systex | 17145b5ac6df9658328d2475e881def19056cd7851ddbfe771ab1394c8f26ce8

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260819-te2pwaxfqa
SHA256 17145b5ac6df9658328d2475e881def19056cd7851ddbfe771ab1394c8f26ce8
MD5 1aa24b374f6374a3b9b8a45ef9011b48
SHA1 8510e1adbef9df28a576555c4c0a44c40296fba9
SHA512 ab21e9ff3673ba3066f1543084a7b3e5358711e52be1d184cfdf2b487122346702b9c788e1ed70de38c272ffafeb500e0d61aeef48216b1952163118ddd529d8
SSDEEP 3072:vjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ryLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2280	kicausnkfdxvpnif.exe
5800	kicausnkfdxvpnif.sys
1088	CreateProcess.exe
5192	nifaxsqkic.exe
1256	CreateProcess.exe
1136	CreateProcess.exe
5100	i_nifaxsqkic.exe
5172	vsnkfcxupm.sys
3188	CreateProcess.exe
3892	mkhfzxvpnh.exe
2912	CreateProcess.exe
1012	CreateProcess.exe
1080	i_mkhfzxvpnh.exe
3596	smkhczxrpk.sys
1568	CreateProcess.exe
568	mjhcwupmhf.exe
4020	CreateProcess.exe
828	CreateProcess.exe
4300	i_mjhcwupmhf.exe
2708	cwuomhezxr.sys
3520	CreateProcess.exe
816	omjecwuomh.exe
5852	CreateProcess.exe
5560	CreateProcess.exe
1564	i_omjecwuomh.exe
1112	rmjecwuomg.sys
3420	CreateProcess.exe
2848	hebwurmjhb.exe
4604	CreateProcess.exe
6064	CreateProcess.exe
5520	i_hebwurmjhb.exe
3052	jdbztrljeb.sys
3596	CreateProcess.exe
2568	geywqojgby.exe
708	CreateProcess.exe
4324	CreateProcess.exe
2828	i_geywqojgby.exe
3328	qoigaywtol.sys
4300	CreateProcess.exe
6132	qljdbvtolg.exe
5656	CreateProcess.exe
2612	CreateProcess.exe
2260	i_qljdbvtolg.exe
1404	lgdyvqoiga.sys
2076	CreateProcess.exe
2960	xvqnlfdyvq.exe
2624	CreateProcess.exe
4440	CreateProcess.exe
5496	i_xvqnlfdyvq.exe
5188	ysqkicavsn.sys
2060	CreateProcess.exe
1284	icaxvpnifd.exe
5964	CreateProcess.exe
3328	CreateProcess.exe
3568	i_icaxvpnifd.exe
3176	snkfcxvpnh.sys
4948	CreateProcess.exe
4612	pnhcaxsqki.exe
3824	CreateProcess.exe
4944	CreateProcess.exe
3828	i_pnhcaxsqki.exe
4692	kecxuspkhf.sys
1972	CreateProcess.exe
4372	hfcxusmkhf.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_618291035\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_618291035\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1177308527\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1177308527\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_201198797\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhcwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxvpnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhcaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztromgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztromgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hebwurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxvpnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhcaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hebwurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhcwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtomgey.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4584	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
728	ipconfig.exe
2180	ipconfig.exe
5172	ipconfig.exe
1188	ipconfig.exe
4512	ipconfig.exe
5664	ipconfig.exe
2816	ipconfig.exe
4568	ipconfig.exe
5576	ipconfig.exe
3376	ipconfig.exe
4620	ipconfig.exe
560	ipconfig.exe
4936	ipconfig.exe
4756	ipconfig.exe
6036	ipconfig.exe
5272	ipconfig.exe
3248	ipconfig.exe
3020	ipconfig.exe
1588	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316287539778382"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8929E353-2E8C-418C-B091-34212CC40460}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe
2280	kicausnkfdxvpnif.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	i_nifaxsqkic.exe
Token: SeDebugPrivilege	1080	i_mkhfzxvpnh.exe
Token: SeDebugPrivilege	4300	i_mjhcwupmhf.exe
Token: SeDebugPrivilege	1564	i_omjecwuomh.exe
Token: SeDebugPrivilege	5520	i_hebwurmjhb.exe
Token: SeDebugPrivilege	2828	i_geywqojgby.exe
Token: SeDebugPrivilege	2260	i_qljdbvtolg.exe
Token: SeDebugPrivilege	5496	i_xvqnlfdyvq.exe
Token: SeDebugPrivilege	3568	i_icaxvpnifd.exe
Token: SeDebugPrivilege	3828	i_pnhcaxsqki.exe
Token: SeDebugPrivilege	1980	i_hfcxusmkhf.exe
Token: SeDebugPrivilege	2896	i_ezxrpjhbzt.exe
Token: SeDebugPrivilege	804	i_hbztromgec.exe
Token: SeDebugPrivilege	1980	i_geywtomgey.exe
Token: SeDebugPrivilege	5860	i_gdbvtolgdy.exe
Token: SeDebugPrivilege	1564	i_nlidbvtqli.exe
Token: SeDebugPrivilege	4900	i_nifaysqkic.exe
Token: SeDebugPrivilege	4788	i_kifaxvsnki.exe
Token: SeDebugPrivilege	2672	i_fzxspkicax.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2280	800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 800 wrote to memory of 3192	800	2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3192 wrote to memory of 4228	3192	iexplore.exe	91
PID 4228 wrote to memory of 5208	4228	msedge.exe	92
PID 4228 wrote to memory of 5688	4228	msedge.exe	93
PID 4228 wrote to memory of 4584	4228	msedge.exe	94
PID 4228 wrote to memory of 5688	4228	msedge.exe	93
PID 4228 wrote to memory of 5688	4228	msedge.exe	93
PID 4228 wrote to memory of 3720	4228	msedge.exe	95
PID 4228 wrote to memory of 3720	4228	msedge.exe	95
PID 4228 wrote to memory of 3536	4228	msedge.exe	98
PID 4228 wrote to memory of 5048	4228	msedge.exe	97
PID 4228 wrote to memory of 3536	4228	msedge.exe	98
PID 4228 wrote to memory of 3536	4228	msedge.exe	98
PID 4228 wrote to memory of 5048	4228	msedge.exe	97
PID 4228 wrote to memory of 5048	4228	msedge.exe	97
PID 4228 wrote to memory of 2872	4228	msedge.exe	99
