systex | 49a050d7df5448c126f8e4258b5f29474e5a437318dace61847db68f86a47152

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260930-npgjsstfpd
SHA256 49a050d7df5448c126f8e4258b5f29474e5a437318dace61847db68f86a47152
MD5 4f173271dbe48df73a91659792f06e03
SHA1 8307535ea627e166d79ade175cc4ef9dc055719b
SHA512 5b1010317178df32c5e08058ca09638982dc670396d7703ceba7f4ec687c7b20819f0824674d55d32055fefc826e28fc6601500f8edacc83f5280ec31d0e0bf8
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T107847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4312	aytqlidbvtnlgdyv.exe
2720	aytqlidbvtnlgdyv.sys
624	CreateProcess.exe
4068	vtnlidavtn.exe
2864	CreateProcess.exe
4972	CreateProcess.exe
708	i_vtnlidavtn.exe
2032	vtnlfdxvpn.sys
5616	CreateProcess.exe
4232	nlfdqnicay.exe
3492	CreateProcess.exe
1544	CreateProcess.exe
1220	i_nlfdqnicay.exe
5372	fcxvsnkica.sys
964	CreateProcess.exe
456	axvpnhfzxs.exe
2516	CreateProcess.exe
1252	CreateProcess.exe
4580	i_axvpnhfzxs.exe
2764	zxupmkhczx.sys
2672	CreateProcess.exe
4224	caurpjhfcx.exe
708	CreateProcess.exe
5340	CreateProcess.exe
4448	i_caurpjhfcx.exe
2316	mkeczurmjh.sys
5080	CreateProcess.exe
4524	pjheczuomh.exe
4628	CreateProcess.exe
1976	CreateProcess.exe
3388	i_pjheczuomh.exe
2304	omjhbztrmj.sys
5152	CreateProcess.exe
4992	gebztrljdb.exe
4580	CreateProcess.exe
2508	CreateProcess.exe
4092	i_gebztrljdb.exe
3668	ebztromgeb.sys
1344	CreateProcess.exe
4116	jebztqomje.exe
3452	CreateProcess.exe
4980	CreateProcess.exe
5564	i_jebztqomje.exe
2276	ligaytqoig.sys
4624	CreateProcess.exe
4056	ljdbvqolgd.exe
1776	CreateProcess.exe
1196	CreateProcess.exe
476	i_ljdbvqolgd.exe
2768	gayolfdays.sys
3884	CreateProcess.exe
4712	sqkigayvtn.exe
4736	CreateProcess.exe
1528	CreateProcess.exe
2116	i_sqkigayvtn.exe
2300	nifdxvqnig.sys
4172	CreateProcess.exe
4384	qdavsnlfdx.exe
4440	CreateProcess.exe
2652	CreateProcess.exe
3568	i_qdavsnlfdx.exe
4244	fdavsnkifd.sys
2324	CreateProcess.exe
2372	hfcavsnkfc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_441137918\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_441137918\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1321719499\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1321719499\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_441137918\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_441137918\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1069237646\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1030387981\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1030387981\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdqnicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcavsnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caurpjhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjheczuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkigayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjheczuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztqomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkigayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpmzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztqomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcavsnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkifdavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpmzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdqnicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caurpjhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkifdavsq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
236	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1708	ipconfig.exe
5696	ipconfig.exe
4956	ipconfig.exe
1724	ipconfig.exe
4588	ipconfig.exe
4036	ipconfig.exe
1080	ipconfig.exe
5688	ipconfig.exe
2252	ipconfig.exe
5344	ipconfig.exe
5360	ipconfig.exe
5060	ipconfig.exe
1664	ipconfig.exe
5392	ipconfig.exe
1456	ipconfig.exe
2616	ipconfig.exe
2788	ipconfig.exe
4180	ipconfig.exe
5860	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{F47F4C6F-1085-4698-AA0C-23E2EE6A2A8D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	aytqlidbvtnlgdyv.exe
4312	aytqlidbvtnlgdyv.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	aytqlidbvtnlgdyv.exe
4312	aytqlidbvtnlgdyv.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	aytqlidbvtnlgdyv.exe
4312	aytqlidbvtnlgdyv.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	aytqlidbvtnlgdyv.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	aytqlidbvtnlgdyv.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	aytqlidbvtnlgdyv.exe
1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	i_vtnlidavtn.exe
Token: SeDebugPrivilege	1220	i_nlfdqnicay.exe
Token: SeDebugPrivilege	4580	i_axvpnhfzxs.exe
Token: SeDebugPrivilege	4448	i_caurpjhfcx.exe
Token: SeDebugPrivilege	3388	i_pjheczuomh.exe
Token: SeDebugPrivilege	4092	i_gebztrljdb.exe
Token: SeDebugPrivilege	5564	i_jebztqomje.exe
Token: SeDebugPrivilege	476	i_ljdbvqolgd.exe
Token: SeDebugPrivilege	2116	i_sqkigayvtn.exe
Token: SeDebugPrivilege	3568	i_qdavsnlfdx.exe
Token: SeDebugPrivilege	6120	i_hfcavsnkfc.exe
Token: SeDebugPrivilege	204	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	3788	i_wupmhecwup.exe
Token: SeDebugPrivilege	5048	i_zwrpmzwuom.exe
Token: SeDebugPrivilege	1040	i_wuomgeywro.exe
Token: SeDebugPrivilege	5768	i_wtolgdbwto.exe
Token: SeDebugPrivilege	2788	i_qligdyvqoi.exe
Token: SeDebugPrivilege	1652	i_ayvqnlfdyv.exe
Token: SeDebugPrivilege	1068	i_sqkifdavsq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4312	1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1876 wrote to memory of 2504	1876	2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2504 wrote to memory of 1912	2504	iexplore.exe	90
PID 1912 wrote to memory of 3216	1912	msedge.exe	91
PID 1912 wrote to memory of 236	1912	msedge.exe	93
PID 1912 wrote to memory of 5040	1912	msedge.exe	94
PID 1912 wrote to memory of 5040	1912	msedge.exe	94
