systex | 8a09f938bb9a6399a22709b30f5218303facee89e35ae904beda2c483d348409

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260823-ysrt2san9v
SHA256 8a09f938bb9a6399a22709b30f5218303facee89e35ae904beda2c483d348409
MD5 d28e18d12ca97d214c052714e5db26d9
SHA1 4a09a9f9b7104039cd466a5d335b41051adb29e5
SHA512 292eac15c6217e7ad1ab0904c6ab39dcdd2b7045de22ff64203c37c4ec8b6a70886c71539ff0776ab8db01ebe83d5b9b9df4a1aa1d15e45277d93a8e92bba039
SSDEEP 3072:9FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5512	ywrojhbztrljebwu.exe
3924	ywrojhbztrljebwu.sys
4172	CreateProcess.exe
2996	bztrpjgbzt.exe
2652	CreateProcess.exe
2888	CreateProcess.exe
1900	i_bztrpjgbzt.exe
4256	ztrljdbwto.sys
5572	CreateProcess.exe
4688	oigbywtolg.exe
3200	CreateProcess.exe
3820	CreateProcess.exe
1256	i_oigbywtolg.exe
3476	igdywqoiga.sys
5612	CreateProcess.exe
1652	dywqoigdyw.exe
1880	CreateProcess.exe
4496	CreateProcess.exe
2756	i_dywqoigdyw.exe
4236	lfdyvqnifa.sys
4544	CreateProcess.exe
696	xvpnifdxvq.exe
2796	CreateProcess.exe
5616	CreateProcess.exe
4128	i_xvpnifdxvq.exe
2804	ayvpnlfdxv.sys
3300	CreateProcess.exe
4448	nkfdxvpnhf.exe
1256	CreateProcess.exe
520	CreateProcess.exe
5260	i_nkfdxvpnhf.exe
5308	faxspnkica.sys
4252	CreateProcess.exe
964	zxspnkfcau.exe
2756	CreateProcess.exe
2184	CreateProcess.exe
5040	i_zxspnkfcau.exe
4748	czxrpkhczx.sys
5092	CreateProcess.exe
4176	fzxupmkhca.exe
5468	CreateProcess.exe
4128	CreateProcess.exe
5080	i_fzxupmkhca.exe
2508	ecwuomhezw.sys
3668	CreateProcess.exe
4352	hezxrpjebz.exe
2192	CreateProcess.exe
3424	CreateProcess.exe
904	i_hezxrpjebz.exe
4204	mjhbzxromj.sys
4348	CreateProcess.exe
4392	bztrljebwu.exe
4324	CreateProcess.exe
4768	CreateProcess.exe
2472	i_bztrljebwu.exe
4748	bwtomgeywq.sys
1648	CreateProcess.exe
1820	rljhbztrlj.exe
2932	CreateProcess.exe
4108	CreateProcess.exe
5704	i_rljhbztrlj.exe
3352	ytqljdbvtn.sys
4152	CreateProcess.exe
5760	qljdbvtqlj.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbywtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicayvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbywtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrojgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspnkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uoljgbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uoljgbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrojgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicayvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspnkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjebz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5700	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4296	ipconfig.exe
4140	ipconfig.exe
5304	ipconfig.exe
564	ipconfig.exe
3708	ipconfig.exe
4772	ipconfig.exe
3260	ipconfig.exe
4780	ipconfig.exe
1788	ipconfig.exe
1852	ipconfig.exe
4400	ipconfig.exe
1464	ipconfig.exe
1332	ipconfig.exe
3256	ipconfig.exe
5908	ipconfig.exe
1928	ipconfig.exe
2720	ipconfig.exe
3008	ipconfig.exe
1332	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319890040278991"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{BF226927-F04E-4607-AA7F-CEDA7E5D97FF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe
5512	ywrojhbztrljebwu.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	i_bztrpjgbzt.exe
Token: SeDebugPrivilege	1256	i_oigbywtolg.exe
Token: SeDebugPrivilege	2756	i_dywqoigdyw.exe
Token: SeDebugPrivilege	4128	i_xvpnifdxvq.exe
Token: SeDebugPrivilege	5260	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	5040	i_zxspnkfcau.exe
Token: SeDebugPrivilege	5080	i_fzxupmkhca.exe
Token: SeDebugPrivilege	904	i_hezxrpjebz.exe
Token: SeDebugPrivilege	2472	i_bztrljebwu.exe
Token: SeDebugPrivilege	5704	i_rljhbztrlj.exe
Token: SeDebugPrivilege	2296	i_qljdbvtqlj.exe
Token: SeDebugPrivilege	3504	i_vqnigaysql.exe
Token: SeDebugPrivilege	1588	i_nkicayvpni.exe
Token: SeDebugPrivilege	2208	i_avsnkfdxvp.exe
