systex | 7204f020263f6e12adb91015a769cb305c91407007ebf2dbefd56f63f3970aee

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260820-b44xesdk3y
SHA256 7204f020263f6e12adb91015a769cb305c91407007ebf2dbefd56f63f3970aee
MD5 6bd68de9614d27d4ccfa1f4c93ba2f7e
SHA1 a4095da94f33f6275f3a9a7310c44608f1742468
SHA512 367f7e43eaf1b897901f5b91a9cfe67c97be11c0fa6dbee99603efd56805744357f8660bcdd199fe0a88cf510d233ae2d9ca4ae2321dfffc07f42b51c13c894f
SSDEEP 3072:pFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1228	bytqoigeywtgdbyt.exe
1464	CreateProcess.exe
5964	bytqoigeywtgdbyt.sys
5612	gaytqlidbv.exe
4844	CreateProcess.exe
1928	CreateProcess.exe
4656	i_gaytqlidbv.exe
4168	tqljdbvtnl.sys
5012	CreateProcess.exe
1960	lidbytqlig.exe
2856	CreateProcess.exe
4668	CreateProcess.exe
1356	i_lidbytqlig.exe
2728	ysqkidavsn.sys
5604	CreateProcess.exe
5328	snifaysqki.exe
4712	CreateProcess.exe
6108	CreateProcess.exe
2104	i_snifaysqki.exe
5828	kicausmkfc.sys
628	CreateProcess.exe
3068	hfdxusmkic.exe
4196	CreateProcess.exe
4336	CreateProcess.exe
3316	i_hfdxusmkic.exe
5008	kicaxspkic.sys
1360	CreateProcess.exe
3700	xupnhfzxup.exe
4740	CreateProcess.exe
2728	CreateProcess.exe
5492	i_xupnhfzxup.exe
6004	xusmkecxup.sys
2460	CreateProcess.exe
3492	usmkhfzxrp.exe
5416	CreateProcess.exe
1892	CreateProcess.exe
2060	i_usmkhfzxrp.exe
2172	wuomkeczxu.sys
6080	CreateProcess.exe
2736	zwurmjebzt.exe
6048	CreateProcess.exe
2156	CreateProcess.exe
4796	i_zwurmjebzt.exe
3932	ljhbztrljd.sys
4328	CreateProcess.exe
4804	ojgbztrljd.exe
1060	CreateProcess.exe
3316	CreateProcess.exe
5016	i_ojgbztrljd.exe
5864	wtrojhbytq.sys
5856	CreateProcess.exe
712	bytqoigbyt.exe
3056	CreateProcess.exe
4944	CreateProcess.exe
4868	i_bytqoigbyt.exe
784	igeytqljgb.sys
5084	CreateProcess.exe
2396	gdywqolgdb.exe
2212	CreateProcess.exe
1220	CreateProcess.exe
3352	i_gdywqolgdb.exe
1456	xvqnlfdays.sys
2912	CreateProcess.exe
3160	vtnifayvqn.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxusmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnifayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkiczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqoigeywtgdbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxusmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnifayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkiczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snifaysqki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1916	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2000	ipconfig.exe
3868	ipconfig.exe
3948	ipconfig.exe
4124	ipconfig.exe
3224	ipconfig.exe
2876	ipconfig.exe
4472	ipconfig.exe
1604	ipconfig.exe
5924	ipconfig.exe
1524	ipconfig.exe
1600	ipconfig.exe
4988	ipconfig.exe
4480	ipconfig.exe
4812	ipconfig.exe
2028	ipconfig.exe
1580	ipconfig.exe
5352	ipconfig.exe
5384	ipconfig.exe
3388	ipconfig.exe
6084	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316637796289455"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{EEE9D240-6616-4DE3-A950-286EF3552E18}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe
1228	bytqoigeywtgdbyt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	i_gaytqlidbv.exe
Token: SeDebugPrivilege	1356	i_lidbytqlig.exe
Token: SeDebugPrivilege	2104	i_snifaysqki.exe
Token: SeDebugPrivilege	3316	i_hfdxusmkic.exe
Token: SeDebugPrivilege	5492	i_xupnhfzxup.exe
Token: SeDebugPrivilege	2060	i_usmkhfzxrp.exe
Token: SeDebugPrivilege	4796	i_zwurmjebzt.exe
Token: SeDebugPrivilege	5016	i_ojgbztrljd.exe
Token: SeDebugPrivilege	4868	i_bytqoigbyt.exe
Token: SeDebugPrivilege	3352	i_gdywqolgdb.exe
Token: SeDebugPrivilege	1972	i_vtnifayvqn.exe
Token: SeDebugPrivilege	5020	i_axsqnifays.exe
Token: SeDebugPrivilege	2916	i_spkiczxrpk.exe
Token: SeDebugPrivilege	4356	i_wupmkecxup.exe
Token: SeDebugPrivilege	3368	i_czurpjhezw.exe
Token: SeDebugPrivilege	1512	i_bzwuomgeyw.exe
Token: SeDebugPrivilege	3172	i_ywqojgbztr.exe
Token: SeDebugPrivilege	4760	i_jgbywqolgd.exe
Token: SeDebugPrivilege	916	i_fdyvqoigdy.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1228	1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1080 wrote to memory of 4136	1080	2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4136 wrote to memory of 124	4136	iexplore.exe	91
PID 124 wrote to memory of 4880	124	msedge.exe	92
PID 124 wrote to memory of 3320	124	msedge.exe	94
PID 124 wrote to memory of 1916	124	msedge.exe	93
PID 124 wrote to memory of 3320	124	msedge.exe	94
PID 124 wrote to memory of 3320	124	msedge.exe	94
PID 124 wrote to memory of 5496	124	msedge.exe	95
PID 124 wrote to memory of 5496	124	msedge.exe	95
PID 124 wrote to memory of 5036	124	msedge.exe	97
PID 124 wrote to memory of 4660	124	msedge.exe	98
PID 124 wrote to memory of 5036	124	msedge.exe	97
PID 124 wrote to memory of 5036	124	msedge.exe	97
PID 124 wrote to memory of 4660	124	msedge.exe	98
PID 124 wrote to memory of 4660	124	msedge.exe	98
PID 124 wrote to memory of 3948	124	msedge.exe	99
PID 124 wrote to memory of 3948	124	msedge.exe	99
PID 124 wrote to memory of 3948	124	msedge.exe	99
PID 124 wrote to memory of 4956	124	msedge.exe	100
PID 124 wrote to memory of 4956	124	msedge.exe	100