PID 1912 wrote to memory of 5040	1912	msedge.exe	94
PID 1912 wrote to memory of 2800	1912	msedge.exe	95
PID 1912 wrote to memory of 2800	1912	msedge.exe	95
PID 1912 wrote to memory of 3508	1912	msedge.exe	96
PID 1912 wrote to memory of 5228	1912	msedge.exe	97
PID 1912 wrote to memory of 3508	1912	msedge.exe	96
PID 1912 wrote to memory of 3508	1912	msedge.exe	96
PID 1912 wrote to memory of 5228	1912	msedge.exe	97
PID 1912 wrote to memory of 5228	1912	msedge.exe	97
PID 1912 wrote to memory of 4044	1912	msedge.exe	98
PID 1912 wrote to memory of 4044	1912	msedge.exe	98
PID 1912 wrote to memory of 4044	1912	msedge.exe	98
PID 1912 wrote to memory of 2560	1912	msedge.exe	99
PID 1912 wrote to memory of 2560	1912	msedge.exe	99
PID 1912 wrote to memory of 2560	1912	msedge.exe	99
PID 1912 wrote to memory of 1512	1912	msedge.exe	100
PID 1912 wrote to memory of 1512	1912	msedge.exe	100
PID 1912 wrote to memory of 1688	1912	msedge.exe	104
PID 1912 wrote to memory of 4544	1912	msedge.exe	105
PID 1912 wrote to memory of 1688	1912	msedge.exe	104
PID 1912 wrote to memory of 4544	1912	msedge.exe	105
PID 4312 wrote to memory of 624	4312	aytqlidbvtnlgdyv.exe	106
PID 4068 wrote to memory of 2864	4068	vtnlidavtn.exe	109
PID 1912 wrote to memory of 1264	1912	msedge.exe	113
PID 1912 wrote to memory of 1264	1912	msedge.exe	113
PID 1912 wrote to memory of 1264	1912	msedge.exe	113
PID 1912 wrote to memory of 1704	1912	msedge.exe	114
PID 1912 wrote to memory of 3324	1912	msedge.exe	115
PID 1912 wrote to memory of 3324	1912	msedge.exe	115
PID 1912 wrote to memory of 3552	1912	msedge.exe	117
PID 1912 wrote to memory of 3552	1912	msedge.exe	117
PID 1912 wrote to memory of 3552	1912	msedge.exe	117
PID 1912 wrote to memory of 4092	1912	msedge.exe	119
PID 1912 wrote to memory of 4092	1912	msedge.exe	119
PID 4312 wrote to memory of 4972	4312	aytqlidbvtnlgdyv.exe	121
PID 4312 wrote to memory of 5616	4312	aytqlidbvtnlgdyv.exe	125
PID 4232 wrote to memory of 3492	4232	nlfdqnicay.exe	127
PID 4312 wrote to memory of 1544	4312	aytqlidbvtnlgdyv.exe	130
PID 4312 wrote to memory of 964	4312	aytqlidbvtnlgdyv.exe	134
PID 456 wrote to memory of 2516	456	axvpnhfzxs.exe	136
PID 4312 wrote to memory of 1252	4312	aytqlidbvtnlgdyv.exe	139
PID 4312 wrote to memory of 2672	4312	aytqlidbvtnlgdyv.exe	144
PID 4224 wrote to memory of 708	4224	caurpjhfcx.exe	146
PID 4312 wrote to memory of 5340	4312	aytqlidbvtnlgdyv.exe	149
PID 1912 wrote to memory of 5376	1912	msedge.exe	151
PID 1912 wrote to memory of 4900	1912	msedge.exe	152
PID 1912 wrote to memory of 2328	1912	msedge.exe	153
PID 4312 wrote to memory of 5080	4312	aytqlidbvtnlgdyv.exe	156
PID 4524 wrote to memory of 4628	4524	pjheczuomh.exe	158
PID 4312 wrote to memory of 1976	4312	aytqlidbvtnlgdyv.exe	161
PID 4312 wrote to memory of 5152	4312	aytqlidbvtnlgdyv.exe	165
PID 4992 wrote to memory of 4580	4992	gebztrljdb.exe	167
PID 4312 wrote to memory of 2508	4312	aytqlidbvtnlgdyv.exe	170
PID 4312 wrote to memory of 1344	4312	aytqlidbvtnlgdyv.exe	174
PID 4116 wrote to memory of 3452	4116	jebztqomje.exe	176
PID 4312 wrote to memory of 4980	4312	aytqlidbvtnlgdyv.exe	179
PID 4312 wrote to memory of 4624	4312	aytqlidbvtnlgdyv.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_4f173271dbe48df73a91659792f06e03_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Temp\aytqlidbvtnlgdyv.exe
  C:\Temp\aytqlidbvtnlgdyv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:624
  - - C:\Temp\vtnlidavtn.exe
      C:\Temp\vtnlidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Temp\i_vtnlidavtn.exe
      C:\Temp\i_vtnlidavtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdqnicay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5616
  - - C:\Temp\nlfdqnicay.exe
      C:\Temp\nlfdqnicay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdqnicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1544
  - - C:\Temp\i_nlfdqnicay.exe
      C:\Temp\i_nlfdqnicay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:964
  - - C:\Temp\axvpnhfzxs.exe
      C:\Temp\axvpnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1252
  - - C:\Temp\i_axvpnhfzxs.exe
      C:\Temp\i_axvpnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caurpjhfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\caurpjhfcx.exe
      C:\Temp\caurpjhfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caurpjhfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\i_caurpjhfcx.exe
      C:\Temp\i_caurpjhfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjheczuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5080
  - - C:\Temp\pjheczuomh.exe
      C:\Temp\pjheczuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjheczuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1976
  - - C:\Temp\i_pjheczuomh.exe
      C:\Temp\i_pjheczuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\gebztrljdb.exe
      C:\Temp\gebztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2508
  - - C:\Temp\i_gebztrljdb.exe
      C:\Temp\i_gebztrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebztqomje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\jebztqomje.exe
      C:\Temp\jebztqomje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebztqomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\i_jebztqomje.exe
      C:\Temp\i_jebztqomje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvqolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4624
  - - C:\Temp\ljdbvqolgd.exe
      C:\Temp\ljdbvqolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvqolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1196
  - - C:\Temp\i_ljdbvqolgd.exe
      C:\Temp\i_ljdbvqolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkigayvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3884
  - - C:\Temp\sqkigayvtn.exe