PID 4228 wrote to memory of 3224	4228	msedge.exe	100
PID 4228 wrote to memory of 2872	4228	msedge.exe	99
PID 4228 wrote to memory of 2872	4228	msedge.exe	99
PID 4228 wrote to memory of 3224	4228	msedge.exe	100
PID 4228 wrote to memory of 3224	4228	msedge.exe	100
PID 4228 wrote to memory of 4456	4228	msedge.exe	101
PID 4228 wrote to memory of 4456	4228	msedge.exe	101
PID 4228 wrote to memory of 2008	4228	msedge.exe	105
PID 4228 wrote to memory of 2008	4228	msedge.exe	105
PID 4228 wrote to memory of 4120	4228	msedge.exe	106
PID 4228 wrote to memory of 4120	4228	msedge.exe	106
PID 4228 wrote to memory of 2676	4228	msedge.exe	108
PID 2280 wrote to memory of 1088	2280	kicausnkfdxvpnif.exe	109
PID 5192 wrote to memory of 1256	5192	nifaxsqkic.exe	112
PID 4228 wrote to memory of 1476	4228	msedge.exe	115
PID 4228 wrote to memory of 1476	4228	msedge.exe	115
PID 4228 wrote to memory of 2816	4228	msedge.exe	116
PID 4228 wrote to memory of 2816	4228	msedge.exe	116
PID 2280 wrote to memory of 1136	2280	kicausnkfdxvpnif.exe	119
PID 2280 wrote to memory of 3188	2280	kicausnkfdxvpnif.exe	123
PID 3892 wrote to memory of 2912	3892	mkhfzxvpnh.exe	125
PID 2280 wrote to memory of 1012	2280	kicausnkfdxvpnif.exe	128
PID 2280 wrote to memory of 1568	2280	kicausnkfdxvpnif.exe	132
PID 568 wrote to memory of 4020	568	mjhcwupmhf.exe	134
PID 2280 wrote to memory of 828	2280	kicausnkfdxvpnif.exe	137
PID 2280 wrote to memory of 3520	2280	kicausnkfdxvpnif.exe	142
PID 816 wrote to memory of 5852	816	omjecwuomh.exe	144
PID 2280 wrote to memory of 5560	2280	kicausnkfdxvpnif.exe	147
PID 4228 wrote to memory of 1628	4228	msedge.exe	149
PID 4228 wrote to memory of 5848	4228	msedge.exe	150
PID 4228 wrote to memory of 5100	4228	msedge.exe	151
PID 2280 wrote to memory of 3420	2280	kicausnkfdxvpnif.exe	154
PID 2848 wrote to memory of 4604	2848	hebwurmjhb.exe	156
PID 2280 wrote to memory of 6064	2280	kicausnkfdxvpnif.exe	159
PID 2280 wrote to memory of 3596	2280	kicausnkfdxvpnif.exe	163
PID 2568 wrote to memory of 708	2568	geywqojgby.exe	165
PID 2280 wrote to memory of 4324	2280	kicausnkfdxvpnif.exe	168
PID 2280 wrote to memory of 4300	2280	kicausnkfdxvpnif.exe	172
PID 6132 wrote to memory of 5656	6132	qljdbvtolg.exe	174
PID 2280 wrote to memory of 2612	2280	kicausnkfdxvpnif.exe	177
PID 2280 wrote to memory of 2076	2280	kicausnkfdxvpnif.exe	181
PID 2960 wrote to memory of 2624	2960	xvqnlfdyvq.exe	183
PID 2280 wrote to memory of 4440	2280	kicausnkfdxvpnif.exe	186
PID 4228 wrote to memory of 5800	4228	msedge.exe	188
PID 4228 wrote to memory of 5800	4228	msedge.exe	188
PID 4228 wrote to memory of 4608	4228	msedge.exe	194
PID 4228 wrote to memory of 4608	4228	msedge.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_1aa24b374f6374a3b9b8a45ef9011b48_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:800
- C:\Temp\kicausnkfdxvpnif.exe
  C:\Temp\kicausnkfdxvpnif.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1088
  - - C:\Temp\nifaxsqkic.exe
      C:\Temp\nifaxsqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\i_nifaxsqkic.exe
      C:\Temp\i_nifaxsqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhfzxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3188
  - - C:\Temp\mkhfzxvpnh.exe
      C:\Temp\mkhfzxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhfzxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1012
  - - C:\Temp\i_mkhfzxvpnh.exe
      C:\Temp\i_mkhfzxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhcwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1568
  - - C:\Temp\mjhcwupmhf.exe
      C:\Temp\mjhcwupmhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhcwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:828
  - - C:\Temp\i_mjhcwupmhf.exe
      C:\Temp\i_mjhcwupmhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\omjecwuomh.exe
      C:\Temp\omjecwuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5560
  - - C:\Temp\i_omjecwuomh.exe
      C:\Temp\i_omjecwuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hebwurmjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\hebwurmjhb.exe
      C:\Temp\hebwurmjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hebwurmjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6064
  - - C:\Temp\i_hebwurmjhb.exe
      C:\Temp\i_hebwurmjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3596
  - - C:\Temp\geywqojgby.exe
      C:\Temp\geywqojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\i_geywqojgby.exe
      C:\Temp\i_geywqojgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4300
  - - C:\Temp\qljdbvtolg.exe
      C:\Temp\qljdbvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2612
  - - C:\Temp\i_qljdbvtolg.exe
      C:\Temp\i_qljdbvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2076
  - - C:\Temp\xvqnlfdyvq.exe
      C:\Temp\xvqnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4440
  - - C:\Temp\i_xvqnlfdyvq.exe
      C:\Temp\i_xvqnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxvpnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2060
  - - C:\Temp\icaxvpnifd.exe
      C:\Temp\icaxvpnifd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxvpnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\i_icaxvpnifd.exe
      C:\Temp\i_icaxvpnifd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhcaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\pnhcaxsqki.exe
