systex | 78e144bcbde2c02fb68858359a6d652a9ace51e67cbecb7a7a91f221b8e9f306

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260819-qkynmaxsd1
SHA256 78e144bcbde2c02fb68858359a6d652a9ace51e67cbecb7a7a91f221b8e9f306
MD5 6c52ece1e018490b31d07619311a587c
SHA1 2831669e47fdf7710bb1c4d55b14a00228edcaf2
SHA512 dfdd8b10b010b7f487e85e9a9e431d791db5e4934666bfc0389bb79fad986e89e786135a1d10c95aac8938df785e2cc7d084a76ea3bbd0a6ee9cc511e7455f90
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4216	faysqkicaysqkica.exe
4500	faysqkicaysqkica.sys
2368	CreateProcess.exe
4828	ifdxvqkfxs.exe
2840	CreateProcess.exe
3880	CreateProcess.exe
4696	i_ifdxvqkfxs.exe
4124	faxspnhfzu.sys
520	CreateProcess.exe
4500	xupkhfzxsm.exe
556	CreateProcess.exe
6112	CreateProcess.exe
3632	i_xupkhfzxsm.exe
2432	usmkfcxmhf.sys
3420	CreateProcess.exe
3888	fzwurmjhfc.exe
472	CreateProcess.exe
2400	CreateProcess.exe
2112	i_fzwurmjhfc.exe
1444	hbzxrpjhbz.sys
396	CreateProcess.exe
4788	hbzurmbwto.exe
932	CreateProcess.exe
3044	CreateProcess.exe
4652	i_hbzurmbwto.exe
1752	zurmjebwuo.sys
2500	CreateProcess.exe
1336	rmjebzwuol.exe
5332	CreateProcess.exe
4980	CreateProcess.exe
5824	i_rmjebzwuol.exe
1400	eytrojgebw.sys
5716	CreateProcess.exe
3380	bywqoljebw.exe
540	CreateProcess.exe
4552	CreateProcess.exe
2784	i_bywqoljebw.exe
5916	jdbwtoigby.sys
5252	CreateProcess.exe
5860	ytqljdbvtn.exe
2940	CreateProcess.exe
4632	CreateProcess.exe
5908	i_ytqljdbvtn.exe
5780	bytqljdbvt.sys
4324	CreateProcess.exe
5044	tqlidayvtn.exe
5940	CreateProcess.exe
4288	CreateProcess.exe
2528	i_tqlidayvtn.exe
6076	vtqkidavtn.sys
5112	CreateProcess.exe
4876	kifaysnlfd.exe
2596	CreateProcess.exe
5492	CreateProcess.exe
4816	i_kifaysnlfd.exe
4648	ifaxspkica.sys
1816	CreateProcess.exe
4244	caxspnkfca.exe
4456	CreateProcess.exe
3260	CreateProcess.exe
1696	i_caxspnkfca.exe
5776	qkicausnkf.sys
1932	CreateProcess.exe
4652	ecausmhfcx.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_201069936\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1856754805\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1054471381\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1054471381\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1187740867\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1187740867\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1856754805\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1187740867\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5520_1187740867\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupkhfzxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecausmhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnlfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnlfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebzwuol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcaurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupkhfzxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzwurmjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebzwuol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvqkfxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvqkfxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzwurmjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecausmhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcaurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5984	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1180	ipconfig.exe
2904	ipconfig.exe
4536	ipconfig.exe
5612	ipconfig.exe
5480	ipconfig.exe
2132	ipconfig.exe
6060	ipconfig.exe
1296	ipconfig.exe
2784	ipconfig.exe
2956	ipconfig.exe
5488	ipconfig.exe
912	ipconfig.exe
1880	ipconfig.exe
1564	ipconfig.exe
4588	ipconfig.exe
4376	ipconfig.exe
4856	ipconfig.exe
4176	ipconfig.exe
2168	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316192014576183"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{2C49E240-0730-4186-8866-08D86AFC4492}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe
4216	faysqkicaysqkica.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	i_ifdxvqkfxs.exe
Token: SeDebugPrivilege	3632	i_xupkhfzxsm.exe
Token: SeDebugPrivilege	2112	i_fzwurmjhfc.exe
Token: SeDebugPrivilege	4652	i_hbzurmbwto.exe
Token: SeDebugPrivilege	5824	i_rmjebzwuol.exe
Token: SeDebugPrivilege	2784	i_bywqoljebw.exe
Token: SeDebugPrivilege	5908	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	2528	i_tqlidayvtn.exe
Token: SeDebugPrivilege	4816	i_kifaysnlfd.exe
Token: SeDebugPrivilege	1696	i_caxspnkfca.exe
Token: SeDebugPrivilege	3564	i_ecausmhfcx.exe
Token: SeDebugPrivilege	1808	i_khcaurmkec.exe
Token: SeDebugPrivilege	5244	i_tromhezwrp.exe
Token: SeDebugPrivilege	5428	i_romgeywrlj.exe
Token: SeDebugPrivilege	452	i_bytrljdbvt.exe
Token: SeDebugPrivilege	4036	i_qlidbvtnlf.exe
Token: SeDebugPrivilege	2232	i_idavsnlfdx.exe
Token: SeDebugPrivilege	3532	i_xvpnlfcaxs.exe
Token: SeDebugPrivilege	4880	i_usmkfcxupn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4216	4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4592 wrote to memory of 2268	4592	2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 2268 wrote to memory of 5520	2268	iexplore.exe	91
PID 5520 wrote to memory of 3512	5520	msedge.exe	92
PID 5520 wrote to memory of 1228	5520	msedge.exe	94
PID 5520 wrote to memory of 5984	5520	msedge.exe	95
PID 5520 wrote to memory of 1228	5520	msedge.exe	94
PID 5520 wrote to memory of 1228	5520	msedge.exe	94
PID 5520 wrote to memory of 3184	5520	msedge.exe	96
PID 5520 wrote to memory of 3184	5520	msedge.exe	96
PID 5520 wrote to memory of 124	5520	msedge.exe	97
PID 5520 wrote to memory of 124	5520	msedge.exe	97