      C:\Temp\sqkigayvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkigayvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1528
  - - C:\Temp\i_sqkigayvtn.exe
      C:\Temp\i_sqkigayvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qdavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\qdavsnlfdx.exe
      C:\Temp\qdavsnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qdavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2652
  - - C:\Temp\i_qdavsnlfdx.exe
      C:\Temp\i_qdavsnlfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcavsnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2324
  - - C:\Temp\hfcavsnkfc.exe
      C:\Temp\hfcavsnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcavsnkfc.exe ups_ins
    3⤵
    PID:916
  - - C:\Temp\i_hfcavsnkfc.exe
      C:\Temp\i_hfcavsnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    PID:2764
  - - C:\Temp\ausmkfcxvp.exe
      C:\Temp\ausmkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    PID:6064
  - - C:\Temp\i_ausmkfcxvp.exe
      C:\Temp\i_ausmkfcxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhecwup.exe ups_run
    3⤵
    PID:4160
  - - C:\Temp\wupmhecwup.exe
      C:\Temp\wupmhecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhecwup.exe ups_ins
    3⤵
    PID:5852
  - - C:\Temp\i_wupmhecwup.exe
      C:\Temp\i_wupmhecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpmzwuom.exe ups_run
    3⤵
    PID:3636
  - - C:\Temp\zwrpmzwuom.exe
      C:\Temp\zwrpmzwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpmzwuom.exe ups_ins
    3⤵
    PID:1564
  - - C:\Temp\i_zwrpmzwuom.exe
      C:\Temp\i_zwrpmzwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    PID:4380
  - - C:\Temp\wuomgeywro.exe
      C:\Temp\wuomgeywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    PID:4328
  - - C:\Temp\i_wuomgeywro.exe
      C:\Temp\i_wuomgeywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgdbwto.exe ups_run
    3⤵
    PID:204
  - - C:\Temp\wtolgdbwto.exe
      C:\Temp\wtolgdbwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgdbwto.exe ups_ins
    3⤵
    PID:4084
  - - C:\Temp\i_wtolgdbwto.exe
      C:\Temp\i_wtolgdbwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligdyvqoi.exe ups_run
    3⤵
    PID:5860
  - - C:\Temp\qligdyvqoi.exe
      C:\Temp\qligdyvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligdyvqoi.exe ups_ins
    3⤵
    PID:2316
  - - C:\Temp\i_qligdyvqoi.exe
      C:\Temp\i_qligdyvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnlfdyv.exe ups_run
    3⤵
    PID:932
  - - C:\Temp\ayvqnlfdyv.exe
      C:\Temp\ayvqnlfdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnlfdyv.exe ups_ins
    3⤵
    PID:4784
  - - C:\Temp\i_ayvqnlfdyv.exe
      C:\Temp\i_ayvqnlfdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkifdavsq.exe ups_run
    3⤵
    PID:4728
  - - C:\Temp\sqkifdavsq.exe
      C:\Temp\sqkifdavsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkifdavsq.exe ups_ins
    3⤵
    PID:4952
  - - C:\Temp\i_sqkifdavsq.exe
      C:\Temp\i_sqkifdavsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffdd3d0c188,0x7ffdd3d0c194,0x7ffdd3d0c1a0
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,13445967759952687329,2557157485167091918,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
      4⤵
      System Time Discovery
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,5411975308900203104,15697480607715734166,262144 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,17864460151479201459,7870342221765694937,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,1937132788013504711,12510513217075082547,2097152 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,8739669472247050925,16774758051976534993,2097152 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11605088413054841407,9182651782277439963,2097152 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,1377353121646522336,11562725269920617844,2097152 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:9
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,13163536329182977713,10614995197363110910,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,2891318191827835648,5489965485601464682,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,3217786401510368285,4327956606938658168,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,81919964878708893,9181217907252455181,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6124,i,1346720509606726191,1082570944573226038,2097152 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,81919964878708893,9181217907252455181,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,6249322599244222597,11340268025816481273,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6408,i,17348674382347847459,17962218611827606825,2097152 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,17321523763405638741,14912343262519095067,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,10297493591794249157,3446033633441510688,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,955257249112569351,11770390792552915439,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,5120148310179234456,9245084103376069059,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16406206329341458061,496490022215468462,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8579697082425161892,18430938126594357275,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,74322747822895123,9398429348083525209,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,10466976739490097681,14370631559624657702,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4544,i,13318477461031493195,10052059787960115552,262144 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:10
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,7587255838154210538,11962688492496231083,524288 --field-trial-handle=2436,i,9403018737979374034,3010949006746858790,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