PID 124 wrote to memory of 4956	124	msedge.exe	100
PID 124 wrote to memory of 5336	124	msedge.exe	101
PID 124 wrote to memory of 5336	124	msedge.exe	101
PID 124 wrote to memory of 1256	124	msedge.exe	103
PID 124 wrote to memory of 4676	124	msedge.exe	104
PID 124 wrote to memory of 1256	124	msedge.exe	103
PID 124 wrote to memory of 4676	124	msedge.exe	104
PID 1228 wrote to memory of 1464	1228	bytqoigeywtgdbyt.exe	106
PID 5612 wrote to memory of 4844	5612	gaytqlidbv.exe	110
PID 124 wrote to memory of 2708	124	msedge.exe	114
PID 124 wrote to memory of 916	124	msedge.exe	115
PID 124 wrote to memory of 916	124	msedge.exe	115
PID 124 wrote to memory of 4640	124	msedge.exe	118
PID 124 wrote to memory of 4640	124	msedge.exe	118
PID 1228 wrote to memory of 1928	1228	bytqoigeywtgdbyt.exe	119
PID 1228 wrote to memory of 5012	1228	bytqoigeywtgdbyt.exe	123
PID 1960 wrote to memory of 2856	1960	lidbytqlig.exe	125
PID 1228 wrote to memory of 4668	1228	bytqoigeywtgdbyt.exe	128
PID 1228 wrote to memory of 5604	1228	bytqoigeywtgdbyt.exe	132
PID 5328 wrote to memory of 4712	5328	snifaysqki.exe	134
PID 1228 wrote to memory of 6108	1228	bytqoigeywtgdbyt.exe	137
PID 1228 wrote to memory of 628	1228	bytqoigeywtgdbyt.exe	141
PID 3068 wrote to memory of 4196	3068	hfdxusmkic.exe	143
PID 1228 wrote to memory of 4336	1228	bytqoigeywtgdbyt.exe	147
PID 124 wrote to memory of 4356	124	msedge.exe	149
PID 124 wrote to memory of 1060	124	msedge.exe	150
PID 124 wrote to memory of 5004	124	msedge.exe	151
PID 1228 wrote to memory of 1360	1228	bytqoigeywtgdbyt.exe	154
PID 3700 wrote to memory of 4740	3700	xupnhfzxup.exe	156
PID 1228 wrote to memory of 2728	1228	bytqoigeywtgdbyt.exe	159
PID 1228 wrote to memory of 2460	1228	bytqoigeywtgdbyt.exe	163
PID 3492 wrote to memory of 5416	3492	usmkhfzxrp.exe	165
PID 1228 wrote to memory of 1892	1228	bytqoigeywtgdbyt.exe	168
PID 1228 wrote to memory of 6080	1228	bytqoigeywtgdbyt.exe	172
PID 2736 wrote to memory of 6048	2736	zwurmjebzt.exe	174
PID 1228 wrote to memory of 2156	1228	bytqoigeywtgdbyt.exe	177
PID 1228 wrote to memory of 4328	1228	bytqoigeywtgdbyt.exe	181
PID 4804 wrote to memory of 1060	4804	ojgbztrljd.exe	183
PID 1228 wrote to memory of 3316	1228	bytqoigeywtgdbyt.exe	186
PID 124 wrote to memory of 5128	124	msedge.exe	188
PID 124 wrote to memory of 5128	124	msedge.exe	188
PID 1228 wrote to memory of 5856	1228	bytqoigeywtgdbyt.exe	194
PID 712 wrote to memory of 3056	712	bytqoigbyt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6bd68de9614d27d4ccfa1f4c93ba2f7e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Temp\bytqoigeywtgdbyt.exe
  C:\Temp\bytqoigeywtgdbyt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1464
  - - C:\Temp\gaytqlidbv.exe
      C:\Temp\gaytqlidbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\i_gaytqlidbv.exe
      C:\Temp\i_gaytqlidbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidbytqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5012
  - - C:\Temp\lidbytqlig.exe
      C:\Temp\lidbytqlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidbytqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4668
  - - C:\Temp\i_lidbytqlig.exe
      C:\Temp\i_lidbytqlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5604
  - - C:\Temp\snifaysqki.exe
      C:\Temp\snifaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\i_snifaysqki.exe
      C:\Temp\i_snifaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfdxusmkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:628
  - - C:\Temp\hfdxusmkic.exe
      C:\Temp\hfdxusmkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfdxusmkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4336
  - - C:\Temp\i_hfdxusmkic.exe
      C:\Temp\i_hfdxusmkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1360
  - - C:\Temp\xupnhfzxup.exe
      C:\Temp\xupnhfzxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2728
  - - C:\Temp\i_xupnhfzxup.exe
      C:\Temp\i_xupnhfzxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2460
  - - C:\Temp\usmkhfzxrp.exe
      C:\Temp\usmkhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1892
  - - C:\Temp\i_usmkhfzxrp.exe
      C:\Temp\i_usmkhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwurmjebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6080
  - - C:\Temp\zwurmjebzt.exe
      C:\Temp\zwurmjebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwurmjebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\i_zwurmjebzt.exe
      C:\Temp\i_zwurmjebzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\ojgbztrljd.exe
      C:\Temp\ojgbztrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3316
  - - C:\Temp\i_ojgbztrljd.exe
      C:\Temp\i_ojgbztrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5856
  - - C:\Temp\bytqoigbyt.exe
      C:\Temp\bytqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\i_bytqoigbyt.exe
      C:\Temp\i_bytqoigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqolgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Temp\gdywqolgdb.exe
