systex | 63fa9c880e259f5d0de5fb8b8e4ac1ecf041f46f308b2ff1a613ace9e1e865dd

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260702-2b5lcsfx3y
SHA256 63fa9c880e259f5d0de5fb8b8e4ac1ecf041f46f308b2ff1a613ace9e1e865dd
MD5 e445e99fb71463130b145727c8b0fc3f
SHA1 15061d5453003776ebd5ba39da7cc1aef22081ca
SHA512 c3b37f54d87d23e26ee6e213c8e95509f2a06cc0bc734e74fb9c43914bd24a993caf1c64f8ed73ec08cfa11891ed9f054af49b2a3155ecf1c680538710d6b94b
SSDEEP 3072:NFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5696	qojdtoigaysqlidb.exe
3312	qojdtoigaysqlidb.sys
6608	CreateProcess.exe
2288	nlfdyvtlia.exe
872	CreateProcess.exe
1996	CreateProcess.exe
2496	i_nlfdyvtlia.exe
1852	nlfdxvsqli.sys
1300	CreateProcess.exe
2128	kigaysqlid.exe
6192	CreateProcess.exe
6524	CreateProcess.exe
1968	i_kigaysqlid.exe
1280	kfdxvpnhfa.sys
2744	CreateProcess.exe
1196	fdxsqkicav.exe
2292	CreateProcess.exe
5860	CreateProcess.exe
716	i_fdxsqkicav.exe
1048	icausmkica.sys
3144	CreateProcess.exe
5648	kfcxupmkhf.exe
3640	CreateProcess.exe
2808	CreateProcess.exe
5904	i_kfcxupmkhf.exe
6656	usmkhfzxup.sys
6480	CreateProcess.exe
7064	mjhfzxrpjh.exe
5420	CreateProcess.exe
508	CreateProcess.exe
5004	i_mjhfzxrpjh.exe
6092	bzurmkecwu.sys
1296	CreateProcess.exe
6260	bzxrpkhbzu.exe
2624	CreateProcess.exe
4164	CreateProcess.exe
2524	i_bzxrpkhbzu.exe
1108	rpjecwurmj.sys
5876	CreateProcess.exe
5108	rpjhbztrmj.exe
4928	CreateProcess.exe
5292	CreateProcess.exe
2560	i_rpjhbztrmj.exe
2032	trojgebwtr.sys
2568	CreateProcess.exe
3228	troigeywtr.exe
5592	CreateProcess.exe
4528	CreateProcess.exe
2736	i_troigeywtr.exe
1476	rljgeywqoi.sys
5136	CreateProcess.exe
3060	dyvqoigayt.exe
1404	CreateProcess.exe
6904	CreateProcess.exe
4912	i_dyvqoigayt.exe
5200	lfdyvqoigd.sys
3112	CreateProcess.exe
3876	dbvtqlidbv.exe
1232	CreateProcess.exe
4752	CreateProcess.exe
5704	i_dbvtqlidbv.exe
4576	fdxvsnlfda.sys
3548	CreateProcess.exe
4280	aysqkidavt.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1511044701\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_230237397\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1028947463\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1511044701\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_230237397\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1028947463\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1028947463\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1028947463\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1028947463\v1FieldTypes.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_troigeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxupmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcaxspf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpkhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcaxspf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvtlia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxupmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	troigeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvtlia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpkhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojdtoigaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3880	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3032	ipconfig.exe
6880	ipconfig.exe
2652	ipconfig.exe
5240	ipconfig.exe
5556	ipconfig.exe
788	ipconfig.exe
6408	ipconfig.exe
1700	ipconfig.exe
6648	ipconfig.exe
1980	ipconfig.exe
6436	ipconfig.exe
6316	ipconfig.exe
3104	ipconfig.exe
2872	ipconfig.exe
5496	ipconfig.exe
5316	ipconfig.exe
6776	ipconfig.exe
2488	ipconfig.exe
5296	ipconfig.exe
5448	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275047389930601"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{B12404C2-78C7-4200-8628-0EF7DEE32417}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe
5696	qojdtoigaysqlidb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	i_nlfdyvtlia.exe
Token: SeDebugPrivilege	1968	i_kigaysqlid.exe
Token: SeDebugPrivilege	716	i_fdxsqkicav.exe
Token: SeDebugPrivilege	5904	i_kfcxupmkhf.exe
Token: SeDebugPrivilege	5004	i_mjhfzxrpjh.exe
Token: SeDebugPrivilege	2524	i_bzxrpkhbzu.exe
Token: SeDebugPrivilege	2560	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	2736	i_troigeywtr.exe