      C:\Temp\pnhcaxsqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhcaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\i_pnhcaxsqki.exe
      C:\Temp\i_pnhcaxsqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxusmkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1972
  - - C:\Temp\hfcxusmkhf.exe
      C:\Temp\hfcxusmkhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxusmkhf.exe ups_ins
    3⤵
    PID:5116
  - - C:\Temp\i_hfcxusmkhf.exe
      C:\Temp\i_hfcxusmkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxrpjhbzt.exe ups_run
    3⤵
    PID:912
  - - C:\Temp\ezxrpjhbzt.exe
      C:\Temp\ezxrpjhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhbzt.exe ups_ins
    3⤵
    PID:3048
  - - C:\Temp\i_ezxrpjhbzt.exe
      C:\Temp\i_ezxrpjhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztromgec.exe ups_run
    3⤵
    PID:264
  - - C:\Temp\hbztromgec.exe
      C:\Temp\hbztromgec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztromgec.exe ups_ins
    3⤵
    PID:5864
  - - C:\Temp\i_hbztromgec.exe
      C:\Temp\i_hbztromgec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywtomgey.exe ups_run
    3⤵
    PID:248
  - - C:\Temp\geywtomgey.exe
      C:\Temp\geywtomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywtomgey.exe ups_ins
    3⤵
    PID:2064
  - - C:\Temp\i_geywtomgey.exe
      C:\Temp\i_geywtomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtolgdy.exe ups_run
    3⤵
    PID:3176
  - - C:\Temp\gdbvtolgdy.exe
      C:\Temp\gdbvtolgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtolgdy.exe ups_ins
    3⤵
    PID:3476
  - - C:\Temp\i_gdbvtolgdy.exe
      C:\Temp\i_gdbvtolgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbvtqli.exe ups_run
    3⤵
    PID:2260
  - - C:\Temp\nlidbvtqli.exe
      C:\Temp\nlidbvtqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidbvtqli.exe ups_ins
    3⤵
    PID:1388
  - - C:\Temp\i_nlidbvtqli.exe
      C:\Temp\i_nlidbvtqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run
    3⤵
    PID:1128
  - - C:\Temp\nifaysqkic.exe
      C:\Temp\nifaysqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    PID:3748
  - - C:\Temp\i_nifaysqkic.exe
      C:\Temp\i_nifaysqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvsnki.exe ups_run
    3⤵
    PID:1620
  - - C:\Temp\kifaxvsnki.exe
      C:\Temp\kifaxvsnki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvsnki.exe ups_ins
    3⤵
    PID:1300
  - - C:\Temp\i_kifaxvsnki.exe
      C:\Temp\i_kifaxvsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkicax.exe ups_run
    3⤵
    PID:5172
  - - C:\Temp\fzxspkicax.exe
      C:\Temp\fzxspkicax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkicax.exe ups_ins
    3⤵
    PID:1176
  - - C:\Temp\i_fzxspkicax.exe
      C:\Temp\i_fzxspkicax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2672
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa7789c188,0x7ffa7789c194,0x7ffa7789c1a0
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,12482424138036848901,3052886375852843313,262144 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,12832817324222579705,10065148476419485957,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
      4⤵
      System Time Discovery
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,7780368952696073255,10053818122460468215,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:13
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,6137946925553948401,6456979038064894683,2097152 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,330378884370128975,6565149661002608140,2097152 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,10982476363995401077,15842824537825314232,2097152 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12828314250944319677,15609964698305845542,2097152 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,753315161460804208,14849136331922476777,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,16234224520882625870,11430882392328926606,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,11650647072206445600,2126611707706897396,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17863977613686963270,12233151633697543123,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17863977613686963270,12233151633697543123,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,12356679941565839335,1556167889569920000,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,441185179088365713,14240765440605308557,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,6045112898917996041,7927386443939954325,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,13800264086411121880,14520691865152703382,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,13480345962930800978,15493720726990256087,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,2160567587935669930,5303548772178468621,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,4275450097114034925,11249258549811183533,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,3188186439096689378,626705430686278199,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,18325103894090739680,16579171368619504936,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5004,i,12911074966474625346,7519917709447507903,262144 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:10
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17446340688428821512,9048679810716217867,524288 --field-trial-handle=2684,i,16219911333964148976,8779185797529403529,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