      C:\Temp\gdywqolgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqolgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Temp\i_gdywqolgdb.exe
      C:\Temp\i_gdywqolgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnifayvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2912
  - - C:\Temp\vtnifayvqn.exe
      C:\Temp\vtnifayvqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnifayvqn.exe ups_ins
    3⤵
    PID:4812
  - - C:\Temp\i_vtnifayvqn.exe
      C:\Temp\i_vtnifayvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqnifays.exe ups_run
    3⤵
    PID:2692
  - - C:\Temp\axsqnifays.exe
      C:\Temp\axsqnifays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqnifays.exe ups_ins
    3⤵
    PID:3300
  - - C:\Temp\i_axsqnifays.exe
      C:\Temp\i_axsqnifays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkiczxrpk.exe ups_run
    3⤵
    PID:3408
  - - C:\Temp\spkiczxrpk.exe
      C:\Temp\spkiczxrpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkiczxrpk.exe ups_ins
    3⤵
    PID:3484
  - - C:\Temp\i_spkiczxrpk.exe
      C:\Temp\i_spkiczxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmkecxup.exe ups_run
    3⤵
    PID:4140
  - - C:\Temp\wupmkecxup.exe
      C:\Temp\wupmkecxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmkecxup.exe ups_ins
    3⤵
    PID:4896
  - - C:\Temp\i_wupmkecxup.exe
      C:\Temp\i_wupmkecxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpjhezw.exe ups_run
    3⤵
    PID:5488
  - - C:\Temp\czurpjhezw.exe
      C:\Temp\czurpjhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpjhezw.exe ups_ins
    3⤵
    PID:6100
  - - C:\Temp\i_czurpjhezw.exe
      C:\Temp\i_czurpjhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwuomgeyw.exe ups_run
    3⤵
    PID:5216
  - - C:\Temp\bzwuomgeyw.exe
      C:\Temp\bzwuomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwuomgeyw.exe ups_ins
    3⤵
    PID:1900
  - - C:\Temp\i_bzwuomgeyw.exe
      C:\Temp\i_bzwuomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    PID:3404
  - - C:\Temp\ywqojgbztr.exe
      C:\Temp\ywqojgbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    PID:5832
  - - C:\Temp\i_ywqojgbztr.exe
      C:\Temp\i_ywqojgbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbywqolgd.exe ups_run
    3⤵
    PID:2272
  - - C:\Temp\jgbywqolgd.exe
      C:\Temp\jgbywqolgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbywqolgd.exe ups_ins
    3⤵
    PID:3968
  - - C:\Temp\i_jgbywqolgd.exe
      C:\Temp\i_jgbywqolgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvqoigdy.exe ups_run
    3⤵
    PID:2160
  - - C:\Temp\fdyvqoigdy.exe
      C:\Temp\fdyvqoigdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvqoigdy.exe ups_ins
    3⤵
    PID:824
  - - C:\Temp\i_fdyvqoigdy.exe
      C:\Temp\i_fdyvqoigdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run
    3⤵
    PID:3224
  - - C:\Temp\aysqkicavs.exe
      C:\Temp\aysqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb1129c188,0x7ffb1129c194,0x7ffb1129c1a0
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,12229880928928165514,14808207502802610152,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
      4⤵
      System Time Discovery
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,3984301717844212495,7029410549865095646,262144 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,225499444587798215,12335312655673000899,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,1483011667219888333,14064703687663658381,2097152 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,14652235569906263217,17641249733037303303,2097152 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,17958713369921273860,5517652538002711472,2097152 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,15229559515232744100,2154007521398801929,2097152 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13485927356135397594,10176002211633894909,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,12988251365434900513,8401252061721902587,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17332653314194420962,8054721270612824398,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3792663822239860639,2094199295458077939,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3792663822239860639,2094199295458077939,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,8243285001811550179,4403369837353171801,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,2907223665214615421,7697647282865083707,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,16438088425437056520,8841085546732628012,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,9039779353260747887,3720010397046112310,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,8630331600164518211,6828937946075619775,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,258526109168600102,17588290824720576956,524288 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5652,i,18259475520859610807,7565192071878527157,262144 --field-trial-handle=2404,i,17362749427333701833,15410945174202647726,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:10
      4⤵
      PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1752