Token: SeDebugPrivilege	4912	i_dyvqoigayt.exe
Token: SeDebugPrivilege	5704	i_dbvtqlidbv.exe
Token: SeDebugPrivilege	5816	i_aysqkidavt.exe
Token: SeDebugPrivilege	6460	i_xvpnhfzxvp.exe
Token: SeDebugPrivilege	5340	i_pnkfcaxspf.exe
Token: SeDebugPrivilege	5840	i_ausmkeczus.exe
Token: SeDebugPrivilege	2780	i_jhbztrmjec.exe
Token: SeDebugPrivilege	1068	i_trojgebwtr.exe
Token: SeDebugPrivilege	4572	i_romgebwtom.exe
Token: SeDebugPrivilege	2816	i_aytqljdbvt.exe
Token: SeDebugPrivilege	6668	i_yvqoigayvq.exe
Token: SeDebugPrivilege	2928	i_xvsnkfdxvp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 5696	5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5652 wrote to memory of 5888	5652	2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5888 wrote to memory of 4424	5888	iexplore.exe	91
PID 4424 wrote to memory of 2936	4424	msedge.exe	92
PID 4424 wrote to memory of 1760	4424	msedge.exe	93
PID 4424 wrote to memory of 3880	4424	msedge.exe	94
PID 4424 wrote to memory of 1760	4424	msedge.exe	93
PID 4424 wrote to memory of 1760	4424	msedge.exe	93
PID 4424 wrote to memory of 676	4424	msedge.exe	95
PID 4424 wrote to memory of 676	4424	msedge.exe	95
PID 4424 wrote to memory of 6400	4424	msedge.exe	97
PID 4424 wrote to memory of 6672	4424	msedge.exe	98
PID 4424 wrote to memory of 6400	4424	msedge.exe	97
PID 4424 wrote to memory of 6400	4424	msedge.exe	97
PID 4424 wrote to memory of 6672	4424	msedge.exe	98
PID 4424 wrote to memory of 6672	4424	msedge.exe	98
PID 4424 wrote to memory of 1832	4424	msedge.exe	99
PID 4424 wrote to memory of 1832	4424	msedge.exe	99
PID 4424 wrote to memory of 1832	4424	msedge.exe	99
PID 4424 wrote to memory of 5508	4424	msedge.exe	100
PID 4424 wrote to memory of 5508	4424	msedge.exe	100
PID 4424 wrote to memory of 5508	4424	msedge.exe	100
PID 4424 wrote to memory of 3004	4424	msedge.exe	104
PID 4424 wrote to memory of 1588	4424	msedge.exe	105
PID 4424 wrote to memory of 1588	4424	msedge.exe	105
PID 4424 wrote to memory of 1276	4424	msedge.exe	106
PID 4424 wrote to memory of 1276	4424	msedge.exe	106
PID 5696 wrote to memory of 6608	5696	qojdtoigaysqlidb.exe	107
PID 2288 wrote to memory of 872	2288	nlfdyvtlia.exe	110
PID 5696 wrote to memory of 1996	5696	qojdtoigaysqlidb.exe	115
PID 4424 wrote to memory of 1576	4424	msedge.exe	117
PID 4424 wrote to memory of 1576	4424	msedge.exe	117
PID 4424 wrote to memory of 1576	4424	msedge.exe	117
PID 5696 wrote to memory of 1300	5696	qojdtoigaysqlidb.exe	120
PID 2128 wrote to memory of 6192	2128	kigaysqlid.exe	122
PID 5696 wrote to memory of 6524	5696	qojdtoigaysqlidb.exe	125
PID 5696 wrote to memory of 2744	5696	qojdtoigaysqlidb.exe	129
PID 1196 wrote to memory of 2292	1196	fdxsqkicav.exe	131
PID 5696 wrote to memory of 5860	5696	qojdtoigaysqlidb.exe	134
PID 5696 wrote to memory of 3144	5696	qojdtoigaysqlidb.exe	138
PID 5648 wrote to memory of 3640	5648	kfcxupmkhf.exe	140
PID 5696 wrote to memory of 2808	5696	qojdtoigaysqlidb.exe	144
PID 4424 wrote to memory of 5940	4424	msedge.exe	146
PID 4424 wrote to memory of 2700	4424	msedge.exe	147
PID 4424 wrote to memory of 5924	4424	msedge.exe	148
PID 5696 wrote to memory of 6480	5696	qojdtoigaysqlidb.exe	151
PID 7064 wrote to memory of 5420	7064	mjhfzxrpjh.exe	153
PID 5696 wrote to memory of 508	5696	qojdtoigaysqlidb.exe	156
PID 5696 wrote to memory of 1296	5696	qojdtoigaysqlidb.exe	160
PID 6260 wrote to memory of 2624	6260	bzxrpkhbzu.exe	162
PID 5696 wrote to memory of 4164	5696	qojdtoigaysqlidb.exe	165
PID 5696 wrote to memory of 5876	5696	qojdtoigaysqlidb.exe	169
PID 5108 wrote to memory of 4928	5108	rpjhbztrmj.exe	171
PID 5696 wrote to memory of 5292	5696	qojdtoigaysqlidb.exe	174
PID 5696 wrote to memory of 2568	5696	qojdtoigaysqlidb.exe	178
PID 3228 wrote to memory of 5592	3228	troigeywtr.exe	180
PID 5696 wrote to memory of 4528	5696	qojdtoigaysqlidb.exe	183
PID 4424 wrote to memory of 7120	4424	msedge.exe	187
PID 4424 wrote to memory of 7120	4424	msedge.exe	187
PID 5696 wrote to memory of 5136	5696	qojdtoigaysqlidb.exe	190
PID 3060 wrote to memory of 1404	3060	dyvqoigayt.exe	192
PID 5696 wrote to memory of 6904	5696	qojdtoigaysqlidb.exe	195
PID 5696 wrote to memory of 3112	5696	qojdtoigaysqlidb.exe	199
PID 3876 wrote to memory of 1232	3876	dbvtqlidbv.exe	201