Token: SeDebugPrivilege	920	i_xupmkfcxvp.exe
Token: SeDebugPrivilege	4636	i_jhbzxrpjhb.exe
Token: SeDebugPrivilege	4600	i_hbztrojgec.exe
Token: SeDebugPrivilege	5340	i_uoljgbywro.exe
Token: SeDebugPrivilege	2708	i_qoigbytqlj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 5512	4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4316 wrote to memory of 5296	4316	2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5296 wrote to memory of 2812	5296	iexplore.exe	91
PID 2812 wrote to memory of 3600	2812	msedge.exe	92
PID 2812 wrote to memory of 2776	2812	msedge.exe	93
PID 2812 wrote to memory of 5700	2812	msedge.exe	94
PID 2812 wrote to memory of 2776	2812	msedge.exe	93
PID 2812 wrote to memory of 2776	2812	msedge.exe	93
PID 2812 wrote to memory of 4888	2812	msedge.exe	96
PID 2812 wrote to memory of 4888	2812	msedge.exe	96
PID 2812 wrote to memory of 1016	2812	msedge.exe	97
PID 2812 wrote to memory of 5916	2812	msedge.exe	98
PID 2812 wrote to memory of 1016	2812	msedge.exe	97
PID 2812 wrote to memory of 1016	2812	msedge.exe	97
PID 2812 wrote to memory of 5916	2812	msedge.exe	98
PID 2812 wrote to memory of 5916	2812	msedge.exe	98
PID 2812 wrote to memory of 3916	2812	msedge.exe	99
PID 2812 wrote to memory of 3916	2812	msedge.exe	99
PID 2812 wrote to memory of 3916	2812	msedge.exe	99
PID 2812 wrote to memory of 4756	2812	msedge.exe	100
PID 2812 wrote to memory of 4756	2812	msedge.exe	100
PID 2812 wrote to memory of 4756	2812	msedge.exe	100
PID 5512 wrote to memory of 4172	5512	ywrojhbztrljebwu.exe	104
PID 2996 wrote to memory of 2652	2996	bztrpjgbzt.exe	107
PID 2812 wrote to memory of 2760	2812	msedge.exe	110
PID 2812 wrote to memory of 2760	2812	msedge.exe	110
PID 2812 wrote to memory of 1260	2812	msedge.exe	111
PID 2812 wrote to memory of 1260	2812	msedge.exe	111
PID 2812 wrote to memory of 3260	2812	msedge.exe	113
PID 5512 wrote to memory of 2888	5512	ywrojhbztrljebwu.exe	116
PID 5512 wrote to memory of 5572	5512	ywrojhbztrljebwu.exe	120
PID 4688 wrote to memory of 3200	4688	oigbywtolg.exe	122
PID 2812 wrote to memory of 5872	2812	msedge.exe	125
PID 2812 wrote to memory of 5872	2812	msedge.exe	125
PID 2812 wrote to memory of 5872	2812	msedge.exe	125
PID 5512 wrote to memory of 3820	5512	ywrojhbztrljebwu.exe	126
PID 2812 wrote to memory of 4900	2812	msedge.exe	128
PID 2812 wrote to memory of 4900	2812	msedge.exe	128
PID 2812 wrote to memory of 4900	2812	msedge.exe	128
PID 5512 wrote to memory of 5612	5512	ywrojhbztrljebwu.exe	131
PID 1652 wrote to memory of 1880	1652	dywqoigdyw.exe	133
PID 5512 wrote to memory of 4496	5512	ywrojhbztrljebwu.exe	136
PID 5512 wrote to memory of 4544	5512	ywrojhbztrljebwu.exe	141
PID 696 wrote to memory of 2796	696	xvpnifdxvq.exe	143
PID 5512 wrote to memory of 5616	5512	ywrojhbztrljebwu.exe	146
PID 2812 wrote to memory of 3372	2812	msedge.exe	148
PID 2812 wrote to memory of 3372	2812	msedge.exe	148
PID 2812 wrote to memory of 3372	2812	msedge.exe	148
PID 2812 wrote to memory of 6024	2812	msedge.exe	149
PID 2812 wrote to memory of 2724	2812	msedge.exe	150
PID 2812 wrote to memory of 3508	2812	msedge.exe	151
PID 5512 wrote to memory of 3300	5512	ywrojhbztrljebwu.exe	154
PID 4448 wrote to memory of 1256	4448	nkfdxvpnhf.exe	156
PID 5512 wrote to memory of 520	5512	ywrojhbztrljebwu.exe	159
PID 5512 wrote to memory of 4252	5512	ywrojhbztrljebwu.exe	163
PID 964 wrote to memory of 2756	964	zxspnkfcau.exe	165
PID 5512 wrote to memory of 2184	5512	ywrojhbztrljebwu.exe	168
PID 5512 wrote to memory of 5092	5512	ywrojhbztrljebwu.exe	172
PID 4176 wrote to memory of 5468	4176	fzxupmkhca.exe	174
PID 5512 wrote to memory of 4128	5512	ywrojhbztrljebwu.exe	177
PID 5512 wrote to memory of 3668	5512	ywrojhbztrljebwu.exe	181
PID 4352 wrote to memory of 2192	4352	hezxrpjebz.exe	183
PID 5512 wrote to memory of 3424	5512	ywrojhbztrljebwu.exe	186
PID 2812 wrote to memory of 848	2812	msedge.exe	188