C:\Temp\bytqoigeywtgdbyt.sys
C:\Temp\bytqoigeywtgdbyt.sys
1⤵
- Executes dropped EXE
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3416

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:4168

C:\Temp\ysqkidavsn.sys
C:\Temp\ysqkidavsn.sys
1⤵
- Executes dropped EXE
PID:2728

C:\Temp\kicausmkfc.sys
C:\Temp\kicausmkfc.sys
1⤵
- Executes dropped EXE
PID:5828

C:\Temp\kicaxspkic.sys
C:\Temp\kicaxspkic.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\xusmkecxup.sys
C:\Temp\xusmkecxup.sys
1⤵
- Executes dropped EXE
PID:6004

C:\Temp\wuomkeczxu.sys
C:\Temp\wuomkeczxu.sys
1⤵
- Executes dropped EXE
PID:2172

C:\Temp\ljhbztrljd.sys
C:\Temp\ljhbztrljd.sys
1⤵
- Executes dropped EXE
PID:3932

C:\Temp\wtrojhbytq.sys
C:\Temp\wtrojhbytq.sys
1⤵
- Executes dropped EXE
PID:5864

C:\Temp\igeytqljgb.sys
C:\Temp\igeytqljgb.sys
1⤵
- Executes dropped EXE
PID:784

C:\Temp\xvqnlfdays.sys
C:\Temp\xvqnlfdays.sys
1⤵
- Executes dropped EXE
PID:1456

C:\Temp\xvsnkfdxvp.sys
C:\Temp\xvsnkfdxvp.sys
1⤵
PID:5688

C:\Temp\dxvpnkifzx.sys
C:\Temp\dxvpnkifzx.sys
1⤵
PID:5036

C:\Temp\caurpkhcau.sys
C:\Temp\caurpkhcau.sys
1⤵
PID:2840

C:\Temp\cwupmhezxu.sys
C:\Temp\cwupmhezxu.sys
1⤵
PID:1536

C:\Temp\cwurmjheyw.sys
C:\Temp\cwurmjheyw.sys
1⤵
PID:2308

C:\Temp\mgeywuomge.sys
C:\Temp\mgeywuomge.sys
1⤵
PID:5524

C:\Temp\gdbvtroigd.sys
C:\Temp\gdbvtroigd.sys
1⤵
PID:1400

C:\Temp\jdayvtnlgd.sys
C:\Temp\jdayvtnlgd.sys
1⤵
PID:5924

C:\Temp\faysqkicay.sys
C:\Temp\faysqkicay.sys
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bytqoigeywtgdbyt.exe

Path C:\Temp\bytqoigeywtgdbyt.exe
Size 376KB
SHA256 37451da4be8b5e5f680fca55ef963e7d0883f0edd698c9a06eb904236b149b83
MD5 a08287e76cbe334ac15be948211185ac
SHA1 f8e9971c59f212c3ea364318bcfa9e7e5dd82f50
SHA512 66e8c3f8a151d223aea28b6a43d699f5551c94f44ad99a996a20c2fcbb30933ed8ce68e51d0a9e1362763e74eef7d81db0434cf2fe0bc7c1d7092a3344b28320
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoigeywtgdbyt.sys

Path C:\Temp\bytqoigeywtgdbyt.sys
Size 293KB
SHA256 0aa33eb7a4cb73052e72add3cdbd66235f364e6d85e2e011797bc7d1f7e25ba9
MD5 0f98259b9ad346365063f78d62bf9ef1
SHA1 6ff429286311e5b660d078d5b2f2fdd699efd26d
SHA512 9821a0170fc589582fcfc95190b958400a0d156ad33e649d4afb9367d0c12365c736115ef6a2859e31397fb0ed8b4f3bd8686b4c7db32a26c45338ed4ff57756
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqlidbv.exe