C:\Temp\aytqlidbvtnlgdyv.sys
C:\Temp\aytqlidbvtnlgdyv.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2892

C:\Temp\vtnlfdxvpn.sys
C:\Temp\vtnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:2032

C:\Temp\fcxvsnkica.sys
C:\Temp\fcxvsnkica.sys
1⤵
- Executes dropped EXE
PID:5372

C:\Temp\zxupmkhczx.sys
C:\Temp\zxupmkhczx.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\mkeczurmjh.sys
C:\Temp\mkeczurmjh.sys
1⤵
- Executes dropped EXE
PID:2316

C:\Temp\omjhbztrmj.sys
C:\Temp\omjhbztrmj.sys
1⤵
- Executes dropped EXE
PID:2304

C:\Temp\ebztromgeb.sys
C:\Temp\ebztromgeb.sys
1⤵
- Executes dropped EXE
PID:3668

C:\Temp\ligaytqoig.sys
C:\Temp\ligaytqoig.sys
1⤵
- Executes dropped EXE
PID:2276

C:\Temp\gayolfdays.sys
C:\Temp\gayolfdays.sys
1⤵
- Executes dropped EXE
PID:2768

C:\Temp\nifdxvqnig.sys
C:\Temp\nifdxvqnig.sys
1⤵
- Executes dropped EXE
PID:2300

C:\Temp\fdavsnkifd.sys
C:\Temp\fdavsnkifd.sys
1⤵
- Executes dropped EXE
PID:4244

C:\Temp\cxupmkfcxv.sys
C:\Temp\cxupmkfcxv.sys
1⤵
PID:5232

C:\Temp\czxjhfcxuo.sys
C:\Temp\czxjhfcxuo.sys
1⤵
PID:4072

C:\Temp\ezxrojhezx.sys
C:\Temp\ezxrojhezx.sys
1⤵
PID:1080

C:\Temp\wurmjhezwr.sys
C:\Temp\wurmjhezwr.sys
1⤵
PID:5792

C:\Temp\bztqolgeyw.sys
C:\Temp\bztqolgeyw.sys
1⤵
PID:1900

C:\Temp\ytrljdbytq.sys
C:\Temp\ytrljdbytq.sys
1⤵
PID:5256

C:\Temp\yvtnlidbvt.sys
C:\Temp\yvtnlidbvt.sys
1⤵
PID:2960

C:\Temp\sqkicaxvpn.sys
C:\Temp\sqkicaxvpn.sys
1⤵
PID:5972

C:\Temp\xspkhfcaus.sys
C:\Temp\xspkhfcaus.sys
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvpnhfzxs.exe

Path C:\Temp\axvpnhfzxs.exe
Size 376KB
SHA256 9d233a4d6c275a71cc5dce35ec91d4474aeebbbe28e227481684ebdffe5e0d39
MD5 98cf2adcaa2ca90ac0905b585ee17d3b
SHA1 bf9a08966b8bebc5e2794b69bc3926e6099710ec
SHA512 94fbf8215f9847b3e85c257c9a3be1299aa955fad785cab4abf63b0862d12309bdd3592e88d244acdb257541f29f925356b8ac350857c8e2a9f4e7b0339824d7
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqlidbvtnlgdyv.exe

Path C:\Temp\aytqlidbvtnlgdyv.exe
Size 376KB
SHA256 2fb71faa0061e4e38a215c6c27449d240d929a8ae18530e7705b87c8dac0ebd8
MD5 4ef46f7edaea67d9002814f2720402d2
SHA1 61e33a69bbc3566cec23ff799fc6d4c716c3a2cb
SHA512 63bef608693d439a4b9c75bb7f1549ad629bd62925c3c97ee9b9138af77b25190b8c9d5823679010cf191a0d9bf309a566380a470a04fa3bfe7591f4b5ebc19e
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqlidbvtnlgdyv.sys