C:\Users\Admin\AppData\Local\Temp\2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_d28e18d12ca97d214c052714e5db26d9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Temp\ywrojhbztrljebwu.exe
  C:\Temp\ywrojhbztrljebwu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrpjgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4172
  - - C:\Temp\bztrpjgbzt.exe
      C:\Temp\bztrpjgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrpjgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2888
  - - C:\Temp\i_bztrpjgbzt.exe
      C:\Temp\i_bztrpjgbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbywtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5572
  - - C:\Temp\oigbywtolg.exe
      C:\Temp\oigbywtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbywtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3820
  - - C:\Temp\i_oigbywtolg.exe
      C:\Temp\i_oigbywtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\dywqoigdyw.exe
      C:\Temp\dywqoigdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4496
  - - C:\Temp\i_dywqoigdyw.exe
      C:\Temp\i_dywqoigdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Temp\xvpnifdxvq.exe
      C:\Temp\xvpnifdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5616
  - - C:\Temp\i_xvpnifdxvq.exe
      C:\Temp\i_xvpnifdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:520
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspnkfcau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4252
  - - C:\Temp\zxspnkfcau.exe
      C:\Temp\zxspnkfcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspnkfcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\i_zxspnkfcau.exe
      C:\Temp\i_zxspnkfcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxupmkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Temp\fzxupmkhca.exe
      C:\Temp\fzxupmkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxupmkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4128
  - - C:\Temp\i_fzxupmkhca.exe
      C:\Temp\i_fzxupmkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrpjebz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3668
  - - C:\Temp\hezxrpjebz.exe
      C:\Temp\hezxrpjebz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3424
  - - C:\Temp\i_hezxrpjebz.exe
      C:\Temp\i_hezxrpjebz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4348
  - - C:\Temp\bztrljebwu.exe
      C:\Temp\bztrljebwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4768
  - - C:\Temp\i_bztrljebwu.exe
      C:\Temp\i_bztrljebwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1648
  - - C:\Temp\rljhbztrlj.exe
      C:\Temp\rljhbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4108
  - - C:\Temp\i_rljhbztrlj.exe
      C:\Temp\i_rljhbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbvtqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4152
  - - C:\Temp\qljdbvtqlj.exe
      C:\Temp\qljdbvtqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbvtqlj.exe ups_ins
    3⤵
    PID:468
  - - C:\Temp\i_qljdbvtqlj.exe
      C:\Temp\i_qljdbvtqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnigaysql.exe ups_run
    3⤵
    PID:1000
  - - C:\Temp\vqnigaysql.exe
      C:\Temp\vqnigaysql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnigaysql.exe ups_ins
    3⤵
    PID:1596
  - - C:\Temp\i_vqnigaysql.exe
      C:\Temp\i_vqnigaysql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicayvpni.exe ups_run
    3⤵
    PID:5764
  - - C:\Temp\nkicayvpni.exe
      C:\Temp\nkicayvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicayvpni.exe ups_ins
    3⤵
    PID:4300
  - - C:\Temp\i_nkicayvpni.exe
      C:\Temp\i_nkicayvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnkfdxvp.exe ups_run
    3⤵
    PID:2672
  - - C:\Temp\avsnkfdxvp.exe
      C:\Temp\avsnkfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnkfdxvp.exe ups_ins
    3⤵
    PID:2856
  - - C:\Temp\i_avsnkfdxvp.exe
      C:\Temp\i_avsnkfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmkfcxvp.exe ups_run
    3⤵
    PID:1464
  - - C:\Temp\xupmkfcxvp.exe
      C:\Temp\xupmkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmkfcxvp.exe ups_ins
    3⤵
    PID:1212
  - - C:\Temp\i_xupmkfcxvp.exe
      C:\Temp\i_xupmkfcxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzxrpjhb.exe ups_run
    3⤵
    PID:4060
  - - C:\Temp\jhbzxrpjhb.exe
      C:\Temp\jhbzxrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzxrpjhb.exe ups_ins
    3⤵
    PID:5020
  - - C:\Temp\i_jhbzxrpjhb.exe
      C:\Temp\i_jhbzxrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrojgec.exe ups_run
    3⤵
    PID:3504
  - - C:\Temp\hbztrojgec.exe
      C:\Temp\hbztrojgec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrojgec.exe ups_ins
    3⤵
    PID:956
  - - C:\Temp\i_hbztrojgec.exe
      C:\Temp\i_hbztrojgec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uoljgbywro.exe ups_run
    3⤵
    PID:4260
  - - C:\Temp\uoljgbywro.exe
      C:\Temp\uoljgbywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uoljgbywro.exe ups_ins
    3⤵
    PID:1432
  - - C:\Temp\i_uoljgbywro.exe
      C:\Temp\i_uoljgbywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run
    3⤵
    PID:5084
  - - C:\Temp\qoigbytqlj.exe
      C:\Temp\qoigbytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins
    3⤵
    PID:1732
  - - C:\Temp\i_qoigbytqlj.exe
      C:\Temp\i_qoigbytqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbbf14c188,0x7ffbbf14c194,0x7ffbbf14c1a0
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10675766154112094213,8137663005951430084,262144 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1003844240736792565,1155276825243333212,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
      4⤵
      System Time Discovery
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,4644288363788751085,16039915454586920391,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,7681478077402625421,1745574874417568490,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,5598503357243590903,4330949525094246557,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,16815333432351596407,4908280009998254207,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,16995956640845858370,9609551736490621100,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7547443234431564988,6879360823465176794,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,4144688772640249432,7366777337302089962,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,12424492098283145833,13651808099229729901,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,12424492098283145833,13651808099229729901,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6496,i,7641737126727667373,9364252748686203525,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3784,i,11196090646452006800,9259566848780440261,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4964,i,14096318090342223499,1557485248227119138,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,3354035471420894802,12085124095333430409,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,10718774316004064381,7792466912478319169,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,15597816343579792131,12945919204617279050,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,9496705257189272505,10989492082806746519,524288 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5668,i,953548984111933881,17346850717789872226,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,15807069892415659003,5415774241583459326,262144 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:10
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5692,i,9535435247326029586,13240602685079341867,2097152 --field-trial-handle=2424,i,14733324358892050827,15483283754367442560,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
      4⤵
      PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Temp\ywrojhbztrljebwu.sys
C:\Temp\ywrojhbztrljebwu.sys
1⤵
- Executes dropped EXE
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1356