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e445e99fb71463130b145727c8b0fc3f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Temp\qojdtoigaysqlidb.exe
  C:\Temp\qojdtoigaysqlidb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdyvtlia.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6608
  - - C:\Temp\nlfdyvtlia.exe
      C:\Temp\nlfdyvtlia.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdyvtlia.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Temp\i_nlfdyvtlia.exe
      C:\Temp\i_nlfdyvtlia.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Temp\kigaysqlid.exe
      C:\Temp\kigaysqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6524
  - - C:\Temp\i_kigaysqlid.exe
      C:\Temp\i_kigaysqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxsqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2744
  - - C:\Temp\fdxsqkicav.exe
      C:\Temp\fdxsqkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxsqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5860
  - - C:\Temp\i_fdxsqkicav.exe
      C:\Temp\i_fdxsqkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxupmkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Temp\kfcxupmkhf.exe
      C:\Temp\kfcxupmkhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxupmkhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2808
  - - C:\Temp\i_kfcxupmkhf.exe
      C:\Temp\i_kfcxupmkhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6480
  - - C:\Temp\mjhfzxrpjh.exe
      C:\Temp\mjhfzxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:508
  - - C:\Temp\i_mjhfzxrpjh.exe
      C:\Temp\i_mjhfzxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxrpkhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Temp\bzxrpkhbzu.exe
      C:\Temp\bzxrpkhbzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxrpkhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4164
  - - C:\Temp\i_bzxrpkhbzu.exe
      C:\Temp\i_bzxrpkhbzu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5876
  - - C:\Temp\rpjhbztrmj.exe
      C:\Temp\rpjhbztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5292
  - - C:\Temp\i_rpjhbztrmj.exe
      C:\Temp\i_rpjhbztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\troigeywtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2568
  - - C:\Temp\troigeywtr.exe
      C:\Temp\troigeywtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_troigeywtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4528
  - - C:\Temp\i_troigeywtr.exe
      C:\Temp\i_troigeywtr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5136
  - - C:\Temp\dyvqoigayt.exe
      C:\Temp\dyvqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6904
  - - C:\Temp\i_dyvqoigayt.exe
      C:\Temp\i_dyvqoigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3112
  - - C:\Temp\dbvtqlidbv.exe
      C:\Temp\dbvtqlidbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4752
  - - C:\Temp\i_dbvtqlidbv.exe
      C:\Temp\i_dbvtqlidbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3548
  - - C:\Temp\aysqkidavt.exe
      C:\Temp\aysqkidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    PID:5496
  - - C:\Temp\i_aysqkidavt.exe
      C:\Temp\i_aysqkidavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfzxvp.exe ups_run
    3⤵
    PID:6180
  - - C:\Temp\xvpnhfzxvp.exe
      C:\Temp\xvpnhfzxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzxvp.exe ups_ins
    3⤵
    PID:5232
  - - C:\Temp\i_xvpnhfzxvp.exe
      C:\Temp\i_xvpnhfzxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcaxspf.exe ups_run
    3⤵
    PID:5740
  - - C:\Temp\pnkfcaxspf.exe
      C:\Temp\pnkfcaxspf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcaxspf.exe ups_ins
    3⤵
    PID:5680
  - - C:\Temp\i_pnkfcaxspf.exe
      C:\Temp\i_pnkfcaxspf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkeczus.exe ups_run
    3⤵
    PID:2384
  - - C:\Temp\ausmkeczus.exe
      C:\Temp\ausmkeczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkeczus.exe ups_ins
    3⤵
    PID:3324
  - - C:\Temp\i_ausmkeczus.exe
      C:\Temp\i_ausmkeczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    PID:3232
  - - C:\Temp\jhbztrmjec.exe
      C:\Temp\jhbztrmjec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    PID:3748
  - - C:\Temp\i_jhbztrmjec.exe
      C:\Temp\i_jhbztrmjec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trojgebwtr.exe ups_run
    3⤵
    PID:5020
  - - C:\Temp\trojgebwtr.exe
      C:\Temp\trojgebwtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trojgebwtr.exe ups_ins
    3⤵
    PID:6644
  - - C:\Temp\i_trojgebwtr.exe
      C:\Temp\i_trojgebwtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebwtom.exe ups_run
    3⤵
    PID:3600
  - - C:\Temp\romgebwtom.exe
      C:\Temp\romgebwtom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebwtom.exe ups_ins
    3⤵
    PID:5024
  - - C:\Temp\i_romgebwtom.exe
      C:\Temp\i_romgebwtom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    PID:3968
  - - C:\Temp\aytqljdbvt.exe
      C:\Temp\aytqljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    PID:2964
  - - C:\Temp\i_aytqljdbvt.exe
      C:\Temp\i_aytqljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigayvq.exe ups_run
    3⤵
    PID:1944
  - - C:\Temp\yvqoigayvq.exe
      C:\Temp\yvqoigayvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigayvq.exe ups_ins
    3⤵
    PID:5240
  - - C:\Temp\i_yvqoigayvq.exe
      C:\Temp\i_yvqoigayvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnkfdxvp.exe ups_run
    3⤵
    PID:1304
  - - C:\Temp\xvsnkfdxvp.exe
      C:\Temp\xvsnkfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnkfdxvp.exe ups_ins
    3⤵
    PID:5400
  - - C:\Temp\i_xvsnkfdxvp.exe
      C:\Temp\i_xvsnkfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9256bc188,0x7ff9256bc194,0x7ff9256bc1a0
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,12071306403736130364,11641992217787737895,262144 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,17013605256961190341,9535862535802536113,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
      4⤵
      System Time Discovery
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,1674647368004652218,12880755720601334949,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
      4⤵
      PID:676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,2226588247423549754,8571669814674006790,2097152 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,17446329767163288417,6297344618020536973,2097152 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5052,i,9849549749300013980,9058873563482904134,2097152 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3904,i,8695340704281017400,13279423580810732524,2097152 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1135502883694332843,994471980375571500,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1135502883694332843,994471980375571500,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14201603174465450100,3604793790386297693,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,8719086698081412211,5753361243766390369,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6384,i,9509558556872441558,10499416774772501987,2097152 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,13999744010303659297,7276954968137913239,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16874926458436997221,5702643074175632025,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,1586052360025854614,2406641968880727202,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,18018218997072533698,11706924415004039003,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,16709659307138342413,14500319305696135616,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,1658067647734343606,8019980734417052072,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3824,i,3012650522957745078,9047114883997943325,262144 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:10
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6470207560375350982,13197006824154703944,524288 --field-trial-handle=2392,i,10976522254391512554,15883527012821731917,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:14
      4⤵
      PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:632