Path C:\Temp\aytqlidbvtnlgdyv.sys
Size 293KB
SHA256 323e5b008d2f0088813cedebbc900801738c8b273f7312b24f1d9530f234ea16
MD5 fae8709ae98600f942908734843b5b26
SHA1 0876abe9b5ad1fb472d767f52616a3d6fda3c7f8
SHA512 a5d0087b807912d9f5413f4b53a7d407c97d29997148ee46d829c5868b937de32b5619b60349efa0a21bc7cd73ecbe6bdf9cfac84e593d6b4f6d6f49e58ab3e7
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caurpjhfcx.exe

Path C:\Temp\caurpjhfcx.exe
Size 376KB
SHA256 992322163bcc4641f1bc348ec0877aa737bf44cc0c5113cb23a0ccf7c5943aec
MD5 e68a163de0def895d7b0fbd1c384f61d
SHA1 75f3750c90cb99e325a06b102c11d6e16ea6f7c3
SHA512 26a0dbdf868653b22ec5b0f056f94d9d891eef0a657a9c8dc225a600a05b28cb6858ac275897b1389be10c30043c7dc6f7202467254acd4d96cded4286261d2e
SSDEEP 3072:jFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T194847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvsnkica.sys

Path C:\Temp\fcxvsnkica.sys
Size 293KB
SHA256 34bfb5c50852a66944cb944ecea37e9e9faa1fd4d13e62876baa84e87ef2c3a2
MD5 59dd1d39420e60c5af15f8681bea7b2e
SHA1 37e067f7b2ec267986e5db787d05880308129248
SHA512 b2927e6f06b170d05af6523dd5cf6b95245de321e714a59ac33bb88617a3ce72568fa1a09fcd4d354f3a0242ce14153d4697ec4c552e0e453ab1762ca4c1eb10
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebztrljdb.exe

Path C:\Temp\gebztrljdb.exe
Size 376KB
SHA256 f540fc6c09db0f04a1eabf16be8d4141080bccb6f08daa94cfe1e413216f2975
MD5 2b6c270fc2212a39b890db3bd3461870
SHA1 73b022817a38e8d99ac6b6018c5b88324da275fd
SHA512 517bed8d791031a12f1b30f456a0d3538d96b6d4221d2f03e3fddbc3edae59fc839cf8d123c3df0e5452a379792e4cbe6616529201b388a05655b6e9b226013c
SSDEEP 3072:5FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvpnhfzxs.exe

Path C:\Temp\i_axvpnhfzxs.exe
Size 376KB
SHA256 fbaa4b4eec9d7969f6623a21c0f3f3f8307b3177ea974784e376fef22a2dbd43
MD5 ed21422994d736b475438f254c325eb1
SHA1 e85b04e1cb9b4c546ef9c23b929b49420b6d8574
SHA512 43e462906415b07b0369b804e28e3da0dfcc112e71d6afd731d27abb265d564fa994a24c0ba3e948a25e4b78e101be3ed3fbe203b617b544ed694ff419b5e494
SSDEEP 3072:ZFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caurpjhfcx.exe

Path C:\Temp\i_caurpjhfcx.exe
Size 376KB
SHA256 ec89eca8a9ceff34907ce77679643d17358282a53db9db1e2d6ee8c81e499cb8
MD5 edadcd7fd2b5c401e2a218474397405f
SHA1 4486073dfee5a4b9e1029689c46fcf932b7b66be
SHA512 e54cdd8176d27ea3b72cf57a68cee4c9b5dfa98cb86d518077b5508c19c44ae95943aa2a6e1f6e6a82de3e614f2aa3c10d2772f55830efbb282ac29fa4225e15
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdqnicay.exe

Path C:\Temp\i_nlfdqnicay.exe
Size 376KB
SHA256 d815edefacb251454e3e656f8146e21a1535aeb7e3a2e4080343c3971a082d6b
MD5 ba66b62114c76f7a62a7a57db44a06ff
SHA1 0fc893b7017030da164acbcbfecbf7194d68ae55
SHA512 4120656e226eda4de909566fb61eaecd7d163445dd4ecd55b705c134eb8348fe470b15686f5d79648bdb9c5ee3c742b24f85b693f021fdfd3930304ee2784c24
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjheczuomh.exe

Path C:\Temp\i_pjheczuomh.exe
Size 376KB
SHA256 09ebf71b82db8defb52825723b8265359f168ffade223e5e9e28a8f951266bd4
MD5 d101c8d0267d45020cdf67699ef95838
SHA1 5728b940daef0b7d5ca1ce38f2f8a425bb0659ee
SHA512 bfa9ce9bd19ffae4f76e17240c0513d0432b08a4646da1385a806e0f61abbcd3124acfef152d40016011e51410e907091797262678826e62d1c4d0807f5ab017
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T120847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlidavtn.exe