PID 5520 wrote to memory of 124	5520	msedge.exe	97
PID 5520 wrote to memory of 396	5520	msedge.exe	98
PID 5520 wrote to memory of 396	5520	msedge.exe	98
PID 5520 wrote to memory of 396	5520	msedge.exe	98
PID 5520 wrote to memory of 4808	5520	msedge.exe	99
PID 5520 wrote to memory of 4808	5520	msedge.exe	99
PID 5520 wrote to memory of 4808	5520	msedge.exe	99
PID 5520 wrote to memory of 5112	5520	msedge.exe	100
PID 5520 wrote to memory of 5112	5520	msedge.exe	100
PID 5520 wrote to memory of 5112	5520	msedge.exe	100
PID 5520 wrote to memory of 4124	5520	msedge.exe	102
PID 5520 wrote to memory of 4124	5520	msedge.exe	102
PID 5520 wrote to memory of 6132	5520	msedge.exe	105
PID 5520 wrote to memory of 3616	5520	msedge.exe	106
PID 5520 wrote to memory of 6132	5520	msedge.exe	105
PID 5520 wrote to memory of 3616	5520	msedge.exe	106
PID 5520 wrote to memory of 2376	5520	msedge.exe	108
PID 4216 wrote to memory of 2368	4216	faysqkicaysqkica.exe	110
PID 5520 wrote to memory of 3404	5520	msedge.exe	113
PID 5520 wrote to memory of 3404	5520	msedge.exe	113
PID 4828 wrote to memory of 2840	4828	ifdxvqkfxs.exe	115
PID 5520 wrote to memory of 4404	5520	msedge.exe	118
PID 5520 wrote to memory of 4404	5520	msedge.exe	118
PID 4216 wrote to memory of 3880	4216	faysqkicaysqkica.exe	119
PID 4216 wrote to memory of 520	4216	faysqkicaysqkica.exe	123
PID 4500 wrote to memory of 556	4500	xupkhfzxsm.exe	125
PID 4216 wrote to memory of 6112	4216	faysqkicaysqkica.exe	128
PID 4216 wrote to memory of 3420	4216	faysqkicaysqkica.exe	132
PID 3888 wrote to memory of 472	3888	fzwurmjhfc.exe	134
PID 4216 wrote to memory of 2400	4216	faysqkicaysqkica.exe	137
PID 4216 wrote to memory of 396	4216	faysqkicaysqkica.exe	142
PID 4788 wrote to memory of 932	4788	hbzurmbwto.exe	144
PID 4216 wrote to memory of 3044	4216	faysqkicaysqkica.exe	147
PID 5520 wrote to memory of 2580	5520	msedge.exe	149
PID 5520 wrote to memory of 5380	5520	msedge.exe	150
PID 5520 wrote to memory of 4880	5520	msedge.exe	151
PID 4216 wrote to memory of 2500	4216	faysqkicaysqkica.exe	154
PID 1336 wrote to memory of 5332	1336	rmjebzwuol.exe	156
PID 4216 wrote to memory of 4980	4216	faysqkicaysqkica.exe	159
PID 4216 wrote to memory of 5716	4216	faysqkicaysqkica.exe	163
PID 3380 wrote to memory of 540	3380	bywqoljebw.exe	165
PID 4216 wrote to memory of 4552	4216	faysqkicaysqkica.exe	168
PID 4216 wrote to memory of 5252	4216	faysqkicaysqkica.exe	172
PID 5860 wrote to memory of 2940	5860	ytqljdbvtn.exe	174
PID 4216 wrote to memory of 4632	4216	faysqkicaysqkica.exe	177
PID 4216 wrote to memory of 4324	4216	faysqkicaysqkica.exe	181
PID 5044 wrote to memory of 5940	5044	tqlidayvtn.exe	183
PID 4216 wrote to memory of 4288	4216	faysqkicaysqkica.exe	186
PID 5520 wrote to memory of 1468	5520	msedge.exe	188
PID 5520 wrote to memory of 1468	5520	msedge.exe	188
PID 4216 wrote to memory of 5112	4216	faysqkicaysqkica.exe	194
PID 4876 wrote to memory of 2596	4876	kifaysnlfd.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6c52ece1e018490b31d07619311a587c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Temp\faysqkicaysqkica.exe
  C:\Temp\faysqkicaysqkica.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvqkfxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2368
  - - C:\Temp\ifdxvqkfxs.exe
      C:\Temp\ifdxvqkfxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvqkfxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3880
  - - C:\Temp\i_ifdxvqkfxs.exe
      C:\Temp\i_ifdxvqkfxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupkhfzxsm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:520
  - - C:\Temp\xupkhfzxsm.exe
      C:\Temp\xupkhfzxsm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupkhfzxsm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\i_xupkhfzxsm.exe
      C:\Temp\i_xupkhfzxsm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzwurmjhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\fzwurmjhfc.exe
      C:\Temp\fzwurmjhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzwurmjhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2400
  - - C:\Temp\i_fzwurmjhfc.exe
      C:\Temp\i_fzwurmjhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:396
  - - C:\Temp\hbzurmbwto.exe
      C:\Temp\hbzurmbwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3044
  - - C:\Temp\i_hbzurmbwto.exe
      C:\Temp\i_hbzurmbwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebzwuol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2500
  - - C:\Temp\rmjebzwuol.exe
      C:\Temp\rmjebzwuol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebzwuol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\i_rmjebzwuol.exe
      C:\Temp\i_rmjebzwuol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5716
  - - C:\Temp\bywqoljebw.exe
      C:\Temp\bywqoljebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4552
  - - C:\Temp\i_bywqoljebw.exe
      C:\Temp\i_bywqoljebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5252
  - - C:\Temp\ytqljdbvtn.exe
      C:\Temp\ytqljdbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Temp\i_ytqljdbvtn.exe
      C:\Temp\i_ytqljdbvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidayvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\tqlidayvtn.exe
      C:\Temp\tqlidayvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidayvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\i_tqlidayvtn.exe
      C:\Temp\i_tqlidayvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaysnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\kifaysnlfd.exe
      C:\Temp\kifaysnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaysnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5492