Path C:\Temp\gaytqlidbv.exe
Size 376KB
SHA256 e466f8c8037fbe5755febfbc49adcd4742bb1070cafde665694446f568fe21e1
MD5 7882b0958a9791f097bafb39d89a0b12
SHA1 cb52583a68112be574f3cacf0fa1fbe89382e360
SHA512 aeb7999f9bee01c63b54fada9728fd9a48f3d01d00cfadbd3f93ce60202e3fe1de3b7abd0cda6523f1d9ba1e25248117199f7a6284acd56cbd8a336ead59aafc
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfdxusmkic.exe

Path C:\Temp\hfdxusmkic.exe
Size 376KB
SHA256 b5fcf7ae61095f789e1c47b9e963b77e2f13c0938146f467ea2d1c5df80b29a0
MD5 1143c3973046c78878c7f11e310e3e35
SHA1 305b2d3b71d43bd3f0eb23d99dc8299d8ffbaba1
SHA512 b240482720663b23a85e13d9e56b5c3262c00d75b9a90dbda212fce209a7a989873ffe1bd65c8f9e0534b836d46b7a197a5191b03e99149c3e6dd858a1b5132a
SSDEEP 3072:BFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqlidbv.exe

Path C:\Temp\i_gaytqlidbv.exe
Size 376KB
SHA256 2d09c8e7e60a4c40b546a47e6a0bb36f3e1ddaecdf6616571632e8691bf5db78
MD5 a525d591a078381574d5152911679af7
SHA1 fc60b43cbd94d2aea787a0b8a1971d0bda8c8ef9
SHA512 a608aef9059b8d241fe194016eaaf821dc444d804bf519f34a2d066b3422444b50e0c11c549ab8facebb7b5454d46eaf4fbfa11384837609fad318ba578d93e4
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfdxusmkic.exe

Path C:\Temp\i_hfdxusmkic.exe
Size 376KB
SHA256 4368e2b9614e21b02a562d188d481e867dfb1c5f75f357f7c62edaa0e80dfa4d
MD5 e44927036f63454df1f4c3d6e72c2883
SHA1 96e2276a68a78921ede662702af9f1c5575dc438
SHA512 9a47d73e950e7ac99adce3496cc2ecd039eac15e6532bbf5a1b680035b8ce4770185e4eab92b07537b04dd12c3321610693fbc98f5fcfa846e08a061c116c013
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbytqlig.exe

Path C:\Temp\i_lidbytqlig.exe
Size 376KB
SHA256 06bd3bce4bf305b836f8756f1f42170a974993146dbe3a14ec1ed2df902ef290
MD5 a3950f0981530f9c96c8df55e986ec40
SHA1 a18d50559f83a046ac3362b8fe4f950f47338057
SHA512 2e11ea2e32ac8891b3372cff2fa8cb4705d5477d629d7ded8338a7de5bbee63299db9b12e93a1cbff18dc750ee0af7ccd39d205acb74b0fd2cdd47b06e455143
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snifaysqki.exe

Path C:\Temp\i_snifaysqki.exe
Size 376KB
SHA256 68524d7551e470ca6a38c0cdd4e99b352f254e1c1aa2d3e5f59374c43f161054
MD5 0f671a49d54618babc3177b134dee154
SHA1 e90216a07e1ef02109daf397e1529bef2cdbe709
SHA512 a846e1979179c5be75bc1cd3487573426245f8ee471430aa0c9c6b8f28141a9bad09ca992536dc2beab628677b13e43bfad9bb7bbb9d4f85d50151ebea905f18
SSDEEP 3072:fFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupnhfzxup.exe

Path C:\Temp\i_xupnhfzxup.exe
Size 376KB
SHA256 e5e0d373dac55fa0e476f6bfe49cde4be5d255c74a04abf584edc241ba01ae6e
MD5 1d81b1918ba57c9c62f7d978c8d49607
SHA1 e22f786b104d5781e2c08b60a5d21226070e8626
SHA512 473a6b44ed9f6377267b22251059eb003b5f0ca9ea6250fc606370753fe18f798f03855c248838b3a52dcf907153ece93044c80ce9f0540deee824e05e69bb91
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.sys

Path C:\Temp\kicausmkfc.sys
Size 293KB
SHA256 9453cdee8da8e1e3de4d670e7900a6ff37a4ecdf11cc3fecaa4c63c805f857fe
MD5 0b3297b15a89129c0f5730c5f4752a24
SHA1 f8a618f46568b8230871b9e4eb5254499743fb20
SHA512 310bba061e07ca3cd39435dd3a85857ea7ab3a156eff58270e8d570c9290583b5c2c8a04d0b1598482ee9e9de84a53be5a8884680f698a38f8c69b6b24ce0227
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspkic.sys

Path C:\Temp\kicaxspkic.sys
Size 293KB
SHA256 05218418341889ceacf755c8def5cfc9d6223cb46288c036e4893aa5d6b02ffc
MD5 b4d209c2f97d22b506ea2af780a6f6ca
SHA1 ab5ba7a4b509b41e77862c53567cd3e1ca5d7c98
SHA512 19da5f04c84d7e9952d309e7f26c778595525a99a03f022792db749923baa098b5998f74aa9f306b657038150bbdee0825be63854b474023da9b8b999ed90507
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbytqlig.exe