C:\Temp\kicausnkfdxvpnif.sys
C:\Temp\kicausnkfdxvpnif.sys
1⤵
- Executes dropped EXE
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5456

C:\Temp\vsnkfcxupm.sys
C:\Temp\vsnkfcxupm.sys
1⤵
- Executes dropped EXE
PID:5172

C:\Temp\smkhczxrpk.sys
C:\Temp\smkhczxrpk.sys
1⤵
- Executes dropped EXE
PID:3596

C:\Temp\cwuomhezxr.sys
C:\Temp\cwuomhezxr.sys
1⤵
- Executes dropped EXE
PID:2708

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\jdbztrljeb.sys
C:\Temp\jdbztrljeb.sys
1⤵
- Executes dropped EXE
PID:3052

C:\Temp\qoigaywtol.sys
C:\Temp\qoigaywtol.sys
1⤵
- Executes dropped EXE
PID:3328

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
- Executes dropped EXE
PID:5188

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:3176

C:\Temp\kecxuspkhf.sys
C:\Temp\kecxuspkhf.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
PID:6036

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
PID:680

C:\Temp\eywqoljhby.sys
C:\Temp\eywqoljhby.sys
1⤵
PID:1112

C:\Temp\lgeywqojgb.sys
C:\Temp\lgeywqojgb.sys
1⤵
PID:1500

C:\Temp\geyvqnlgdy.sys
C:\Temp\geyvqnlgdy.sys
1⤵
PID:2876

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
PID:2364

C:\Temp\nifaxspnki.sys
C:\Temp\nifaxspnki.sys
1⤵
PID:5100

C:\Temp\hfzxupnhfz.sys
C:\Temp\hfzxupnhfz.sys
1⤵
PID:1628

C:\Temp\hfzxspkhcz.sys
C:\Temp\hfzxspkhcz.sys
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwuomhezxr.sys

Path C:\Temp\cwuomhezxr.sys
Size 293KB
SHA256 7c5fd45424710fde0d258a363c22004e821eb54c14f02970274ed6d3613b1df8
MD5 54d4e1fe11a8ebd5a4ea4dbe3725abe7
SHA1 ac4a1ad3b514830108068f71f6e286f3ed4b217f
SHA512 f32fc311860cc83c6a5009d633ef120f73ea3895cf4676a3d0b3865cb92eb54b70a94560c4828329c250ca4b7001242224b50683bac19f9619b8e7421fbc993c
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgby.exe

Path C:\Temp\geywqojgby.exe
Size 376KB
SHA256 2b33d1f637ffc816e1c777e47c784c8e4f9f494c4bc64a7545a6b13cfacd3e7f
MD5 e2dae80347d29b9a65481273f00ad8c1
SHA1 0c807db4fe126e4733159ce394ce21acb6c1b850
SHA512 6e3a8f42bfb52ef1f550785a4f0fa12e2bef88bf0df2b3f935abcd25cae103e2c703d0479f094d955cfde307b2561185b593bf7aa30cc58a43c5ef4b574e13f7
SSDEEP 3072:bjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T136847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hebwurmjhb.exe