  - - C:\Temp\i_kifaysnlfd.exe
      C:\Temp\i_kifaysnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnkfca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1816
  - - C:\Temp\caxspnkfca.exe
      C:\Temp\caxspnkfca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnkfca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3260
  - - C:\Temp\i_caxspnkfca.exe
      C:\Temp\i_caxspnkfca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecausmhfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\ecausmhfcx.exe
      C:\Temp\ecausmhfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecausmhfcx.exe ups_ins
    3⤵
    PID:4212
  - - C:\Temp\i_ecausmhfcx.exe
      C:\Temp\i_ecausmhfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcaurmkec.exe ups_run
    3⤵
    PID:1876
  - - C:\Temp\khcaurmkec.exe
      C:\Temp\khcaurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcaurmkec.exe ups_ins
    3⤵
    PID:4820
  - - C:\Temp\i_khcaurmkec.exe
      C:\Temp\i_khcaurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromhezwrp.exe ups_run
    3⤵
    PID:696
  - - C:\Temp\tromhezwrp.exe
      C:\Temp\tromhezwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromhezwrp.exe ups_ins
    3⤵
    PID:1148
  - - C:\Temp\i_tromhezwrp.exe
      C:\Temp\i_tromhezwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgeywrlj.exe ups_run
    3⤵
    PID:3404
  - - C:\Temp\romgeywrlj.exe
      C:\Temp\romgeywrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgeywrlj.exe ups_ins
    3⤵
    PID:3564
  - - C:\Temp\i_romgeywrlj.exe
      C:\Temp\i_romgeywrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    PID:5604
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    PID:5708
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    PID:4068
  - - C:\Temp\qlidbvtnlf.exe
      C:\Temp\qlidbvtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    PID:4116
  - - C:\Temp\i_qlidbvtnlf.exe
      C:\Temp\i_qlidbvtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsnlfdx.exe ups_run
    3⤵
    PID:2432
  - - C:\Temp\idavsnlfdx.exe
      C:\Temp\idavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsnlfdx.exe ups_ins
    3⤵
    PID:4144
  - - C:\Temp\i_idavsnlfdx.exe
      C:\Temp\i_idavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnlfcaxs.exe ups_run
    3⤵
    PID:5912
  - - C:\Temp\xvpnlfcaxs.exe
      C:\Temp\xvpnlfcaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnlfcaxs.exe ups_ins
    3⤵
    PID:1448
  - - C:\Temp\i_xvpnlfcaxs.exe
      C:\Temp\i_xvpnlfcaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfcxupn.exe ups_run
    3⤵
    PID:1348
  - - C:\Temp\usmkfcxupn.exe
      C:\Temp\usmkfcxupn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfcxupn.exe ups_ins
    3⤵
    PID:2544
  - - C:\Temp\i_usmkfcxupn.exe
      C:\Temp\i_usmkfcxupn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc3be2c188,0x7ffc3be2c194,0x7ffc3be2c1a0
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,354160501746446655,16621570473890675678,262144 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,13467563770932610058,4645555453716446294,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
      4⤵
      System Time Discovery
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,14049891904905608620,12248461884931786130,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:13
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,6180210193136769693,12398461182513010226,2097152 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,12057329089899165212,17715501832283907036,2097152 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,12026205572625111219,265361584107459687,2097152 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,17807204194297277614,5736506803288610156,2097152 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1873133422820461169,15263611003752291111,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,15577548490041278597,17695429401841938600,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,6109402238167275881,12873186600892403238,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,10540755036620480531,16585352131968056529,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,10540755036620480531,16585352131968056529,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,492214940105625921,9614749939957979013,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,14574515427285937071,15402095841538985081,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,17930099051528142432,14355729572734516086,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15919617901860047939,11994685189538970407,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,14731392331391423561,11312846326413630855,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,8165269400978853296,752325685513920900,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,9438916112645606187,17876345797559235856,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,9710943507345737473,16978484026321613991,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,18095600347624868485,11046776221672837926,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,16341860531520873906,10076383708765318449,262144 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:10
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,10641211003649556242,6057973038732580070,524288 --field-trial-handle=2616,i,2836559855442850401,9505313491535841242,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
      4⤵
      PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5912