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Temp\igdywqoiga.sys
C:\Temp\igdywqoiga.sys
1⤵
- Executes dropped EXE
PID:3476

C:\Temp\lfdyvqnifa.sys
C:\Temp\lfdyvqnifa.sys
1⤵
- Executes dropped EXE
PID:4236

C:\Temp\ayvpnlfdxv.sys
C:\Temp\ayvpnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\faxspnkica.sys
C:\Temp\faxspnkica.sys
1⤵
- Executes dropped EXE
PID:5308

C:\Temp\czxrpkhczx.sys
C:\Temp\czxrpkhczx.sys
1⤵
- Executes dropped EXE
PID:4748

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:2508

C:\Temp\mjhbzxromj.sys
C:\Temp\mjhbzxromj.sys
1⤵
- Executes dropped EXE
PID:4204

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
- Executes dropped EXE
PID:4748

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:3352

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
PID:1568

C:\Temp\vtnligayvq.sys
C:\Temp\vtnligayvq.sys
1⤵
PID:4904

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
PID:4400

C:\Temp\xupnkfcxvp.sys
C:\Temp\xupnkfcxvp.sys
1⤵
PID:3556

C:\Temp\bzxrpmkecw.sys
C:\Temp\bzxrpmkecw.sys
1⤵
PID:2432

C:\Temp\wrpjhczurm.sys
C:\Temp\wrpjhczurm.sys
1⤵
PID:908

C:\Temp\trpjhbzwro.sys
C:\Temp\trpjhbzwro.sys
1⤵
PID:3076

C:\Temp\vtrojgbztr.sys
C:\Temp\vtrojgbztr.sys
1⤵
PID:2292

C:\Temp\gdyvtnlgdb.sys
C:\Temp\gdyvtnlgdb.sys
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvpnlfdxv.sys

Path C:\Temp\ayvpnlfdxv.sys
Size 293KB
SHA256 459840548587c99884a83252a55e88e96b0894d8bb443f8c18b35353f83f0832
MD5 932d255049f438b5f106f33e1c0ee020
SHA1 20c0b9718cd72d2261c232723fee4a8a21b30c62
SHA512 486f997e5f80e8cd68aeef4d20aa95593e6e360a3845a513c12fdc7dd13be1b4e1f0e511c7018144213fa8c3ecc4913a98b2b6b547c042c1ba00a68b09479b7b
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpjgbzt.exe

Path C:\Temp\bztrpjgbzt.exe
Size 376KB
SHA256 874983c3876933ac0bc7542e9a4c27b4bfdc5a7e226bc6d8ed08a1e09a9c156d
MD5 e84997e53683d465d6c02f8a719b774a
SHA1 05d6581a0e949310fbeae4354b1d1311a58e1bf3
SHA512 5f82f0425f0b56555a9be60ac401166f2dd3aeeaed60206cf1b223c16703d3343fbe6c2dbaf69f3077728e4a898ad0747405a0f2558a57b57817724d00a9a817
SSDEEP 3072:HFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigdyw.exe