Path C:\Temp\lidbytqlig.exe
Size 376KB
SHA256 de22d40b5a280cb6dc5362c24eb2d09219bbb72902b1d0ccdab47fa5b03e5ede
MD5 8eb0234e036b7f143f505cd6f14c350a
SHA1 61e6f6eeaf45a0089535d9b1d14e3bf9a3b34ccd
SHA512 3385ba9e2b2a3b1d452e8cab8087be6087170372a4f021597c89299407f8cc81a224d5ffd36cb869cbd17d52ec6e7d1b5e322d80a95f56c93486ae115dcfdc14
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snifaysqki.exe

Path C:\Temp\snifaysqki.exe
Size 376KB
SHA256 c9f501c4d87fcf571229d3477a8533f4a4326cee8ad3f2c8cd9c21889ff94087
MD5 a6911bd54ccb1159b4ef659ed8d8c90c
SHA1 61369d939fd9a59258bab64806dbe4ca9a7f4476
SHA512 432109599b64c947fc6e19d554ec5ae9a20ff51c518b6e600cbd543046f2d516f99a79ed86b0d5b23bed2ea668d2ddf55d6a5a7641c899d43a86bfae5f2cfc44
SSDEEP 3072:3FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.sys

Path C:\Temp\tqljdbvtnl.sys
Size 293KB
SHA256 7ec0b4a516264a0ba3cd9808a2ee01ee5f278f50614912ce695c0e01eebc3518
MD5 c95d4ba8d2dafe658d6ce27891b3796b
SHA1 daed6f3296a8b624ed980057fd5a1e25b560a190
SHA512 6b87e67f47f03c70a1cb94b2968d74499a9d507e521f00c8ab9dc2db66cf5153c57c5fbdeb1997a73e918bd228d0ff72412b1d0d5678f45154a9ac5a3c231262
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhfzxrp.exe

Path C:\Temp\usmkhfzxrp.exe
Size 376KB
SHA256 706fe6587d66862cb64b0edc2b1f832957d401be232595255724b6bdede7446e
MD5 50441cdc5a73806f1984f29f3370163c
SHA1 278151dfb109280d2e5c592f63b866d64bb58d25
SHA512 4c72257f6a474259ef80920a1928345ebf4e0befb1b1162af3226da8acc6637db58e20d42e1ee7a491843a778d24cc1bca23145f5546aba933af20cc240e2be4
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxup.exe

Path C:\Temp\xupnhfzxup.exe
Size 376KB
SHA256 9b4c0de256f8540cb4a956f0fc43df076832985631b3663b9099cda012b9cd80
MD5 1b8dd71f91103ab658536018012e3319
SHA1 e1f91087c458a1be7d1a1cbe0234b26d090d2330
SHA512 c29b0bf75473ae98f25d4948830ef419ca0757d93b17ff4e43817eda68af74d0b7349165c6a7b78eccb12e217ac92d71855fbd3e3b4ac3319363c9011060b888
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmkecxup.sys

Path C:\Temp\xusmkecxup.sys
Size 293KB
SHA256 d560c83c15681d8fb24d175be081ce63d5afc450dd0b7b2457f90897e419615a
MD5 27d523a267365062a90e0b4e7c6f9755
SHA1 030b108c2b397992eb456b7c2b85bf2cec1ce887
SHA512 c9980e9fc921914a237dc52ad65c9c86b5e1b70ea9056c9cc41d853f9f653218e026a61a8a20c50193cebcb78ee9631d4610288e4bc2937f37d3b35c192385ff
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidavsn.sys