C:\Temp\faysqkicaysqkica.sys
C:\Temp\faysqkicaysqkica.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3588

C:\Temp\faxspnhfzu.sys
C:\Temp\faxspnhfzu.sys
1⤵
- Executes dropped EXE
PID:4124

C:\Temp\usmkfcxmhf.sys
C:\Temp\usmkfcxmhf.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\hbzxrpjhbz.sys
C:\Temp\hbzxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:1444

C:\Temp\zurmjebwuo.sys
C:\Temp\zurmjebwuo.sys
1⤵
- Executes dropped EXE
PID:1752

C:\Temp\eytrojgebw.sys
C:\Temp\eytrojgebw.sys
1⤵
- Executes dropped EXE
PID:1400

C:\Temp\jdbwtoigby.sys
C:\Temp\jdbwtoigby.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:5780

C:\Temp\vtqkidavtn.sys
C:\Temp\vtqkidavtn.sys
1⤵
- Executes dropped EXE
PID:6076

C:\Temp\ifaxspkica.sys
C:\Temp\ifaxspkica.sys
1⤵
- Executes dropped EXE
PID:4648

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
- Executes dropped EXE
PID:5776

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
PID:5736

C:\Temp\zwromjhbzt.sys
C:\Temp\zwromjhbzt.sys
1⤵
PID:2032

C:\Temp\trljdbztrl.sys
C:\Temp\trljdbztrl.sys
1⤵
PID:6052

C:\Temp\qomjdbzwqo.sys
C:\Temp\qomjdbzwqo.sys
1⤵
PID:4648

C:\Temp\ywqoigdbvt.sys
C:\Temp\ywqoigdbvt.sys
1⤵
PID:2372

C:\Temp\nlfdyvqnif.sys
C:\Temp\nlfdyvqnif.sys
1⤵
PID:5560

C:\Temp\davsnlfdxv.sys
C:\Temp\davsnlfdxv.sys
1⤵
PID:4080

C:\Temp\usmkhcausp.sys
C:\Temp\usmkhcausp.sys
1⤵
PID:1728

C:\Temp\czxrpkhczx.sys
C:\Temp\czxrpkhczx.sys
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bywqoljebw.exe

Path C:\Temp\bywqoljebw.exe
Size 365KB
SHA256 5ff87318f558df1073a28e8ab89f3b2b93936dc4d86591b5d7795a1840173f8b
MD5 a6f8cabe6f23b4813ba36f9a10609570
SHA1 adf781ebab4bb45c6bcb16733162422bc2e0d12b
SHA512 132a6e305eed37b9d2aa00a074557e0635705b10227bdfb605268a7c5ebc30accb374e7cbc04da7c239421d0be92eccbdea0d42e2dc0a9c27c3ad5f00adf26b0
SSDEEP 3072:QuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eytrojgebw.sys

Path C:\Temp\eytrojgebw.sys
Size 293KB
SHA256 dbcbef9ec167925638f5f3c5bb77fd3f69d9a469692805429510d092a39319de
MD5 ef530a10acbdbbca4f44ee0a9fd2a196
SHA1 b934941581da142bd86a5d2f9015f5fc97799490
SHA512 9ade7d4d4bec35a61651d9f911d1f565a6209f449132da87b741e603f83a24541410935105c08a9f5dfd0e10a18e3957e6dcbf42839fdaa39699516478b17b1a
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T12D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspnhfzu.sys

Path C:\Temp\faxspnhfzu.sys
Size 293KB
SHA256 3d9aea951a6769aaf0f74522e3d1ee96e44d667de463f41909ba72acd558041a
MD5 6a2d5cc51d685aaa5968f79b98bffdec
SHA1 1b6609dce875001a14b4009f9f470b465ef9f3ed
SHA512 e9108e1a3c849c974b51c540ca58341d05240ff01ce231a57794202d55c3415916b48b245778e87acaa5ce7dc80a5a331800b7cd7f40165edaf834742fa6c645
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicaysqkica.exe

Path C:\Temp\faysqkicaysqkica.exe
Size 365KB
SHA256 9db07ef02f4ff52a1421147283afe9db2d7835b417c62aaf1cd658e578ca05e1
MD5 e4c34b27c0868285ec6ddec0cf5269b8
SHA1 b099b3eb293380f13d219bb22b595f5c4edd6f92
SHA512 dc6c1aecf7157339fd4d7e9983234ca3e79bdaf9261bae90c0aeb481b02b51ff147a5050c35d694fbb2f1d7504a47961baeb2a6371eb1ce6070e2c25e4064b48
SSDEEP 3072:8uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicaysqkica.sys