Path C:\Temp\dywqoigdyw.exe
Size 376KB
SHA256 f68f56892027b3f7b7b57e6e61aa72b7fcb25ecb462cec70d64318c330823779
MD5 229f7ed8f41aa3eab48d661a8ef470c3
SHA1 4c548abc9b3dfa0843844bbcb09b12d1c68177a8
SHA512 2a061764d3e2ceccf9bc81cff3a2fc28d87e07eb26f6fa80b3ccc38e1260c43705bb61b094fb93b7eca0cbd7e475f956e3ecc8a73d11be2eae330f178975e89e
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T181847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspnkica.sys

Path C:\Temp\faxspnkica.sys
Size 293KB
SHA256 162ef3cdb2dd83389f402fe789d7042ff2a420f29eb4f792e7f8b11f1a7a9a2e
MD5 8d96609009ba449d35b38125dcc490d7
SHA1 50e685702b0eb008b7aeb811b84cf5309a021995
SHA512 387718642ad764a6cd99e63f35e92f35260e9035aa560d01e8de71076e8b036e102888839bc927857d8bc00907f7bb61233f3a9d4e3a7afa6807eeae7a2b1b64
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrpjgbzt.exe

Path C:\Temp\i_bztrpjgbzt.exe
Size 376KB
SHA256 0126bb77658ff86ec8fdca28f08102f2998ed69c6ccd637d57e2e7c92643db43
MD5 23370bb988f0bf150c2cdcd31b5b1987
SHA1 6c065c07ec9fcedac147204f9fcbf4ec91e96cb9
SHA512 3ed2f7b0c3d39998a9d55e37e08ff8a1ae1da594dbf5329415b7fc6c4092b839491b07ca14a3f140d13c3dd40e0cde3b49ecc7c91e2c2074ef34a8ff97d1e4af
SSDEEP 3072:AFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigdyw.exe

Path C:\Temp\i_dywqoigdyw.exe
Size 376KB
SHA256 0ecde077fb0dec4912afd934e1da4f68851580105775f6d1e8ac99d89fe7797b
MD5 1dc28939188db93088bda4a5a7fb3756
SHA1 fe9029c39573bd056cc5bbc1afc1f1948430dc92
SHA512 26917cf9620ace2788deaaed74fef4973fbd7e62a79751c982fa93ebee5c835746c49a53100949d4bf3c04684e00f61eecbb04ee7a66dbede88f2c30dc3c5910
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnhf.exe

Path C:\Temp\i_nkfdxvpnhf.exe
Size 376KB
SHA256 19e6662df655327b9bfdcfc3e21045d7853ce3faeadf2176f9c6543427db1578
MD5 4decb098c56ea82de8d7d933178afb87
SHA1 128e4ffaac51ce38a9ed3d5e2d9e13476b105923
SHA512 c5258f44f3b4f1d254832dc76034cb16e6f3590af03e7b4a8a61f0b8537caa700c97f9d9d4b34c2ef23fa43c02e25f94b48fb074e4c792b5731c88dc67975205
SSDEEP 3072:ZFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbywtolg.exe

Path C:\Temp\i_oigbywtolg.exe
Size 376KB
SHA256 beb6562bbd6bef79e64432b5c031d5b3c97de6631b905d92e066c5392cf8adc5
MD5 3f776f2ce0fe8b8173418083dd3fd551
SHA1 3b3e02749903138cb4689508a11385b44387e1b7
SHA512 b41145c195f064f3060eb7f3d805841088c19397957740e21c4a3607ce29e2584930a7b10573a3c72c391a6858b0e061de08572340c601004152e420c68c6cc4
SSDEEP 3072:ZFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifdxvq.exe

Path C:\Temp\i_xvpnifdxvq.exe
Size 376KB
SHA256 fc66116915d8a2f1861cb905c118d3c78a777cf13fc90385019ed047c2e78592
MD5 1605b283e9b64d2a272481dc3800d3c2
SHA1 a7d68c8b5e10ac17108742be2b8f911d2b1466b4
SHA512 29a2b79f87d50bf1b69a45edc2b1ef804c80a00a9e9013e808b07a40c4c87fcfc7151b4bc1807c0e2ca9792ee99f1ceeafce13cade3c533f569c960af7d9e2a0
SSDEEP 3072:LFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoiga.sys

Path C:\Temp\igdywqoiga.sys
Size 293KB
SHA256 13cd7ea11667f69fad1cd99d2f1a51a46114f9379d41f292f7baeb321fbe7116
MD5 f5141770e0e7719b3ad2bbd883acc867
SHA1 a2bdd5aef0570f094e457dc6156e47950586e529
SHA512 92540bfc4bb50541bde6ea862d86fff4ed0a3a5fd970a9403934143e225d7427bd5a008df38e9ec5fd52ae5149936bcb444838ae0baaadba128d4a8b391b11a5
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqnifa.sys