Path C:\Temp\hebwurmjhb.exe
Size 376KB
SHA256 fe566755bddd1dc2641d9808b98c10e40dde17a870f82f0d59cefde40a51f455
MD5 eb40eda83a43321b9524fef30c5eaf6a
SHA1 cf2a45b2c07b290629d57b237d01ffbfadc99ef5
SHA512 692c4bdd2fc1ca0f0e088b649b1cfa43d1c2868fcaf43e0ba98b1f1d0cf17a5b2c017ab682357ae4bc119aa0a1b3d8577be949e42dc3e21cce61ea3f8d7da921
SSDEEP 3072:cjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FA847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hebwurmjhb.exe

Path C:\Temp\i_hebwurmjhb.exe
Size 376KB
SHA256 cd0f885e860d2a3d543db26369774cda2e7c6cb01a0fe916c0a9776733d3d124
MD5 68e4bd455b81e167343aa329d6f40bae
SHA1 0f1bf1168420a161ea7f4d5ea33cb9b50f8bb64c
SHA512 baee3594e09cf27176cf8d7425e873fe6c8348178b4c67918e5726351437e57ac7391053606d8204f0ea5a73daac0f821b4f5fdef0e93fef15cc7a85edc4489b
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CF847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhcwupmhf.exe

Path C:\Temp\i_mjhcwupmhf.exe
Size 376KB
SHA256 ffacba96d2d9c67b72e757a8b67986eb6746b3dd940fc13a09805c8b28135243
MD5 bc04881f4aba231360100ca5a10208ae
SHA1 dd67977cf45fb221d92c934d2d4fc9910c55a9cb
SHA512 d48877d1b843c3ddd363d9f3f9faeac8d117548e0cc2d0048d54b5d30f361d0bbc5f708f002832aac520949147daa9690e33ecf0c01e67484d764258c48e10f0
SSDEEP 3072:BjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ByLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhfzxvpnh.exe

Path C:\Temp\i_mkhfzxvpnh.exe
Size 376KB
SHA256 88309545283328e033b575055c8422021f3b9ed6849c8a64a1685a671cbaa428
MD5 d2cbdcc800f409974343d9c37b881aa0
SHA1 a56d7b93dfa0b56af98ed148cf5ff4e05a09af2c
SHA512 2266080ce07f45f0b2ccb40187d55014b2127d0d90102d8fcb24e4ed0c7e93b526f5ce701c178be97e2fcce90034ef164f2c56f234d6a01cacc1f66cf769cc0b
SSDEEP 3072:zjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaxsqkic.exe

Path C:\Temp\i_nifaxsqkic.exe
Size 376KB
SHA256 d0c6bb7aaf53537bf5bf9f1d021cfa64cd87b556b6fae1eece3cb759463bf7c1
MD5 ad8dc36a106fc7c46bcfa501c77da1db
SHA1 8264f2389224cd752e8293bd05bc0efd1a601814
SHA512 d94a2ba9ec883188e685bac83cb4facd8a71b47ba4c1845507126ea2e3e4ca76e6220e84ac3119c6a3a35f7ca24f8e42a4908e9b638cebbc7a8c6e302c4e7b43
SSDEEP 3072:cjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T145847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjecwuomh.exe

Path C:\Temp\i_omjecwuomh.exe
Size 376KB
SHA256 1ccafe0899bcab63e1356de6f943d4dda542be6a7689231cbe1bd505e83b1c4f
MD5 d636dee7f00df9daad45ce09c6772acd
SHA1 73685c4133dd2544b78d40a103b0a1537458b0cb
SHA512 d346d910491cc753ea587c012823ece331b93cbdadccb7a47a015a9f377da7ff4f42e704a8977221b158d46e1a735c907bf30c354943b04bf2f689adc320502a
SSDEEP 3072:ijyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbztrljeb.sys

Path C:\Temp\jdbztrljeb.sys
Size 293KB
SHA256 ad0b59bfcb1349003a1e3c1b46599a14a7c837ea508bf69b2ca2edffc65150b7
MD5 05dfe50bdb7e248f5f9a0899690c499c
SHA1 f7a5ed1ae51a601ca56326123b656d7f4c95bcf5
SHA512 0d46fe699eb21fc67d24a4cf4dc9d6a2579ed24763f980448443233fcc4d647ff2b7d8a0f69d1139789c55a3c23060d21d48a7ce0b419ca7b943f357cfab3212
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfdxvpnif.exe

Path C:\Temp\kicausnkfdxvpnif.exe
Size 376KB
SHA256 7ed278fdda4b996f0fa8f7346d58a8461281a15114e422114024a8c31d985d53
MD5 d76d749b2404a4fca9693ab174583385
SHA1 7f219f64151b52313d3a82d5ccdab2c6c7a631bb
SHA512 15c020ceb4c1dd1d311462b4362cf442d593696c79208412d943c9c589ad4836ed9c0e721509c6fb9ca0aa670bfe98a98d853002d7bcc633bad4189c65ac5b3e
SSDEEP 3072:+jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfdxvpnif.sys