Path C:\Temp\faysqkicaysqkica.sys
Size 293KB
SHA256 e9513228124d012b0b89ca023f68b2260b2d7b622ab15a4be38d770d212f5a69
MD5 0525883f21b51685d368a839c3479ad0
SHA1 694e8a60069afdfda8716a8231ea2d436f884b77
SHA512 25613ebf17fff5fdfc004d8fd77d731ec7b1b9b20423bb9d72e92354e1ce9fb7b5c24acf59725bd91a86ede0816ba366b73c85a5e988c94fea1758fe1ce138ab
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzwurmjhfc.exe

Path C:\Temp\fzwurmjhfc.exe
Size 365KB
SHA256 e9a8ee53b972bb334912e8eadc8ed3b29590f387450f86c0abc547ed5e22844c
MD5 adfca64f5d61f9344f5cd117fbcfb8a4
SHA1 4b4e2c608cdb3a1b5ef6a1952c81fa73b5ad3e07
SHA512 bff211d22704a2b63f1b6e6e0d31b4251f27c8b22a137d135c57cdf5cb312da0003826b2e2a899cb159b44aaf5491f592893688aa6610080a62636e1f4f29c57
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmbwto.exe

Path C:\Temp\hbzurmbwto.exe
Size 365KB
SHA256 b762c1bce47e81acef30b127b525b53f59b163cc3d7348a2e54602aac8b5092b
MD5 fa06d47f7934d94ed09df97d3bb130c1
SHA1 b6a8c53d203f78e49e9b1633335f31e7d3608fcc
SHA512 f60fe7deedcb0f96b998432bcf647c800b0ae41c3cf79234838b1ea2c951a8b0bc93d206c3af17809321d5af1f05c31914aa2d1b7b20e549eff21af3597eddf2
SSDEEP 3072:YuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxrpjhbz.sys

Path C:\Temp\hbzxrpjhbz.sys
Size 293KB
SHA256 c09482ee7b6588a9c9bdd95b664d3c446c8262f5cc03c166e2c567ab1090c551
MD5 0e1ea067351842ed75fe74598d92ffb6
SHA1 9dafd686ecb68774a348c7e56090900652c2d33b
SHA512 5c7427f059a149ef5304e7f7b4e7e15ada3364497e8b4eaf10e8eade467249778be7919ae8cc13daea3872a6f3e20cf443b0511821e4591c3cb9e9e3879fc49a
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqoljebw.exe

Path C:\Temp\i_bywqoljebw.exe
Size 365KB
SHA256 155ff920b4af60f8bf7cb9dea8cfafc3a07c079607ab52428503176d2229e2b9
MD5 808818c9e76b132b8767c47f9975ec05
SHA1 bb239d7ab41c764ddc65ffe6926337f98c622695
SHA512 261430daad2eca10fa90d516851a34721ee847719202665b28b872c6131163ff905caf3d08864c962e096a70aeac7b96e2716492de6c591dd9ca62012a3927c8
SSDEEP 3072:euxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzwurmjhfc.exe

Path C:\Temp\i_fzwurmjhfc.exe
Size 365KB
SHA256 1525531d48c761e77513c4c9046fc6a82dc02c76f2a76a19ea1b504984b656ff
MD5 2be2f0deb6f903374c2e74485ad39d48
SHA1 33b56702ee9dd3232d311274575e18e9265d00a1
SHA512 80d11d71e130846081701c8b8ee2a135461ae5a74c21688990589bca6e0da687d43e59d3de270ae05d776e87ad9cb4853128d3e5804d439a931130c85ac6952e
SSDEEP 3072:JuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzurmbwto.exe

Path C:\Temp\i_hbzurmbwto.exe
Size 365KB
SHA256 245d4abccc9ebc0f006b91d490dea900a03c67fcd6d161df4b3fbaf15097c208
MD5 0c0260f3cb5c3f8b97eda3e0ce694c5b
SHA1 dcb3177f544688fef1ba3a59ca7114ad300bd096
SHA512 6ad70aeabe216c1344d35a1f37ad713ec38cd2d08f4b07c1fe136a45e80b8282916941e55ec068af5e7b80f01283a02f01158753916de0a15a07880ff2cd679b
SSDEEP 3072:ouxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ouxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifdxvqkfxs.exe

Path C:\Temp\i_ifdxvqkfxs.exe
Size 365KB
SHA256 9ac8fd2198774d9116b055a8e3e7dcf4ac0c08b4b0c7654d7f74ac98f602bac7
MD5 c1ccd01677de102e6c0f6740ab2ff9e5
SHA1 3976565bef5d9eb15b90cdcff50211301b1297a4
SHA512 fa41d71d926b205fcba3c89e134f26010fe7b8d951e98f8f020225734d958bb985f47dddf4ad8bef41e457b18c68e93db3c0b81cb0a6f241ec22f022aac0e8cd
SSDEEP 3072:IuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjebzwuol.exe

Path C:\Temp\i_rmjebzwuol.exe
Size 365KB
SHA256 816aff1653e88693e30a0a83d497477309a97d20c2cc19354649f58dddc49f4a
MD5 07f8d8ba006de93d33e17bc66916109c
SHA1 ebf82e67a5784410ff9cb919bc93d54a3ea89ea8
SHA512 5c8a284888773094733dd4054806e1ac56241cfe0fe7fb250de228a869e754008db61ddc13b35442ae816a992db491bdc994bfa8d804945aba59a53d72173818
SSDEEP 3072:wuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupkhfzxsm.exe