Path C:\Temp\lfdyvqnifa.sys
Size 293KB
SHA256 7b2b5b925b7b68172b587c7db11c338e0b066eee1e7d31095f724b8327f2ec9e
MD5 5340cd1005cb1a63117c9187e887b97f
SHA1 e7383c19faeef6461ce6430eb1f2611d34a9f7bb
SHA512 9ff484c22d87db03037a0cf25fa825bd8a2624769fe25c87c4421780a810159fa0489c1056b0809271941c2ff747c0e61e793c5ce9f023ada410226b144a258d
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T17A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.exe

Path C:\Temp\nkfdxvpnhf.exe
Size 376KB
SHA256 24113f51c44a1dfa1d22ab99a1b2b215d422def630ffe7365a3965e8eee333c3
MD5 28b1d2fb6bb4ba34aecd04ce66142a61
SHA1 ad58dcdd9014173da6646fff1af55cce46a48e38
SHA512 7a00759d5e39fb48c3f9efbbad8bd1f599cdecd64fceee0d9cbd75740fc5df184365af88f2ae94ff02fbe28c78f3b90117b16bba3e1027b7431adc55e69acc66
SSDEEP 3072:7FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbywtolg.exe

Path C:\Temp\oigbywtolg.exe
Size 376KB
SHA256 92512fd93c64409fb032e526bbd03c7618af5ef24e12c041f3f0524961fe23d7
MD5 a75cf8034cdfdadb7ea60626749f0621
SHA1 e2ef5e0a50e1be2da1cb503d1c75bc668237dc81
SHA512 246875d90f2d37e94fdfc5d163f488114087e8c4625921840683e9f117fcaf8a5ece3b1365f5b7c0a7f0e2103a4b29737f555a6ed6babc19e66da2f3d5df0fe1
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifdxvq.exe

Path C:\Temp\xvpnifdxvq.exe
Size 376KB
SHA256 675b36e30903d4c559c8db607ca97b042a6ca8bee94abba2a12a2095ea55837a
MD5 106d83707366a77bf0408907240aea2b
SHA1 88dee73ca4a1491bacc710c978f2dd0b37478615
SHA512 c40c663a7f7efc174dda2b7a9074890f2895c4c267763b7ba0a3c94567310bafc20959d543fd4aa321b2404a37abc93daff8b0200104abfdc4c9c0fe558aeffd
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztrljebwu.exe

Path C:\Temp\ywrojhbztrljebwu.exe
Size 376KB
SHA256 b6bd35905a2a6a527923dbd8e9f818a2b130960d8fdf2dac8f19b6f25a39d7e8
MD5 42bb61267e7f4a746c8fa0f4d6520a63
SHA1 294f6b2e545efd281c29762f4fdcef25dea4b0cb
SHA512 c5abd6fee351ed53bde2c95d608e91ff81d584ef621ce56cdbaa49e1e9923111dbef0cc19717a6a8bea01b7cb645e3ce360cd9a90657bc45aced9745187090fc
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztrljebwu.sys

Path C:\Temp\ywrojhbztrljebwu.sys
Size 293KB
SHA256 c3cff62c092935b366a56e2b83a92bf6272c04ead19e25d6865c2b9ce4cc45ce
MD5 b3b924f5d1831c57d2e07c85ee5f5481
SHA1 0b1be637bd4b8ee2bfbcb9236f318882fe31fd1a
SHA512 4794108105e0991403370af57ed21c6f60b4102b41c48f127cc00c9eb2f66b57ea71506393142763ce43f96b388ca9c3e37399196318f82c39dc0cadac65bde3
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T12C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 293KB
SHA256 6aa02d42d64891dd77e762b83664c8cd755fb7601edb3ef634ce8e61b91bdf18
MD5 1f285030404c289ccce840f4a3a6fd94
SHA1 b916f116e6ad24273e4d31795963e8beb93c5534
SHA512 6a128f10c15245b73a0b23dadcf36d88eb825b94107f1d5a5aad8aa78f8fd1f2ae0e988198b16f2c2e13125830df06a63ec257c83ecf55f0abc6efba335bd91b
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxspnkfcau.exe