Path C:\Temp\kicausnkfdxvpnif.sys
Size 293KB
SHA256 9ffd5fea49b1100c22343e57cbb7316e0ccd09ebd947333bc9400e68d14482fd
MD5 40ab39e010dae34b535062e7074c1632
SHA1 52036f5a219e1f8758f201aae1fead9f927a400f
SHA512 a7085d721f3cdc655f467ad7ba224ef9fdbd8237e07433199a774d19257e363b0bb5e46dbbdf354da8efe9730f5d3a2be3e2e2e5d4bc44b08c21adf87f392567
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhcwupmhf.exe

Path C:\Temp\mjhcwupmhf.exe
Size 376KB
SHA256 a2aa299aacc734c062f15b4691132c042e1b7e44c164eb3e14dc7e6275317d77
MD5 3b917154010d7088ea8d663eafe22f44
SHA1 4887218007d6a04bf0cbf89e4dded4a551f1f41f
SHA512 65d28465744250fa5cddc21e833eb9e6622bddd12b25d00b2f39f17bf476128f0f8dfe118b3d9e24a84c867e949c55abfe6b6490a59b549406ab72349482dd60
SSDEEP 3072:GjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhfzxvpnh.exe

Path C:\Temp\mkhfzxvpnh.exe
Size 376KB
SHA256 2980d0d15c793fc755c11aa54e16db5ed01ec073b68a45f8c98778d662cae84c
MD5 2da227a15c439a2115d25f07670bd1f0
SHA1 7f6311b57a995dcdf3130603bcb4fc8792f078d3
SHA512 fcd623894b9ec389186a20807638e9c44f3dd3b76292a7d51058a98e0bf1fa92fe85c303c4cca1a5f60100da7dd9cd4f32571460965cefafbbdbf53685ea9e5e
SSDEEP 3072:xjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxsqkic.exe

Path C:\Temp\nifaxsqkic.exe
Size 376KB
SHA256 6617b043f3b37e22c35df55299f740269bbb29f6beac0f0d961bc0ad7967d810
MD5 fba8fd7964abdfa49088761829a5ae4c
SHA1 046a210facf495adfff3b022ccdebd3a79b46028
SHA512 3c29c04eaada7c82877dd905f0797194e8423c50769a95d44dd415adad9bd734f1b996c905985505032f9eeeb86dfabd5471579f74d23d47221ec9e8e307930d
SSDEEP 3072:UjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjecwuomh.exe

Path C:\Temp\omjecwuomh.exe
Size 376KB
SHA256 4fa5c766e22783d0f5833506ad5042719da306f818c7c73d56c2a27baf2e9496
MD5 c7c5125cfdb88b9dc5d49608a173bd59
SHA1 8aca0704ccaa4cc038cca1a07a7f1f939686fdd9
SHA512 9133b2fb8e7389b130d10082a33b32e54015bb1a10933791cb4c457d673228bb2ef7ac9e25071766f6efe4f9ea3cf3dbd1a302777ff94eebf94e9d32c37ba4ec
SSDEEP 3072:5jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomg.sys

Path C:\Temp\rmjecwuomg.sys
Size 293KB
SHA256 a9c8a97bc79462c3ceb1b8c4182e55557fdb82db246149cd54dab51c99eb14bb
MD5 c585fe4e79c0f43efa477f859c8a0644
SHA1 5f5e513b38fbdf393d77de2201b83fae409bf93c
SHA512 15ed3b5866fd99839f505c88cdcc1d1f41d314b3c79c445286d6268892d2c287b0ed89a6a7e4e335c64f0063c62e7534bf3668a46631e42bbd7875f6646dfc8f
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhczxrpk.sys

Path C:\Temp\smkhczxrpk.sys
Size 293KB
SHA256 c53de7018a0adc03d8db7386b86096411dc03bfdb2b9a0b6e681b57125163922
MD5 c0a4da56b333064f57e6a5ab505ae5fa
SHA1 b5a96c08c770edb2fb1073c326b6f85bac086cbb
SHA512 2793f39309a53aa5d0d17520a443a6d622fb9ce58a42ae7a04bbbf303852242dadb5d6cda1529e5dda43ff2d15a60101461c3b49f6fa4a486904aaa1856a4b6b
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfcxupm.sys