Path C:\Temp\i_xupkhfzxsm.exe
Size 365KB
SHA256 0e5b60e2e9caf6625b23534129e542e107e5384157168edb59996e77fa2860be
MD5 4ffe1926499f6cea23678ed44d2573f9
SHA1 12e4f8897d4f40734dcd844af75a6176b701ff86
SHA512 6723b751e26c0ba700ac1d3a26bbc762ac3f56b3b097b118eabd6fd3db7f21a55545076529ee714e9bd02895d17bbe7d794f7aa2a08bc70280b93119ba0ee353
SSDEEP 3072:NuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvqkfxs.exe

Path C:\Temp\ifdxvqkfxs.exe
Size 365KB
SHA256 5c988ab501997b1ed330bf015093fb87d4321f744882e72b78a153d51019425f
MD5 baea5bf1b06317fd3b2a18876ef8ff75
SHA1 cac6aea5ff0ad35e83bb1f800f0335f2cb4daaa2
SHA512 a2e1e1049c7b2b9b1ab6fd2a74888a3d473ac0a95219d97a98d3b6be3018e7d2a99794bf8ccb5627fdc8f2773fa367efbb36b9d9bf19de38fa79b7eeef38b4ca
SSDEEP 3072:NuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebzwuol.exe

Path C:\Temp\rmjebzwuol.exe
Size 365KB
SHA256 741e56b4373d1e5379416035c435469ef822fb8c91eca22b942b9579fcbb30a9
MD5 f9028c40eaf91666afd1b83b323c7ef9
SHA1 b87a1f8cbf219d037b654882f15d49f96b7dfb02
SHA512 119ec4c179cc6d4f64a862761718f0a5d0ed90c22b26740341a6af1752beaa0a4e4630f858383ef4f0d13e1e973659d103ee77eb9f6347a7ae20b8602d7f3ac3
SSDEEP 3072:YuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxmhf.sys

Path C:\Temp\usmkfcxmhf.sys
Size 293KB
SHA256 0430986540efa438623ec8cbfd032cb183573a4c2520fd5f4bee9ee4240c9cda
MD5 37b9111112b9ca30935117210257cb1d
SHA1 c6c8e3d3991df82a651c22176db4162a6361b972
SHA512 2ccc740ec08c9f21e48650d3a013139a95d6e5f05c42c0684c652748df994ce7e9e807d16a3e97beee51525752ee4abba032e041ae87d594f1b4ec7409d8e078
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupkhfzxsm.exe

Path C:\Temp\xupkhfzxsm.exe
Size 365KB
SHA256 8ba0d2090f6cc7bea743c3507c02f133c513d4265950f4bf44d0cd19f90e7c9c
MD5 bfcc01b2e22644d0629c9272f6c489fa
SHA1 01ff9f7d6fd6450933103382724db175d3a75db6
SHA512 de549d42ec38a644e1b1258b036b3bef277d4405c336008271746ba3255b8cf14f4e40948ba82def885061b02c48c5a079a62fc9d25550b9cc34f9e1e4a16c2d
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T158847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmjebwuo.sys

Path C:\Temp\zurmjebwuo.sys
Size 293KB
SHA256 6f1b6baf94c5143f1948a01f69ab6054b328171286e828c6f900b659e727e07a
MD5 2cf2d0e8ddd0dce04edb47968513f6bf
SHA1 94b229489463f6990bc8293f9f7b19285b0bbf47
SHA512 a0051ed8be8e753f2c4ae7a3b073eea66041f7874f570b75ebf793cf8d1fe280a5a628993806e1bfb8bce71e18c9838e8539e1c8afe94ce8806dd1d3257587d4
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