C:\Temp\qojdtoigaysqlidb.sys
C:\Temp\qojdtoigaysqlidb.sys
1⤵
- Executes dropped EXE
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:352

C:\Temp\nlfdxvsqli.sys
C:\Temp\nlfdxvsqli.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:1280

C:\Temp\icausmkica.sys
C:\Temp\icausmkica.sys
1⤵
- Executes dropped EXE
PID:1048

C:\Temp\usmkhfzxup.sys
C:\Temp\usmkhfzxup.sys
1⤵
- Executes dropped EXE
PID:6656

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:6092

C:\Temp\rpjecwurmj.sys
C:\Temp\rpjecwurmj.sys
1⤵
- Executes dropped EXE
PID:1108

C:\Temp\trojgebwtr.sys
C:\Temp\trojgebwtr.sys
1⤵
- Executes dropped EXE
PID:2032

C:\Temp\rljgeywqoi.sys
C:\Temp\rljgeywqoi.sys
1⤵
- Executes dropped EXE
PID:1476

C:\Temp\lfdyvqoigd.sys
C:\Temp\lfdyvqoigd.sys
1⤵
- Executes dropped EXE
PID:5200

C:\Temp\fdxvsnlfda.sys
C:\Temp\fdxvsnlfda.sys
1⤵
- Executes dropped EXE
PID:4576

C:\Temp\lfdxnifays.sys
C:\Temp\lfdxnifays.sys
1⤵
PID:1384

C:\Temp\pkhfdxvspk.sys
C:\Temp\pkhfdxvspk.sys
1⤵
PID:5868

C:\Temp\xrpnkecxup.sys
C:\Temp\xrpnkecxup.sys
1⤵
PID:6548

C:\Temp\jhezwrpjhb.sys
C:\Temp\jhezwrpjhb.sys
1⤵
PID:484

C:\Temp\zxromgezwu.sys
C:\Temp\zxromgezwu.sys
1⤵
PID:2428

C:\Temp\rojgeywtol.sys
C:\Temp\rojgeywtol.sys
1⤵
PID:2360

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
PID:4592

C:\Temp\idbvtnlgdy.sys
C:\Temp\idbvtnlgdy.sys
1⤵
PID:5524

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
PID:6816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzurmkecwu.sys

Path C:\Temp\bzurmkecwu.sys
Size 293KB
SHA256 ec9d9e5c2d9c7a4ff804db4961f52aaf74a09b9ec10dc4ca57d9ac4a5385b695
MD5 5b76e921396c0fc0cac3e234602b8b44
SHA1 1d9d9934fbe9e01b59d8adcb4b2690fd1402e897
SHA512 25dd84c1bebf89f8660da4ec4194cda3d5ceb51e9c0ae71c4c1160a14cb1572a1d404d5a4a5f2cc7ec1691fb9df86d1d5c11b1456c1973e7150c17d52ca63b30
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzxrpkhbzu.exe

Path C:\Temp\bzxrpkhbzu.exe
Size 376KB
SHA256 4f7f874a8e0e4cd5985eb24c249ce3c31482695019c0f62894ef0b61d021f24f
MD5 7b0910e9c7e918556cb404d752cd0135
SHA1 ea46e18f167c36d639ebf15fbfd5553f917740bb
SHA512 e283ec329e84a426912754ead3e8cd61e4c77bbb04ef68166a51fd12b8198eb33326ab3b0a84b46483d728484f829182a6ef97c691f2dae07a83cc1ded543220
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T109847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxsqkicav.exe

Path C:\Temp\fdxsqkicav.exe
Size 376KB
SHA256 5635f6e4f3bbcebb7d67b3ccdf4ee5c26e4c8e8a98f4fbf7afcf8f0b19e60516
MD5 fcd41f243d628f95161dc62d218b11ae
SHA1 61b6141a025ec04f6ba2de4b5d057996ccdbce0f
SHA512 e6e485a1be1632447aafb9f7aad625de212460b752453bca2fd7bbf5054fff8c45e2702ae7fdcf82d70da713c087dc4f86b0dd2a68aba9775a4bb8c49a191fe5
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzxrpkhbzu.exe

Path C:\Temp\i_bzxrpkhbzu.exe
Size 376KB
SHA256 1664badb06040987e14c39badf59f06d098274430aa148335a0119c6d3dc8df3
MD5 ecbd0525a8c66f512e9fb198459d7385
SHA1 0675c3933622a2baddb04b0fad36ce8750896600
SHA512 3ed02589cc62827a67f3ef7f7b4788c7ec4af9cdbd5ce40e67b7ea2bdc08e5d17bb6e97bb30060e80af1d1f84e04eb0cc63980b97d833140f94f2f5ab962f5bf
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T119847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxsqkicav.exe

Path C:\Temp\i_fdxsqkicav.exe
Size 376KB
SHA256 e50b55f79879545df304a9b30a6177867281cd83ebe11dc529e1be5f3d63ce43
MD5 3cb8da6661db55a07f241bddc8c84119
SHA1 6fe7f0dfabd30a1f2328dc8f31a8e2d5dc34ceca
SHA512 be55d45d0569ec790035ebceb2a8538d607fd369d75e0cdddc13356da2b26694997d91c6821364090e57cd0e40b310c881e56ea88de18fb24e17848eec017d28
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxupmkhf.exe

Path C:\Temp\i_kfcxupmkhf.exe
Size 376KB
SHA256 1c5ab04425ea88880833c275a442f3a95be166a566557aaf6acf689103d4c68d
MD5 8cb4b10db7bc6f2c57cd22e10f77447b
SHA1 d40aabaa34bc1ac9ff5d9f2e541faa21b9a445e5
SHA512 3b5438ce6677069c4b7107f35faaefcbbdde61782606d879c4b7f7352acee4d43b84ef489c1c116374a14e47a156c94feb10f68ae65a400f1a9acadc1160828b
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kigaysqlid.exe

