec56c5686c7a12763cf2bc2edb24e14281ee04b
MD5 ba3a73c1cfa11101602e96d7084a680b
SHA1 1d791bc23ebca8fa8b6d679942569606225a3707
SHA512 d63796ff7673c7f84a11f214684e10162ac1d37ea4f4e5a20fe42d1aa8e86ff3a34217f81245cec08f78f66788a7919b79350828865b200b7a00a669a56ace2c
TLSH
T1C371E39397A9C6B3C1DE5FF102835644F6FB22384763702407955587AB70A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1508-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2924-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2948-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3080-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3296-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3376-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3840-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4072-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4072-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4080-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4136-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4144-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4552-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4552-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4656-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5200-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5288-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5520-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download