4d209873-5e7f-408a-9c40-a331689896a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d209873-5e7f-408a-9c40-a331689896a7.tmp
Size 14KB
SHA256 36f4a1d79da92a12db96b3c27d4f51826962697672a8908f710645d3273a4986
MD5 ec5150fae06f8990787e706f59fd66e8
SHA1 fa8d43c843bdf1235a3e0d92dbd00fc63a791e78
SHA512 e40767d31a86d3a4d06d4a80a30777251c8574fb2074855b5fa94ce69825be9505f69508ef2eb9cc5be50e6c0e8f411d047d2050144018ffd383fed36ef17e5e
SSDEEP 192:sxRpRayM/jK1Ml8wCQ/fFstHQZjBkuNRwzoA8p9k/g6+WNCp3/Yl0ZMiUGhIgDcp:sxRpk8Q/fFstHOjBZNRpu/58/pds
TLSH
T16062F915AA245E77CCDBD20DFA557F53D2F91533A2901E44AAFC9E1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1bd9ad187de895e3abcb40a61b2b8b2bc9e54577bc0ef2f2d0eb888898afa53f
MD5 581135c6e90cd76d09cc0e105fd0d20f
SHA1 ec52a0c536d96e49a207cf2d246fa97763c231b5
SHA512 73b189f0a9ff36c73360aecb5e561af01ab524dbee20d039d13063edddc41d1805208842437c9ed1f828e25ba5ed185454c41c7a41ff88bcfac33b17e06d3dde
TLSH
T11241FB59D32D3DCDC7A997B221E9515932F3CC59AD07AE0582409FB48E02F0760E3723
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c0a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591c0a.TMP
Size 2KB
SHA256 83e10d5f0424cbb72787ea08b34bffff8867a56a36e0a937f00cb68f9572784f
MD5 d0b248a133fbdaf106afdc3327abd4cd
SHA1 93ba0e062309077dfcfca397cc8955897ac38845
SHA512 abf4a43370f05b658a4d5123635b4149e808ecb126685ca69b9754580fa6fcca3023d1c2ee6361e991420ad51958f9b6f71d8f78df260844f543898d9f853f79
TLSH
T12F41DA59D32D3DCDC7A9D7B261E9565932F3CC59A907AE0582509FB48E02F0760E3323
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ee24d83d147806c895fa7cd47b32a60e60a98673357d212f0aa3856a8715234c
MD5 ef508d6d9a61e5cc2538f24e1d373f2d
SHA1 b4d0c11a7e9f6ca4eb3cb293d5635d8973007dca
SHA512 2aa816d5d2667990afbe5b05a15f31793755cc777c906dc5a7274de3ccb7e2b14b7b94a54b695d50141bf97122da0214a76b4e98ee100d3f869208aaacbd3095
TLSH
T1F341CEF787F4856E8A0196F0AA146E1FCE2C0515432C7C5A89E4AE2B93E3472E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1c3d88966f7e86191459fde44a339cf6df6f2906956093e8b2236329ac329664
MD5 5793ed45cdb5174e1f8d380dfebff6d1
SHA1 0c509e57cff598964846a530cc253aa1dfe919c8
SHA512 4a5334d258a297a53182ea92da4f1a38ae50b0cac4defc684586a75ab853a3ba165c192bf42815d4e94b224b974833fa7d44a21bca80d81e91382dc47438d6ad
SSDEEP 192:sxR6RayM/jK1Ml8wCQ/fFsuHQZjBkuNRwzoA8p9k/g6+WNCp3/Yl0ZMiUGhIgVHJ:sxR6k8Q/fFsuHOjBZNRpu/58/pdr
TLSH
T19362F915AA245E77CCDBD20DFA557F53D2F91533A2901E44AAFC9E1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e2bf456c5816850845d18840264ad5959c1b08e524a4dc3603fa1f43aff669bc
MD5 e04c6920b190c75022bcd770e9fb6d7f
SHA1 79a4722df84a64107d9feda90a668bf3ee50e5fb
SHA512 c1f841286ad9fd12028645dec6be3855c9eaefd467f7a0ac3beff29062d1bc72d9e51e9eeb76cdeacb69a640f02b48b769136ee970350518789894315a0ff825
SSDEEP 192:sxRpRayM/jK1Ml8UQM1CQ/fFst0QZjBkuNRwzoA8prk/g6+WNCp3/YlYZYiUGhI7:sxRpkqMkQ/fFst0OjBZNRpI/58/xdy
TLSH
T10562E815AA245E77CCDBE209FA517F53D2F91533A1901E44AAFC9E1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 de81e2c88591dd00d6053e32e2fbe119c7b08d02faca4519d0208ae25f99ee67
MD5 a2b7bbd1924f31970f4bd454f1e196b4
SHA1 24600197739b7116c5790df2fed9a853cc4debd5
SHA512 05c8e264c23dec0290558f6d4f078b884165de65a34989621d9ed1970fa4fe62b38b59274df3fd92164768b9d9e1a258f47cdae9ef6ee6c9f3b2cbce95e37d94
SSDEEP 768:dhRAjj7pLuL7ExWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4mV13fproPaGv:dhRAjVE7ExWgg+fAJu1jaPmVlfCyGv
TLSH
T1C4E2EC3B680CCB7E4F804ADCEC29BE9A6DA802CF56D8CD5447EA481C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e73b1639b26236f589cf213971bcc36d357812a4a8ccffe7de7ac671ca1d983d
MD5 817ecadcf4378d4c78eb9ea410ac66fd
SHA1 ac78dc8fe12161e995387cd028e51e5b5fb01ce0
SHA512 536a60eddad5a408eeb128fac3be67dc5ad6914b42006ae4c82d785a52627284de7d279032abef669af0a89ed01aed83638d75e1bb63b7b2919c1e2c33295c72
SSDEEP 96:KRZ2HDxTnjWXkU1gkeCGEWCPvgsEK4hgmEcEkveEZOzWKw0yKsgK9+1:CZ2HDxTnyXkU1gkeCG7CPYs4hgmrEkvY
TLSH
T1E5910420347A07057C7F660C80BE9A1AC2D2B5F2706DA96F775941D60BABE014FFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b898.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b898.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8d0dca31959f7928b8bfff6e33cd4ac6e303b0bab4bbc49f5d608d97be77433b
MD5 4dc1ea7210d0a39406aaf9eeb6432357
SHA1 54cc81a8ab97eb55126f619721e25213cfa0b1a2