Path C:\Temp\i_kigaysqlid.exe
Size 376KB
SHA256 6aa688228532b4f4ed20254284baf2d6330789922c78d1a4ee51093f758b7cc9
MD5 4c9ba7eea6d333c273fdbfb73b696916
SHA1 e1f3c705c0dd3ab22d2428a3dd142c1c42a762bc
SHA512 75a371207c04b6fc5a555886dd9ed9e07eb2743c7c54b6d821d60e549b370c84bda38ab92d849ea7125e42436e4eccdd2a6393c4d425186df69c9c8e23b4bc2a
SSDEEP 3072:SFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhfzxrpjh.exe

Path C:\Temp\i_mjhfzxrpjh.exe
Size 376KB
SHA256 6b075a9efff7ff684f83ecd6b049fd79f9598df20e3dd500e247f4e5571425ed
MD5 8cbdc8a1addd8d4a7e5dc7974acb1d22
SHA1 9fae66ab296fc2f8e4b11baddf311bab2f820194
SHA512 5b623a68ccd4f95638f06bee105ca9cfd9dbe834b1df84dcc1a62a9236b47af18fb432a358e3caf4d037789563b15c7b2d35ec0812a221ddbcc4df869aeff472
SSDEEP 3072:7FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdyvtlia.exe

Path C:\Temp\i_nlfdyvtlia.exe
Size 376KB
SHA256 9c6dd0c864ebe8db2130a7464fb097fa81276a27b9ace9218d4a205359fde57c
MD5 a53c68aeacaa6b52cc0fc614aa657d0c
SHA1 587a484b5e63f39443f94054af509d91557662eb
SHA512 d4a9e1cf37c0965f314f2dae5f7dd9a37c349a7864360d1f5b8c92c48532e4201b97c7c3fb4020f4fb57978f55a822f43cb6af793f7e81e2f958840c98babc1a
SSDEEP 3072:oFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:oFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkica.sys

Path C:\Temp\icausmkica.sys
Size 293KB
SHA256 d89bdba5e80a15d73f23822aa1604922c02c52cd2da1885a457e529086913f67
MD5 9e9633121cbdbf1ebc7740489461a721
SHA1 ed4bbf4e7cc92bf1c9d42012d17f70d844d87297
SHA512 5a7075ab2574a7535811fa09480238043d6bab918c63f7751fe36fdb7ff8f54ad08a390b9d31f47d277a4955fb9bfe68ee711a4f1f2baf32ff95aab42a7081b3
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxupmkhf.exe

Path C:\Temp\kfcxupmkhf.exe
Size 376KB
SHA256 8a9aecaea677598d14b2845a8860687327f0dce60dcb8a5564fbf71a7e4b1135
MD5 af9b27387d2640a1e6369b9b112da035
SHA1 a814afa1a4da59663b35c295651dbbbc40c2d9c8
SHA512 d2ec7b0149d4daeffe0af889aaff5db03eaade8f60e510ec23fb68a940ca85ee0082171a8e5d58f5d24f6fc08d57bc55d2f064f11ee189a722aed8379dc56fb3
SSDEEP 3072:wFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.sys

Path C:\Temp\kfdxvpnhfa.sys
Size 293KB
SHA256 fd883a52d9c459b4847f506a2dced31f00da9c1d7c99826332c213455a96705c
MD5 b544f124f3a976fe1495cff8d7768b3e
SHA1 c792d4ad49bb424e3e5163ff7bcfad3685b616ff
SHA512 63401ff25ed3f019d8d3454e42ef826685563e0471c05a7f20d118ef755d6ad7ab8782b4f7f0e3b873e127e9eef443ed3cd78e418808205b04a11ce0858ead8b
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqlid.exe

Path C:\Temp\kigaysqlid.exe
Size 376KB
SHA256 9f51ccde932e1b16b8b6c2a3a5bac50a721385c873c845c3279725fc6173c6b4
MD5 4e47eb56940fb0b4e0ee6de36954332f
SHA1 289b11426498ee4e27c2533a7656c0257e1634f4
SHA512 0179a7c83b58e83abcb3c066dd1128bd32e1b437aafebbaaffe0f424ad3e41ed517840660c91f1ddb54418fc7913290bb9ee90b41f5c0b2f4bfdd7d14325f063
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T108847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhfzxrpjh.exe

Path C:\Temp\mjhfzxrpjh.exe
Size 376KB
SHA256 0f16326f3cfcf00c5941fdd5d4157dfb44f2beab59daefe2113a17a5fbd23b22
MD5 8a32447fdd5c1a9511c14339a5345776
SHA1 54623a86564d5881104acae4e9113a1fe20fb772
SHA512 b19187a9593f063ba5a3b8d2c47890371059707255469147bbc9d72b5cab08dc9bdfc9a82ce1a0c2f6e601481ae96223df242f7159cd07187c55746d7589753e
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvsqli.sys