Path C:\Temp\vsnkfcxupm.sys
Size 293KB
SHA256 cdfaa5f429196a00cdb2569a0fb0826d8d336ff7d0c3f1f36a875c4985e0adae
MD5 8ed4fe9154938c30d99129926d29ff68
SHA1 0a2782523f78ae89906b6df751d12debaa4b3b57
SHA512 f2632759a5642996c2bb006e3580a5bb88ba93060f47d55b8a39b8a30d30b12ceb35c9b7bc11b04949e589794a92572d33a204a36bf37bef5d96fa914a6bbf52
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d2dfbb9af9d4bf47e79dbdfea194a66f9e88144f5d87b84c29fbfbedeee741c1
MD5 f575314464831f4d7783f2f827b95c55
SHA1 5c3f78bbf7d85eb7e0ab1307933c18258fbf7a22
SHA512 d49df7816140b4b9b3c023b3a76a824c8ef8df1783c1702735c7deb511a4daf6aa4f5911bf5a1c30a984b60bc505329b2c3dd316b7816187174c2786dbc30216
TLSH
T1D561415963210EE3EBE5C9F196E0B48831F78C61454BAB3A4293ADF068AAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591f94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591f94.TMP
Size 3KB
SHA256 56e67fb972f2fd742b0f80afeb917c4e85325cd3921b4f5bf1ccf356ffcdf361
MD5 3f8f88f791d7a4c5ad8c7e00eb3d7135
SHA1 319aaae50e9cc61910a80d77f977d105cc7c975a
SHA512 9fc4e9cb17f30df1518b50fcc335885a2353379dad0e5bc816636c1a8573986af53d53792226a31114ac2dddc6cdc9338991f2aa66f15737141a7856816e1970
TLSH
T17761535963210BE3DBE5C5F196E0B44831F78C60450BAB3A4293ADF06CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bb020cc000e85ac980bb890152c4181cdf45edb093a3b1aa0b63885b4ac2e9d4
MD5 0ed2daf72e4b6db15840b998281cf0ae
SHA1 041145aedaa173e5abc681e74dcddeda4c509196
SHA512 a3d94aa208dd72cccbfa69e8880e0d15abc49576cd8b275a4adb7010eae7e6ed294c73004914f7c89888e78dc3ea67fc60048779c9bb43a46b6b78fc662abd87
TLSH
T17F418DF783F4856E891156F4AB14AE1BCE2C0911832C7D5A89E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6c3b2a07b052f7d416cd0ef6aa62e86e6c97a1ce0b4f385e8364e8ff2c5db2e1
MD5 287059d1636e89cf6e7e2848bdc73bd5
SHA1 26492a72700f54fa84e71c08d0000582ce7e1368
SHA512 42f475d4f2b9b403431778850e9b5669a64648e69d5b33d414aac2c1edb3b85c11487f17e80fa41e904734582a881bd4fa82a1c5fa7219acd5790fca27695eda
SSDEEP 192:sxRXRUCh/fRsVCyprQ57zoA8p97/g6+WNCL1Xe/YnoeUGh9tGJIgVvJ:sxRX1h/fRs8y7p/5d/WNQ3
TLSH
T14B42B8166E68A93B4CC7E21DFA55BF53D7F91032A1D45F48AAFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f64ab59971f7755b1101e9e61650536aadae0e0da4c014a64e16f189e129c759
MD5 5803828eac5a707c63f4ec628f0e510f
SHA1 42839b0726eb8a79dfe330dad3e909563f335405
SHA512 529b93716d0002869237231b7ebe7fba3b958f1b77ae3d70d2923cd755934f3c1b2aa28fd3210ac6da19e3aa981009dec892d5e63e4b249599620fcace0be65d
SSDEEP 192:sxRERUCh/fRsnCyprQ57zoA8p97/g6+WNCL1Xe/YnoeUGh9tGJIgD/vJ:sxRE1h/fRsCy7p/5d/WNQ1
TLSH
T1C642C7166E68A93B4CC7E21DFA55BF53D7F91032A1D45F48AAFC8A0C04E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16b27068e50bbb771c21efb77969390f0c6cc2444daa54c76a9e01ce8e0e240e
MD5 15b6b2ccbb0682a25300783ad4e6be26
SHA1 8b2f9e5a642abebc14ac5f65416aef589c97f56d
SHA512 7d4205868748804af9b27f7691662e28edf73755bce97bc6eb84b693c0323786faae8f8fa378f20588900e546a91f5265e54dfa74bd577d55c590a00b97496f2
SSDEEP 192:sxRERUCh/fRsnCElZDbzoA8p97/g6+WNCL1Xe/YnoeRKch9tGJIgDNvJ:sxRE1h/fRsCELD6p/5d/WFQL
TLSH
T13C42D756AD68A93B9CC7E21DFA55BF53D7F91032A0951F48EAFC860C14E76CD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f078b450936ff5ef91c362cff401be846a4287b49a2e894dfcac0938b93ccff3
MD5 6e7d2fb4bb0d313fcac4610f8ea29b85
SHA1 015727c762505a75053c55fbea0cc846405de2c4
SHA512 ca798683c9d41f581d1424a8236555885790aeeda2bf7325897b2e75dd0a78282a40e91a3d4da39d160e03a507516821a7eef58ae8615a5ddd4223215ec61cbb
SSDEEP 768:wb8dXg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6bmu46irohWy5i:wb8dXsE7r6Wgouf6Mu1jaZbmV65NQ
TLSH
T1D0D2DB7B640DCB7E4F800ADDEC19BE9F6DA802CB96D8C94447FE951C02C6BEA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59bbc4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59bbc4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 68059d9a6daaf177f7515acfb8dfca334b5c3ab40e10ef02f672043844e22d9a