Path C:\Temp\i_vtnlidavtn.exe
Size 376KB
SHA256 c8545eea7c200cfb7e6a4842097f237c681628a952996e78c1691ef550b98c13
MD5 2062145ba047b06c4da7d4043ebd4260
SHA1 b973d4a95ee19ed1fe158d19d99df5c7b3cc1439
SHA512 ab7ab3a48c06f503e3d1f87799e8fde75483c751a35844ec804bac46e1d96fd882c690064c44b1f4e9d1602b9b28b7cc1d7fcc5f4d6250dfc18f542c7fc2877f
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkeczurmjh.sys

Path C:\Temp\mkeczurmjh.sys
Size 293KB
SHA256 4a4990bdde6d541407637ad3dcaea32a2cdf865bc8d1d16e0f17690f7f550c3e
MD5 4adb6b10274c706d5883d5549096738b
SHA1 64145deddd75a6f1e5088e34b6f7f9eb1088f690
SHA512 f0b0375206387cd42e8d7c228219f0d69712b96410412a91371312fe1bd6dc899694f308fba635a59c409d4fb39ef2146a3e48bcde8a5e7830eea45dc55c43d8
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T187545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdqnicay.exe

Path C:\Temp\nlfdqnicay.exe
Size 376KB
SHA256 d5af8835c1460d5bf46a1818638833a9f1fdd3e2306c1fe91c7643fb3dbb16b3
MD5 e89e6fef6e5dd049f512e9b7ec1b335b
SHA1 8a3ca7977a4818e5c643ea93358f5a4025b3d413
SHA512 b49651af4e651b2d6c04b2a927f973da5598bdcb1a292ac813ee637d2b7cf02fd3ebe57e74808cee238bceeb961f2781b807427996d841ca77794b045ce3ba8c
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T120847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjhbztrmj.sys

Path C:\Temp\omjhbztrmj.sys
Size 293KB
SHA256 3107a39228d240b70b325864c5e72314fa16b1e01ee1edcdbd17a4da914b3e82
MD5 0d14870360c7e3fbdf957ec48739ce90
SHA1 8b5c319f1c32b7edb9d0317e4cf424b39bdf2dd9
SHA512 f75df3643f4041465815081555d911512c561681c671abdb3ef62f460161de30b5152feda97421d0e70755cd271cbe5efcd3cab702daf52564cecd068e2e2e64
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjheczuomh.exe

Path C:\Temp\pjheczuomh.exe
Size 376KB
SHA256 80b0e77bcd561a3ad3d691eeec4f31bc8819964bc1d16146b865fc39e22ff5e5
MD5 8572d426466a119c558af3ea0b809538
SHA1 ed9a6a54d256eb2aa74350694d619ca8102cd0e1
SHA512 9134a0507abf2ac3e9d6d4b75d7cd516db527bf29ed276e36ce3ead731027eb64a958d9142a8ee26e93b8a5dd2bbb82938127ae171495e03b20d626efe1a7b4d
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvpn.sys

Path C:\Temp\vtnlfdxvpn.sys
Size 293KB
SHA256 93b86322b411de8d0460f78840b696fec91321128c12dce8aef2ab7c570cda65
MD5 1a1bada8a6944a44bcbcde51230cfac2
SHA1 c10bfad096b5ca3482b019725a4b8f798f00a44f
SHA512 ff47290b227b892869cfdebcc06d3c56036d35a5870efee1ef76968c5edf3214f0b05f3b54aecef9d41ecf6426d225edb209aa9acff166a443c1f2fe42405902
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlidavtn.exe

Path C:\Temp\vtnlidavtn.exe
Size 376KB
SHA256 dd9a06fb15395d137803f1e334501e2bfd3d8a6081bcf31d40c34b34f2560d2b
MD5 0791dccc4d8f2c8776c854b9837e0d4b
SHA1 9905a4d1b7f0115557ab0eb1cd19f4b099e00b30
SHA512 46d846a4a1652df86efee6f166df81a4328510c17be515b39eced364897693cb95aafd23ea8f71c593a5c4a8c2343e26904f24760b8d022cedd6f39b5b0c06d2
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T108847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmkhczx.sys