Path C:\Temp\nlfdxvsqli.sys
Size 293KB
SHA256 b036d0c907314f4b137d3f8e72e576bb5d8ebe37a2eb2df5c067cf2558d5ff8c
MD5 5928c581d308223dbda69146744d2a8b
SHA1 d5eefba2ac2a8af4860cd8fb81693726452b6b10
SHA512 dd81c93ac9b44fe93f0301e491e50f02960db131323bae11198fdd309b88f366d7b51194f59a8451d9eb13d9927cecbe9d014fdfa4bf3449f113e320a47dc649
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvtlia.exe

Path C:\Temp\nlfdyvtlia.exe
Size 376KB
SHA256 20cf103748531601ef8ea57110c0691079fa94ba03a0a1d4a911188b582fdeb5
MD5 da4221d6f649ded2df442b48827ab5b6
SHA1 52309eff4d110c0bb90c3a10426f83bee75e1366
SHA512 92b572c29bbe2e107c86bce20d9023e7c8d203fbcc9da7fb610f5f19581d33857793815c83706986765dcba2b08a02219e6f6225929bbcaebac4901bd425f3b5
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojdtoigaysqlidb.exe

Path C:\Temp\qojdtoigaysqlidb.exe
Size 376KB
SHA256 8de9d52a11b4de8e9ead15e95e22ed3551ee430982d6929dddf75ed31fea790f
MD5 e5820d50f9f25b9136279fb3865b9171
SHA1 50bf3d993dcf10d36e9b3edcb374326502760f2f
SHA512 16078aff61d120b2685d8a9784769a3bdbe0ef457af079dee73d641fa188747cce823152f6f01c843d0cbd7d44424f9ce9553aef254304374cd6353a06140df4
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojdtoigaysqlidb.sys

Path C:\Temp\qojdtoigaysqlidb.sys
Size 293KB
SHA256 79d25ab7e800d6b5e3bccb4d16be54c7b4fc56593295effab4acbf546d213980
MD5 5e61ea1fc6cb2641504cdfb017a24165
SHA1 596fc2729c1c9a83289c1fcdbcfb0dbebde73756
SHA512 2c18e847603f60a9d0e787bc48e5f85f96d3ffbec6c8d3d7bd9975027d35dabddd5d632d8dc9ba0c4fa1cecb35487826a9425f4f31880487b2acfff84cd714da
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhfzxup.sys