MD5 43779205ddf77ba7d3f1190c25c32e88
SHA1 ff77b9800cb599e9201a7266d6cef81bbcea7d90
SHA512 cb6187418d914d6c010256111eca868de370a6246991f47cea06b1c7ed9011a67f4df7e94ee1e5ca12e547e333a758ee6787d127688bd9b6989745501d28fcd5
SSDEEP 384:nliFiZcIZ38N/8TUNTUlIl7LkroM2Z/fQxXOVSUUHXCDOHJETRzcoXfK86sfxEZN:sFQZ3swgg+Zw5O033KNzc4ReyIsPEfEs
TLSH
T1611306F598D78936E8AE5783A73D6D42ADFCD067B1885984B7D84E0CCC461BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f885be049eb73a87c586a63a307bab4aacc1ba91cd25abd39af96a0963d1579f
MD5 dc4b9c05c163e62bf88105967e3bdb98
SHA1 507c48ae84d3a846a3706a07c5d0d81b74811e8d
SHA512 162ad984ed6a297500217eb43dadc598ad0b9619af33b51df0f13a79f381d3b971df1bbefaf0eea327394687ac532a6c132ba2bee8ed9a5c72e4fc3d7cbd0702
SSDEEP 384:nnZcIS38NluLz5o2JDZNfNoXOVSUUHXCDOH8ETRzcoXfK86sfxEZxxsIj4lBEfvR:PS3J/DZIO033rNzc4ReyIsPEfEs
TLSH
T1AFF2BF30AC65DC636CEAE285F60636937EF4612B81C85E88D5ED9F0C09476DD1B1F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 662496ab01de69aad8358cd07a5857da706c1f44feec0c8500f0010e475e8a77
MD5 3346b93bcb7c438267e46b3a94fb4016
SHA1 6edd8509ed7524cdaa21bb607ccc82801b7b92f6
SHA512 f96513b0b8effd936da3ca269c24407d0ee6f5f0e0ebe3d0049242b1d8b2d24a0568e978608638dcfe2887a40bf78fa22a276f82f6661adfe0b7353fca09b96a
SSDEEP 768:6rv+4UNbds37HDZIO03SNzc4ReyIsXYeVH1S5D:6bsbS3ttc44bsIEH1Y
TLSH
T1CD03CE32A868D937ACE66686B50776533EF8512B82C81ED4C9DE6F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 560958dfdd4759233993d417ca4397aede749ae65c56a0c5fa0670bd110eff0e
MD5 d7e75e2d7ba6a1551abc20bda1f9bc67
SHA1 a6dc6e36c75ea31feab38b327791321c4c8eb287
SHA512 e7a3f7316f1b8c6e20675ce58fba3e70a5c37d0aa82ac1bacd3bc11ef5fed92d2f0feb2b14914a2fa5ddc9d9d86838cab8ae9a1241af7c68f46900fa70024e4b
SSDEEP 768:Lrv+4UNbds31VDZIO033aNzc4ReyIs2EeVH1S5D:LbsbS3Rtc44bsbEH1Y
TLSH
T18703CF32A878CD33ACEAA686B54776933EF8216B81C40F94C9E95F4C0A471DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f988f792389dca9bea96e77ef77af0a0dc38c516531e5af49cff636b75d4cfa1
MD5 4791a5ebfad7ef160fc9312e5e144ced
SHA1 71525c02b61757732b08ed00a5b387fe9a1053da
SHA512 517061c18d4cfe999b903db19b1b8edcf6e429223fa0afd46b1976ed783ffcd428a7ca8e3f6cc5d824939f368cc4b4c6d2a7b7992abc57dd2679f87f5a8c1e78
SSDEEP 384:nBZcIS38Nl7Lk5o2JDZNfNoXOVSUUHXCDOH8ETRzcoXfK86sfxEZxxsIj4lBEfvR:JS3x/DZIO033rNzc4ReyIsPEfEs
TLSH
T176F2BF30AC69DC636CEAE285F60636937EF4602B81C81E98D5ED9F0C09476DD1B1F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

a360c144-ae56-4e43-a0da-a501e91bbf4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a360c144-ae56-4e43-a0da-a501e91bbf4b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4228_792373359\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 4a77e8571385a7f15d119ee9fff3d32379775acd6dd28f33ad7cc89827874444
MD5 fe79c50f9c9e1033b77be4a3fb7c15eb
SHA1 1d5d788ae07583a93f87c1be29388bbdfec3136f
SHA512 d445711091e98364095dbe824336579113a1aa29d49c5e039acd188ec4cc9a35372dd0303b786dc944f275bfb17c1f23d7bf974259d20a9c2068dfee7157bd72
TLSH
T16471009356A9CAB2C2DA5FF103835604F1BB223C072330200BA555C7AB34A3A58B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/680-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1112-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1112-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1628-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2364-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2708-255-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3052-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3596-227-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4692-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5172-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5188-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5800-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download