Path C:\Temp\zxupmkhczx.sys
Size 293KB
SHA256 bea5b596f0dc6e8856f0397d296be26ee87e965e86e77a7634763da47b54a01e
MD5 f8123c0d9a39f15fca9995c68cbf02a8
SHA1 37540768a0ec6d504289eb294034e20d66774026
SHA512 afd4af7986f6e2ff116fae955e1aa416550f013b784534760b0f495d4f4bd7212d02e0d579151209dd1042fb6eb99f0b630652727755501ca0f416c9df605f72
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 19d65017d70fefa309790fcb6727eada0978b188c38948e44566833d6033a119
MD5 0497bf8c811b65237bd1564fb18fad25
SHA1 a02ea6694360313a5a63b8cc513c5315506ba2e8
SHA512 a7dfd1042f1cc949e184b52a41f117f7f03f9761872710a403270d001b3abcf857d18330099c020bcef7d3d91d1987aa9ba8b5d48794cdebfdadfb9bf8d7a3f4
TLSH
T1E951728346A05060EFBF4BF285D5D5873F7C88B059AF2E521EA5D3B89BC6F97D108008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f468.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f468.TMP
Size 2KB
SHA256 d51622b33a7331c053ad9fcbc5b3a658a97058f4efdb3c1c7f779d286b0adc35
MD5 c41d15eb03ae00f3aaf9ece9d2659205
SHA1 bc0b5a0ed37f593eef6faaf22b56752754c3afd1
SHA512 43bdc18659ec4d1cd537de474298b5f994d9784cc568c3c307f534ec068ccaac863c83cad14bb79650ef999cbd9f5362c02af0e9fcce915708de42075b0e90ca
TLSH
T19651748346A05060EFBF4BF285D5D5873F7C88B059AF2E521DA5D3B89BC6F97D108008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b91d3ac57c2c94f5e52e06c0e99070880c69d131260f91b1b8a6ab1141bae744
MD5 6184627e4ac2847059580f8593929b5d
SHA1 b3f422f23ccf991109f49bf4839a57d50b0778fd
SHA512 4da8978d3fe3c2bae7249680e4cdb6180550c7f453cb8ff979bbee46ce839c00511097f9e538280aa0ad5805b43ab1c14c70463b5f8ff94885d8975f7835d018
TLSH
T14F51CDF3C3E8866D890156F4AB186E2BCE1D0954832C7D5AC8E4EF1B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 55f0d5b988d9b0d64646ea4f3bf0cf519da47058cfd95bad9b29c49f1a5a5979
MD5 630262605803afdb8d2dde7e076e035b
SHA1 6d9f1a44a339645868a0cbc9fb60784448f632a9
SHA512 e3ec935fc1d7b34fcae51e874301bb911f14f763ba944d5ab5a7c49c9203c0d063c6797c2ce635a413e5f17938dc5f511eda896888a6840b6767caa3e418785c
SSDEEP 192:sxRFRPCyv/fsZs1hnhZonIwzoA8p9Q/g6+WNCzg/Y2RcK+GvMIgVCJ:sxRFAa/fsZs1hnvzK/5t/0KtQA
TLSH
T1AA42D859AD28A97B4CC7D21DFB657F53E2F91032A1C11E48E6FC8A1C14E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7368d42d10eb19c6b6f8e861addd65d5c62d858271e4561100123ef9db9e8f62
MD5 536f4f77d17c80a352c5a076531f17fe
SHA1 060000eae5722e714f392a8d5e3d5f3720c7d8de
SHA512 9e12ba14ead2126576bb232f054d7ff8906ac25d1afe4c6edfaad69847824f2bc5bf748d558fe5b51427be3ea45fa77c74870d2d58dcff13608be1b48e96f838
SSDEEP 192:sxRKRPCyv/fsZsqhnhZonIwzoA8p9Q/g6+WNCzg/Y2RcK+GvMIgDhCJ:sxRKAa/fsZsqhnvzK/5t/0KtQo
TLSH
T1DD42C759AD68A97B4CC7D21DFB65BF53E2F91032A0C11E48E6FC8A1C14E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e5b309b6f7d6418d644ca67ac394a53ba1fbd15e0bdc0c97bef96fff7168d713
MD5 8d4e7f3d79ee6cec0cc9724eae9fa3ec
SHA1 0e061914d2f43d261219cbb079cc3778fc1e45a1
SHA512 d9721693ec3fff6338a242f4e4859a94f2594f9c01c867461c7e78dd354d7a7eedeea369993b30761615bbc9c54ef1d2e5a592e9fbc76a99011880e7cd412c5a
SSDEEP 192:sxRKRPCyv/fsZsqVnhZonIwzoA8p9Q/g6+WNCzg/Y2ScK+GvMIgDLCJ:sxRKAa/fsZsqVnvzK/5t/NKtQO
TLSH
T15142D859AD68A97B4CC7D21DFB657F53E2F91032A0C11E48E6FC8A1C14E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9ec2c53cb4fab1c7a77e8a044ab507ccfdfa616b87622aa9dcfaa9480cef5016
MD5 26df43b4e3dae2086e5146750efab136
SHA1 b463f869606d8c7c12398f5b60c1c449bb935cf5
SHA512 3268aa9fa725df1f6fcd20a7242c3d12a5da0491dc5fb7544944739713097d31c65b96a6984ca50757f87ee49255d8222ffecc80b1031d67ca0e25f33c94df8e
SSDEEP 768:L7aaSW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTAFdNMVroHG:L7aaS2Eb6DWgptfvDu1jawAFrMum
TLSH
T1F6D2DB7B640CCB7F4F904ADDEC197E9F6D6802CB9698CD4047FA941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63e23f36-8153-40a0-bfa5-34f27f172eb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\63e23f36-8153-40a0-bfa5-34f27f172eb0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5e24d908d867c8135f5e3b6dd734b773888d847aa31ec328cbd2129bbc2db063
MD5 a30d0becdd0f87b8bc104c4a2c0e1d20
SHA1 788551a1f339f7110ad64a7d5a98dbdf75099ff1
SHA512 c6b4c95e73ff24526208106e5a76793e322f5e8daac4a9d6c18d35d96174b49d93df3731c98b8e949488ce1bd0a67a0f7b93dccab9485c1367fd07543c0234a0