Path C:\Temp\ysqkidavsn.sys
Size 293KB
SHA256 d6662748776b9ee7b3a31471da10dbf8965f913b56c5228b2fc41a15d131517e
MD5 61e1944a4b218d5f3b82ba4d69da57bc
SHA1 d1fb22f8919f46ef9be111d70c5e209560e23566
SHA512 622c5cb988310bb355af98dff96b19278d9058ac8c9c53c9ac412f39a89a4dbc69ae7c0c66539a54a0befe54ce4b8c55b7bd82e29062c7ec485840dc3ae40b4f
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b28525ebb6de1cced294ce77cfbdd6a57d91c3cb3648a6d206927f6a72f8ecf0
MD5 1374cc3158543368abe4fcc4b4c0243a
SHA1 880b79ccedd3eeb570d33a471e0b52a5c79a35f1
SHA512 a6433ec2872586f9d43ea6a5d09b46387bedba296bbe40b483efdeb9e456bfb1aecb833f614a77df0367cb5ade2dc7bbdfe733169317752042edbc9caf0a7e88
TLSH
T1C0613F65132105D1EB286FBBB1A294B473FA849B792B7A215041AF7A4CC7FF151E0363
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cd68.TMP
Size 3KB
SHA256 25275bd49eb335009dc787c23b4ca7ad4cb3ee9fb33d91d4efc7f20bd73c91fe
MD5 c6b92f71d4aa8adc37582e2acdab425a
SHA1 f89500228be8e8c082f1b93ebbb387017e970524
SHA512 7c67c08894adf86f61f95d676570363337b4f9e0944ddaea757f961aa2597761098cdddb0547ed0c77839f4cf3fba93d13982d1012d5b4804664f5d30eba6f64
TLSH
T1C9613065132105D1EB286FBBB1A294B833FA849B792B7E2150419F7A4CC7FF161E0363
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b90fe7b81b1f4c8dfee59e579df60e58449cbdd16352593571475e805c51a5d4
MD5 8a64ea7be5299768cb6ec21bc252f0ab
SHA1 d9a103149774fbd9754da95b1dd197938f88a7de
SHA512 90ccddbd519d272b6381f50da18665ca1f25c1ea6ec638f2ea5f5956f84eaa733bfb8fdd911c0206f7520a6e58f7bf618e20937ef56e219d438048aac0aac018
TLSH
T1B141A2F783F4856D890155F0AB18AE1FCE2D0515432C7D5AC9E4AF2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 68b0ca266c24647987f69ec01dc51f7fc1383f7e517c6d32d51b9bc2e79522a5
MD5 b72290f510789f7bf0f898057aec93aa
SHA1 18a6c95b29f9f11d594acd789e608657b834fbd8
SHA512 36151029d0ed1be60cb1d97d1c6a8f4cc7869be8b13035249e3332b59a6a63fb95330396afd0901bb13b0dc1765ac0b492e2cafabd8d44521a7917871e30fbcd
SSDEEP 192:sxR8RaC3/fZsPTuprQ5BzoA8p9M/g6+WNCpG/YnPUOhF+GXIgVbJ:sxR8j3/fZsbuxa/5Z/elFpD
TLSH
T14042B7166D28AC3B5CC7E21DBB15BF53D3F96032A1D51E48AAFC8A1C14E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 77dd49d751353a7f57e0caf27d9de1b06a79f580bceaed733dcbebb412715a66
MD5 11906ab962ec2ea69cb3624083ed873b
SHA1 55be0873a78acaca6fe8c9c57e621e6616d92531
SHA512 976828d92aebc2ba78f0dbc8f35b8a2e908603179dfc42fb318c4ed41912165a5bbaf64d117bb3ac6dfd62f0aa9cfef5911fbaa732de4f480b98fa674aad704b
SSDEEP 192:sxRzRaC3/fZs8TuprQ5BzoA8p9M/g6+WNCpG/YnPUOhF+GXIgDBbJ:sxRzj3/fZsiuxa/5Z/elFpb
TLSH
T12342B7166D28AD3B5CC7E21DBB55BF53D3F92032A1D11E48AAFC8A1C14E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c6a068c9c5fac09577af20da808a5c5ca3f6eaf51e39a86fdc742e288ee8704
MD5 fb6c546157be33536eac08be11f64fe8
SHA1 1a6a3f3141e2d6e700bbbfb2a1802727ccf765ec
SHA512 c9de9e47f92cf631d899b58473193afba29d52c2cc07ddba54ce6f0537590d16782919e1121a14c7267caf7b0c07d026fe0a3869451204395324eb889c845cec
SSDEEP 192:sxRzRaC3/fZs8TPlZWqwzoA8p9M/g6+WNCpG/YnPV0hF+GXIgDrbJ:sxRzj3/fZsiPLWqpa/5Z/ecFpd
TLSH
T1EF42B615AD24AD7B9CC7E209BB55BF53D3F95432A0D11E48AAFC8A1C14E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 afe8ee23bf8db53368b54cb24512c201ad51ab3c4e7db2446d706a313a756e1b
MD5 50f0cb6d4156a273846d389d4432b852
SHA1 3a0603eb1463347e3cd087809b3e665512441f41
SHA512 be4cf1cae31de10fdf2836c9feed33b522e15f0f61133463c2803ea310caba71e8fa356d7d7ddfce031024b7ccb533d1ef0c5a433537349c7547d213cd999666
SSDEEP 768:wb8dmg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCBmu46grohhI5j:wb8dmsE7r6Wgouf6Mu1jaZBmV6rMl
TLSH
T176D2DA7B740DCB7E4F800ADDEC19BE9F6DA802CB96D8C94447FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a68be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a68be.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 138eaf762420b9f9e617d1132fd3383e577e68cf221ce4e7a1fb0deb1e897ad2
MD5 3d6a5b31d3afe3e3f342016ee0af134a
SHA1 97847874dfd966221e0daf1dd5624db93bc2ec47
SHA512 034c5679ee3f0ced577ff040f418d50c5d092e1f45112425deb7a04f460d3e96d752c8dd9665ba6e4e6b18a1f0f04d9d75a737aa24bdb85109965d78621ef703
SSDEEP 768:6rv+4UNbds3FtDZIO0ENzc4ReyIsXyeVH1S5D:6bsbS33tc44bsCEH1Y
TLSH