SHA512 cba315713257d8d03b30e1fcd7ce5ce3d11eaca200be235b5416f86f2dcc0cc29c30715c7bba41777d3c035773ef2d7ecab08f39134b2d39730e8944e7704c39
SSDEEP 384:nSiFiZcIY38N28TUNTUlIlzaT6OQEBqkf4cYlTJ7CQPlLJQXmIkdP9IimIMWEfMq:ZFQY3hwg1uocyt5NHXmTWTbc+H5f6F
TLSH
T1051329F198E39537E9AE8B87673D6E069EBCC05375981884BBC95D4CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 08418a6f4d07d12f9ac6c28e27ba09514098f2e3d6f26f619cd592bd78aded08
MD5 dda281846cdbac8e232a5d3f7d10d1f0
SHA1 34adbb5ceede7f5bda82a39aef42a5f7e4cc72f9
SHA512 6c48edd608080d7a356fb046c29d3c6cf9577912c2acb5fd853d75a54e0b3bc955d5483dd2432a08882906a087c25710cce42ed5d1b350ef649685eec64b98cd
SSDEEP 384:nqZcIi38N2qaT6OQQBHzRfY9bYlTJ7CQPlLJQXmIkdP9IimIMWEfMbc+H5fvC3Oe:Ii3OyNiJyt5NHXmTWTbc+H5f6F
TLSH
T145F2BF70ACB5A933ADFADEC8A60B7B16AFF9006395D81988CDDD6B0D018755D031B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c76ae00ca4b784845aba3d170c3b3621da3bc39c6056a767a26f0bef7d23685
MD5 e7e8769f323c159333e052000c18aec6
SHA1 545bde1b699c47acf1b48cd93775d5c00143ceee
SHA512 4ce9a632e3caf87006f8f03832084e56a9d0ca3b4c61b0cdc7a9a8aa6c419683341356a4bf33e159d1b25841ab32553f10edd4733ce1173d81369de6cd3672b6
SSDEEP 768:arv+4UNbdM3sYFiJyQNHXmTWTbc+/1eVH1SvyZ:absb+3T1QeWn1NEH1dZ
TLSH
T19D03C0319CB98F37ADFA8688744BBA577EB8116389C80AC4C8D97F4D428744D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0e0a63b7cc0b579796cfab3167c2b975baa217e5efb9086b3e20870e49c17e42
MD5 29251ac37d00281c8106b99d21493177
SHA1 adb4c96589ae3371d5ed4a31ae825dbfd444d1b8
SHA512 3626a53d8cf4204bc127778b682ece56b82d5de1c4060d9aac4d7e8c29da870cb1317789bd34d77e16dd59fae55984d7b585b519d6bb474c45646e677d82dd04
SSDEEP 768:srv+4UNbdh3NBNiJytTNHXmTWTbc+H5f6zy:sbsbD391t1eWn1Zf6zy
TLSH
T1D403C131ACB99A339DF68EC8B10B7E177FB8105345C80994CDD96B8D018B59E130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5683b05e9f9d90913150a03a334c2faa5e40fd5d0294e02e47f2e0158db11920
MD5 3cc04bb8d59eec33335b3d91d1312773
SHA1 4b98c85290a82087ea3cdafc2ffbafe1a63bf551
SHA512 68a371debbcf59a3cc4e4d4cfcba039f88767a82f62f2469ad42b052d780eb2790ae9538d121f35ca0f404c47a9c3db88fdab35151d3b232b5eeca1886b62da4
SSDEEP 384:n4ZcIi38N2zaT6OQQBHzRfY9bYlTJ7CQPlLJQXmIkdP9IimIMWEfMbc+H5fvC3Oe:Gi3zyNiJyt5NHXmTWTbc+H5f6F
TLSH
T1E7F2BF70ACB5A933ADFADEC8A60A7B16AFF9006395D81988CDDD6B0D018755D031B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2f1e7286de4608d4dda2e37f127ab1816b7f41bdb389b9c6bfd0151472ed13d5
MD5 6c6e0fd697ad87d57d714e0be87d1071
SHA1 72a660c6850e9b68a3b0b34cfb0ca36547e551b5
SHA512 827c54a1dcb3d0b708cff6e973f0567a1cf01f37242733cd53aa8d565fd6399f1a1e265377c22bbf14d1e8b9245babec8f018ac846538d5a2d63a3117c9e68bd
SSDEEP 768:grv+4UNbdM3l0fiJytRNHXmTWTbc+e5eVH1SvyZ:gbsb+3W1tHeWn1qEH1dZ
TLSH
T11D03CF319CB99A37AEF68F88744BBA177FB9115385980A94CDD93B4D028B49D030BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

28979694-b9fe-4037-bda1-c05916469406.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28979694-b9fe-4037-bda1-c05916469406.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5520_960403558\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 bbb13dda30c473ef83de78e106c0c6e74e61712073c84346205e120cd5c9c1c1
MD5 c4f92715e88d356b0342a762b98399bb
SHA1 9b97c7e08d8545a2247a271fc98a0416779b06be
SHA512 8a8580bd31110ce349731a7c80b98c969b63040c9e8038a8b24025a527685a5c2689a9a5d93e27d93cbb62dc1030c7b4abd0f105be9b4e4beb10b69ec244d06f
TLSH
T1A471009366B8C9B3C2DA5BF102835248F2FB2238472330200B515987AB70A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1400-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1444-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1444-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1728-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1752-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2032-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2372-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4080-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4124-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5560-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5728-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5736-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5776-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5780-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6052-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download