Path C:\Temp\zxspnkfcau.exe
Size 376KB
SHA256 686158ed7e751590cbdb3fe1e539a324246c4cb592da973fbbbd06e8e31201f7
MD5 b153c1c7eca58f1db3871128c0170a1e
SHA1 13bf707421d3897cf32b5a48e4967f36748978dc
SHA512 6bfef6207ae20978a9013c74a9fdcdc9b8a5d34accad810d764dc0b843f75856011ec62e093f633b506fcabac381bbe92f0181d8501a7bf7ab0984159a42a439
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 486884d1ff41be36120abb7b7d41747c00dbd986f4302f83d0909d6d72a843a1
MD5 870c8e4d4835d799be09d4629fb253e6
SHA1 d687357ffed2878e215247370debd1903a72c309
SHA512 82443ed7e403da33be7478f8b91afb7876c7fe30eea564c333f07c5924ec4fc51933015f264cb6d3a9643bf6745dd3695c6dbbb70902f869222011c3f1c5b685
TLSH
T13951426EB7A518C0DF608CB220ED4C893AF3A4E8950B2F54141CBE73C907FA4D0D0823
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a0e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a0e9.TMP
Size 2KB
SHA256 a1f8ec6680120ada3ecaa814fa07268ca24f382fef3c54e0d4e35a00e28eb9df
MD5 c74a076eae0f79bc4cea0fada949fc28
SHA1 539712a5814875395341014b0ffc610d8ad848bb
SHA512 3322a590c76ca76eeee5e2464268a2b74a79aba0b33636288637abfbf8f4fe91c7619252b19212094a96575f37073648053a315a4f806febcc8dba0b2996d103
TLSH
T13F51226E7BA518C1EF609CB264ED4C993AF3A4E895072F51145CBE73C907FA4D1D0863
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bb711ed8dab7d612de06f30ab2ae0764e348002cb043001c266debe7c32ef391
MD5 ac1bad0b51fc5e895a8b4a2c4609fc50
SHA1 a869fb5baae37afcb9a8979eae9054eb219844b9
SHA512 65f2ccfe14704cfb4762f6b6b5f252c358ddfadc14e4432780cd3bf101f78d99852d982f29888bada5a28e62468938e7eaa55c6b05a95ab27b7c98ad0fe744fd
SSDEEP 192:sxRJrCU/fQs4iKrjDuzoA8pi/g6+WNIYEpPFKTGHIgVUUJ:sxRJeU/fQs4imi/5IrxaY
TLSH
T15432B9166D28A93B8CC7D31DBB657F53D2F95033A1941E48AAFC9A1C04EB6DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 696ee6711069be66621208efb6228cd3343c8fbcb20decb3de6895426bc81c44
MD5 f8d9bd9bee301612fbb8102b452a31c2
SHA1 7e3680ad10c83551f933246a887dea25dfedfa60
SHA512 788ae5b2b379c8581315a5ba615103dc6e2e046375d59b8f951b8a45aefd6718acdf41d3d47b51a7582dfe4dc6bbb87460a259d5403ed81bf67eea984cbfd774
SSDEEP 192:sxRWrCU/fQsNeKrjDmzoA8p9h/g6+WNIYErjFKTGHIgDtUeaXJ:sxRWeU/fQsNeOn/5IJxuP
TLSH
T18D42D9166D28A97B8CCBE30DB7557F53D3F9903251951E08AAFC9A1C04EB6CD221B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 74c88e3c991121d1ebf16ee0302f9a4c40c0ab75bcaf113a6be8c7bc6a62f8f5
MD5 6fcb28b8e4e56e311e2bf5ee92efed41
SHA1 a559792b2f8287faad1deaa6806d9d170396eafe
SHA512 677b17bfb942b786f76a36bc1b9bef16e1d42f43ee1cd15ed2db8647444ae9d97afbeed16a64eff5f72cd17c4ba626c9f710675db9b0aa883bfa38820ad95f1b
SSDEEP 192:sxRWrCU/fQsNiKrjDmzoA8p9h/g6+WNIYE/PFKTGHIgDfUUJ:sxRWeU/fQsNiOn/5IRxYY
TLSH
T12A32C9166D28A97B8CCBD31DBB657F53D3F9503261901E48AAFC9A1C04EB6CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 679893cbd8fb1c5f9fbfe5d16766f106a45c65c9b32c9c196c1a1c00559eaa8d
MD5 f6ec5702c54687b5d144c7c2382ac646
SHA1 f3c3b9f90a5486ce95ca1247924ca220be912fa0
SHA512 f4c8df56fb20f5bf2377e2dbd66189f42be5a6c5868f5cb2b410d9c2dcd0f7bab79310628ca5710f6f4cb3469082dd6200fd40b56fe91290975a3b696254406a
SSDEEP 768:0UQi5W7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwOVquroJ66:0UQi52E7PaWgH7feQu1jaNIqlJ
TLSH
T1F2C2DB7B640CCB7E4F804ADDEC297E9B6DA802CB9698CD8047FE951C03C7BEA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6f60ad995ad02ec4d116621f29476c8f60e820f5c986b0ed2a780df0ba191985
MD5 5ac0305e2af0ff3f9a40aeccad075c44
SHA1 07fe0cf1ee14a7860c6a81fb0f4a45615ce211c1
SHA512 17e9c6ddcef6921b70ef7ad89f350c5786607d9942794991d4994730ac53bd30d5398e8dd92fee3df40101f99edf52f9fe717f3d70043f08780fa16e6de875b1
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zOHbEBVj5J1WdSIg91K4EgT1c7j6MFzSKMcT:C1i7PF/DWrwfX9mgpct1o7zOHbEBVj56
TLSH