T11D03CF32E8789A73ACF66686B14776537EF8912BC2D81E94C5DE2F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 dcc9f20f87442091288b23c32a5503238ad4b7405d792242e25b3d0e3288bbdf
MD5 b314525705377a3d278f0a4fc4c90513
SHA1 21715ab805d3093305fb8445c913f71b93722a80
SHA512 4e9ea6569b89a5402481493b1e6829302f5485e18fcfb7527cd933b752c299fc97e9d8953504b03093d6495b2a82050130157e79beadfb8eed7422e9f3858bac
SSDEEP 768:Vrv+4UNbdi3/TDZIO0mkNzc4ReyIsP0fK:Vbsbg3Utc44bs8fK
TLSH
T15C03BE31B828DD63ACFAA285F1477693BFF8206B81C90EA4D9DA5F5C054B1DE171B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 184e12941cbd88c6ef49b18af601cb3af0b9faf04506a978e8699d60aca40a8a
MD5 ac236c1f1e03508ca8118d21b6d39e24
SHA1 0d24b5a752828ced03136f28a07ac92a42ccd485
SHA512 9a61fb996d3061d89d5741533714601f4e99bc6832b3d46c5111ccfe65aab48961dcca1299a64012184ac34cf076fea14c9ec283aee4dbce499b71a41c31558e
SSDEEP 768:Brv+4UNbds3mJDZIO0maNzc4ReyIs20eVH1S5D:BbsbS3/tc44bsXEH1Y
TLSH
T15403CF32E869CD33ACF6A686B04776937EF8616B81C80E94D9DA5F0C09471DE170F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 21faf569de181297f63c9aa0615f9c3765f61223659a11e235c8099452ff8603
MD5 86aff0fd875fe3003f7a1466da6f707c
SHA1 b6d7fc2f494c349efaf118d70c06879a15c0a991
SHA512 6aa34bf3b5a49876944f659843ff416794ecbf70c53e7e02a4d7b659eaa756a410a74bd0ae02fc8d9d1abcb8c6ee49c7d0ae8c7290948fd8cc416d68dd3df691
SSDEEP 384:n9iFiZcIS38Nt8TUNTUlIlP/u4JitGS62Z/fQxXOVSUU/MXZXnUwETRzcoXfK869:0FQS32wgdqZw5O0mANzc4ReyIsP0f64
TLSH
T1C21317F598D38977E8AD5387A73D6E42AEBCC067B1885994B7C55E0CCC421BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cc2f315ae13036c0ecc898e85ae01b9a2bb724228ad0113e4b99cd5309a38726
MD5 9a5d6cd3906ce89964866979a44d863d
SHA1 7dd5ac15bd0ce6223f16c1b4a23cf58540241981
SHA512 d064f7ee984cab561f1fb1552f369e085a6fcbc1949c9e078f4a87155360470aba756701cc3e1d8f4bdd8fc04e4cc507472399fe1ed88712d32dbfe50542e243
SSDEEP 384:ncZcIZ38NTP/u4JiteSsJDZNfNoXOVSUU/MXZXnUkETRzcoXfK86sfxEZxxsIj4q:KZ3oTDZIO0mQNzc4ReyIsP0f64
TLSH
T14AF2BE70AC25CC63ACFAA286F6467792BEF85027C1CC1E94D9DD9F1C084769E171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f8e607ea6f9e8f5ab69f2686db1548e8bb11c499adaad5c11b52a8ca262f80c2
MD5 d663659c21d31191dd3639fb7813d8cc
SHA1 fbeb26cb4631d1e0a8f851bff3a624d2474de696
SHA512 95ee20216db52515a4b904cbc3b7c727ec6ba927e331fae324214e094f0a55dcd2be0a6450fda663f3131f8351aca354c907fc7aef7f6404be69e398732f78b6
SSDEEP 384:nTZcIZ38NTm/u4JiteSsJDZNfNoXOVSUU/MXZXnUkETRzcoXfK86sfxEZxxsIj4q:LZ31TDZIO0mQNzc4ReyIsP0f64
TLSH
T10EF2BE70AC25CC63ACFAA286F6467792BEF85027C1CC1E94D9D99F1C084729E171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8201c4fc-a321-403d-9e6a-8fa79299ee20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8201c4fc-a321-403d-9e6a-8fa79299ee20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir124_124273579\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1a5f55ff736a0b4c638cb9a71939b4a711a603b14720909bafa9c3e2228ee2dd
MD5 2f35b01aba4a6a5f75fdfc11992322b3
SHA1 eb6d00c97db1af10b425282b9d7fceb461aebf9a
SHA512 ddb5e434cc85d426a71b647d8d6340d52ebb1839eb634f9d33b2bd2da295562f5e29aef669b8d8a05cd701d9479bd088555645b2de2a51a54ae0b75d7f1fac08
TLSH
T1A871238357A8C5B3C1DE9BF402835644F6FB223C072330200B915587AB70A7A68B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/784-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1400-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1456-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1536-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2172-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2308-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2728-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2840-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3240-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3932-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4168-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5524-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5688-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5864-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5964-69-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6004-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download