SSDEEP 768:U/UxvxjgC+B3iqKfgm1d/tDmGA5b65Q92RQMPb4Fj0O:BZj3+B3jU3AF65dQjFQO
TLSH
T1B003C036EC94AEB39CF95280374BA35AAFF94473C1C851E049F96E0D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89e16cf534e837becfddb740204446c003fc461b1ffeb4e8da4942e435ecb564
MD5 7e648e0df3a6e8251a0578a527a25a26
SHA1 5ac53261c0b29772d0d635be8195f76139ac6142
SHA512 c1278cbb33497eaf565b12d3fb4a18ffd441e87af0f285ad4da087816e7fd7e3a5bdf9dc00aea15bd4e7f7e95e7fcbaa6d7c33cc9cb883ba921149a44bfe79be
SSDEEP 768:bA33Y7gm1dPZsSSDmGA5b65Q92RQMPbuRs5d8:bA336yAF65dQ5Rsb8
TLSH
T1A9F2BE71ECA5DEB36CFDA1817646B3467FF84173C4C98694A5E56F0D048368E031B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c7e38937061c587fee611cc07e986d50a83b7a06d09e2596cc3c3ce7b2d52a14
MD5 ab227fb3d78b7b17737fc164bb05e076
SHA1 084c0bd15d4eed548188535c4113b6d9c81b2e59
SHA512 8118378e8689843c014b0b102d49a9cf564a14f0d5828ce4ca2f62accaf9e3bc49009f04e030a4c311fafb0eaf2538ef1437716f4fffce67290b1f81cd8d352c
SSDEEP 768:KA3cI7gm1dPZsSUDmGA5b65Q92RQMPbuRs5d8:KA3cq8AF65dQ5Rsb8
TLSH
T1B1F2BE71ECA4DEB36CFDA1817687B3567FB84177C4C98694A4E56B0D0483ACE031B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 20d5342189ae346693eb43c8cc32bac6e47f5aff5981965cd4c9e742cca56fa1
MD5 53936dc01c66e5a2872e393e75fd39c7
SHA1 1b9074296fc3e8e3a366e015404b58ca5ef67c73
SHA512 c3c7c4c9438673cc703d89e1d42b601d579f9c2f61d0a961b45dcbec2a32e66ce9a91f2a15995482ab650b106d893bd9e70c2a5cc8bdafae8597b225c61d8624
SSDEEP 768:ZA3IY7gm1dPZsSSDmGA5b65Q92RQMPbuRs5d8:ZA3I6yAF65dQ5Rsb8
TLSH
T1D0F2BE71ECA5DEB36CFDA1817646B3467FF84573C4C98694A5E96B0D048368E031B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 c283a87bc55430feaad7d3dda821fa9a4a4e99ec840065f3fa3ff022b0cd227c
MD5 cd1c345ba05fd0635cbe8d0434277358
SHA1 6c02a935d04e0cb2275e11b09ce7cb9ede9ec28b
SHA512 3a4f4dfdfdba8b41e136fa33661641d26072b875f6471b1d1635de6ddddab7b429ff3b2410df44c316472ce62fd42cbeb8466e458190384cbf69832654b153ca
SSDEEP 768:AFHr3Uwg6Y4He1dPZsDDmGA5b65Q92RQMPbuRs5d8:Qr31JAF65dQ5Rsb8
TLSH
T1831306F298D3CA77E8AD5783677D6E45AEBCC163B4888590B7D55D0CCC821BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b1e051d7cb0952914a68b98c75eaef59cb007f4f9c06715dcd00728cf03da711
MD5 6e5b4db7a9fa7403d07d5031c9d0c4b9
SHA1 b7045182c401df9ecc810ffaa951268f89a54cce
SHA512 a4f61ede04b43acbbf85f97f6ed0bf5e6e6d00fb6c3eb88be711dbdfba263e8cc8287301516a7ddae2aba93982dd8692ae31724284c5ca000ab1a24e7dc3f534
SSDEEP 768:KA3IW7gm1dPZsSoDmGA5b65Q92RQMPbuRs5d8:KA3IwIAF65dQ5Rsb8
TLSH
T154F2BE72ECA4DEB36CFDA1817646B3467FF84173C4C98694A4E56B0D0483A8E031B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

6af3f15c-ab9d-4619-82dd-d78ebda7acef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6af3f15c-ab9d-4619-82dd-d78ebda7acef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1912_1363271556\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 bf5311d7198ed2728d737b131ab541a359a80a5542670f3b473df74b225caeb6
MD5 24d035a54c417f8b3d6655679fc49029
SHA1 10f85f66ebf0dddd75ece77bd1b4074d3083826a
SHA512 d5bf65ea2c5269e603c72b4500f0acfe4acb8a3df6eaeaf74b93af318a8462ac053c68832836b074ff15ff6c62779ecfa25320513e5cb7bb61e2dfad7db05648
TLSH
T11B71008356A8D6F2D69E5FF002839244F2BB22380B7370200B91568AAA30A7A54B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1900-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2032-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2276-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2300-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2300-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2304-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2304-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2316-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2768-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2960-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3668-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3788-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4072-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5232-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5372-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5792-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download