Path C:\Temp\usmkhfzxup.sys
Size 293KB
SHA256 e0772e472686915b26ab08f9e42b8b16d78f18c3a4873d9a33a7a0ba1b96c458
MD5 b7524817c59225f727a5551b4f7a1098
SHA1 b9d33d6e1e200ba97e37750fda3ae155537dd2ac
SHA512 c430ab8791015ad8659d574f13ffd415931ef246c409396e8d9fc5a1557d77fca8d1927cc3580815f50f93b4de9edb67a8c61f5ac0be6e9e250a7559273187c1
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T178545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 80316397028040a6972078cad2ff48a613ae7ec5d7f9788967cac33c59ccd0e4
MD5 502e62e23493cb3dc5faf6240dd936ba
SHA1 9849df394e97b94a0cb213fb1ee6c29f596cc41f
SHA512 38a4c0800b4a8730b1c984f37e17e8a5dc581e377b77e44a462a10b5514f23b88cbd1242c1fef08a666d39e4c82ece20a66fae3d7ca167b87f5f0ae7633f376e
TLSH
T1D641CDF383E4856E891196F0AA187E2FCE1D0915832C3D5AC9E4EF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cbf61cadcc94fc649a59254c0a57623cd0f0f6e20f1960fdbfcb53f993e21af2
MD5 98bad6e4fef22422065d705110230274
SHA1 dccaed49c0c591cee03d6543aad7b24f44005984
SHA512 eb1851118ca720080d1e0427626b06ed38707facc47a07463c46bd717f060107e96ad82b0b533a7f127a98f1d842f4ee6589955e3f616fdd807be31a247f1da4
SSDEEP 192:sxRMR4VyMqZjK1Ml8wcE/fxsNoYpZsGJlsJpzoA8prA/g6+WNC+0/YmIaGlIgjLJ:sxRMvCE/fxsNJnsGr40M/5o/0jd
TLSH
T1EE72E91A69345D7B8CDBD609FA457B63D6F81173A2904F44AAFC8A0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f7705ea931c32e8e9c349c3dd71d037d86081f9a75317f8d7aa53a3027d48bbe
MD5 5ff32f44377f4907050d1677928ae608
SHA1 15e768fba0a1568084313ef1707140d8564589c4
SHA512 3f24a4287e4b4ae5620c862c8c614ee90cb29ea0fe779cc31c71828ff7998b9f016c4c05937b93d513cc6bc327519e098ab6befbc4c5b9182eab70fa1e39c51f
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXu7z9wQroPwbp:RGqO3VE7yrWgzvfiXu1jaMu7pw7Pwbp
TLSH
T14EE2EC3B680CC77F4F804A9CEC29BE9A6DA802CF56D8895447EE844C03C76FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 71f1627f987f0852116512aafe847eab93a2cdcdccfe073f7b8ab227a9bf6a84
MD5 7a3d17dab3c3c074f4c976ad299b058c
SHA1 0f82fce2863ced190574fea47a2759a29062a9b2
SHA512 f18a4e6324942cb933c8d3210a2a17568f70a7330a28a74825ce253022b7e9580bc193d5e6d20b8432a474c68abb11cea23b885437e0dfbb7ef7f34ff837a7d6
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mt2:aR55IlHnOLRXxxin93g
TLSH