T16F91420271BA02413D7F754C91E99C2B56C274A2351AE42B3FB841E60F6BE428EFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 534458026e62961693130d7a3f7183c6e1c8b7e3fcdda6311938a90737661c45
MD5 a1c1347ce1cc671d6965a565b3095598
SHA1 7d781fcb59f2b8cbb7de4d0655df0fe074e62e8c
SHA512 985d8532cc2fc730c4381fc4a687625d50392ff1e42dbe2ba8544d6f0114fbaefef79e45f3cb30bceae5110e76ec56cf0cd3cad306730b37cf1f982269cde714
SSDEEP 768:Srv+4UNbd838wqGXBDeoK48dHeByERRFzjK3YIeVH1SCAy:SbsbO38RG9eF48dHSyw/OEH1n
TLSH
T16A13CE70A8A89E734CEBE28975837687BFF4516384C40B64D4DAAF4E85865CC170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5756e4b3b3c436b8d208e2d4a4fcccc16def13f5ef4fd6a1d8ce867cb3f4e3c1
MD5 96ca7feca1cb10859bfdd14fc3ffaf48
SHA1 cc409e930287daaf615dc156c0923577ada44af2
SHA512 8257efabb2a121c35ed88c3d8c505798ede107d5b34ccb7682650ad13ffeb74e68773b99fbcf9cf2929150abb1d1fd235aa00dd71b05c31079bc87e56635c676
SSDEEP 768:Krv+4UNbdW38wqGXB+SoK48dHeByERRFzjK3YIeVH1SCw:Kbsb838RGcSF48dHSyw/OEH1G
TLSH
T13313BE70A8A89E738CEBE2897583B687BFF4416384C50A54C4D9AF4E49875DC170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 feeb125eae8955340cadee8be12f8213fb9687053372261e96118fc677af84a1
MD5 416e88dc29e0f4df12d386e4d8c06913
SHA1 5b0c18c775c25c68d799c6d8aa09f7789043ec17
SHA512 2f2ec40fe1de352fa98f98c3b22f1a4642cbd18cf46d88972e901b906ae254c36aa0dc6b043791b51d269f2d3d85eaf15b6f7f1563a075cc8a39d43004cd9950
SSDEEP 768:Qrv+4UNbdf3vqGLVD7K48dHeByERRFzjK3YKeVH1SCj:QbsbJ3CG1u48dHSyw/QEH1Z
TLSH
T1C503BE71A8A85A734CE7D2897683B65BBFF4411382D41BA4C4DD6F4E828B4DC530BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0986bdb822defe3b139855f2f7e07611964fa7f6ab5596b8b65c569e3767fc9a
MD5 5719576c64465d01eb5176d46a864054
SHA1 7664b13fda98b024911f75d3a10830d5b971655b
SHA512 998dc92c658883abf14ec596d198508ad219c7455060211c8c4814749f015cbc36d2256ee90d26aee55acecc9c431984aaf3df002ffc0318ff91fbd2f60b923c
SSDEEP 768:trv+4UNbdf3iqGC3DeOK48dHeByERRFzjK3JIeVH1SCj:tbsbJ3zGueH48dHSyw/hEH1Z
TLSH
T11503CE70A8A89E730CEBE2897583B697BFF4116384C40B64D4D9AF4E85864CD170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 38091c3cb8b87dc3b071a47522a773a21599b28d234104e6f3132f121e7af709
MD5 5734901e14a69b8cc48f713e66ace3b5
SHA1 b1b62ad328f4477b01b87f910feba580fd43240f
SHA512 2155d2ed0dd056a216bbecca800e007f146028cb4fe18ab422376d4fa045b69df897a4e13f130b40818a29f12ed16573ec9e4c3ecfe9dd7159ed294947e44a5b
SSDEEP 768:Trv+4UNbd83FwqGOBDeoK48dHeByERRFzjK3YIeVH1SCX:TbsbO3FRG4eF48dHSyw/OEH11
TLSH
T15913CE70A8A89E734CEBE28975837687BFF4516384C40B64D4DAAF4E85864CC170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

156e8c3c-6415-4bfe-99a6-da3fa58813f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\156e8c3c-6415-4bfe-99a6-da3fa58813f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 044bc46edb2e5b1a7201b8d3b38ae50694bcfa3d148386dc5c8156986657110d
MD5 0c573e56d1a9204ec98c9490e5cfcba9
SHA1 b8a38654a1c285a80c91668b153ff0fcf0b431e5
SHA512 4a7cda9c01dceefa2b48a298ebdd6be53d16305c82108b435c7d8c9b4e170cd6fc4e32bf5c8458bb1ff4273101adc60fad7ff0716b5680a9e48e8103839d628f
TLSH
T17271274357B8D5B3C5DE5FF102835604F6FB2278472330314B515546A730B392478F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1568-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2508-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3076-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3352-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3924-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4204-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4236-223-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-148-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4400-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5308-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download