T1B7B2905071BA2700387D29099379D42F594630E230DEA87B3BA835E66F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b77d08da-58a6-4328-b6bd-7f7517212b93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b77d08da-58a6-4328-b6bd-7f7517212b93.tmp
Size 16KB
SHA256 51afc271974bf7dbda166784e98cb0da4971a38fbfd3f5241d99a1474a535bdb
MD5 8bd4c685aa75520a8a7b8873ee3c8667
SHA1 ff9c6ce50bf2b557d6e373c0f14ab9d25d6cfa29
SHA512 f1620e3ad24ca02c0488a79d3788b959e69ac795edd00b8ec4c82a7ef63431c184ed362b9c40e33e999c74c225fd8f580611636a1bfdd417bf5b768cd7e7bb9a
SSDEEP 192:sxRMR4VyMqZjK1Ml8UQtcE/fxsCo5pZsGJlsJpzoA8prA/g6+WNC+0/YmyaGlIgH:sxRMvqSE/fxsCknsGr40M/5o/O4G
TLSH
T1E172D81A6934597B8CD7D609FA457B63D6F81173A2804E44AAFC8B0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad337c3181b1d21b9de3410c7a88bfde43780ff321a710dc1cdcbd1d58b33090
MD5 52fa8732833044cd46a1d068aec71fd9
SHA1 0b34f610e0cf24a0ea004a848e2b29fe93230cd7
SHA512 9d0001f0b0ee107bfc4dcfdf6faee39c42557f30968b08b18f9b3390b91a37c255b661994d0f9d12e5d727856be943b3de25138bf3358a6103f2a6894498aea0
SSDEEP 384:nJiF1tNn/s3n9Sr8Nh8TUNTUlIRrRznNX09X+foDMCpF797v/HOObjI9G6w7xALN:gF1j+9+Uwg2JMC797v/H29Mx8
TLSH
T172C23A31DCA1CEABACE68BD4B74A3A56EEF012A385885EC4EAD95D4C01C31ED1707C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 098de4b5f5b5696cd87201054fc97830f8a08f1c78cb218726b0bf7dc8ce19b4
MD5 6978aeb2df1a97acc157d1469906343c
SHA1 cef8eebc41dc91f5cc88cdb5f4af52012f94a48a
SHA512 8c267ab6d5b82ee225fcf99d865e954685882ec009f0f5f7f0d54e7f6c5339ef6dfbab67132cc532690413c3a2ae6ba368ba74b0ac127fc3410c4e2bd0e8e2f8
SSDEEP 384:nYiF1tNn/s3n9Sx8Nh8TUNTUlIRrmznNp09X+foDMCpF797v/HOObjI9G6w7xALx:jF1j+9IUwgtJMC797v/H29Mxk
TLSH
T19DC24A31DCA1CEBBACE68BD4B74A3A86EEF012A385885EC4EAD95D4C01C35ED1707C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bf72284178e5f5c44352e7e420be21f28eec54be4e76ed7d6744c268e3e12dab
MD5 57dca01f526d37fa9ed95f4b9ae98522
SHA1 51741490fbdedb8256dc4171d34b898f05e627db
SHA512 5a41ffc19be52bede475560613db74726621ba410bb4eab24aff07590ada994bfd69d3d32b86bb5a6745317e0f7940a8f0b0f29822703750e0313ba4061fe2f3
SSDEEP 384:nZiF1tNn/s3n9SsD8NJg8TUNTUlIRYkznNVf9HX+foDMCpF797PZmmn15wbAjEJK:wF1j+9RLwgPLMC797PZmmn12bfJ7W
TLSH
T1BDC23936DCA4CA7BEDE38FC9B70A7646EEE4126381981AD4DAD85D4D01C32DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 3b1159c0c35a556a72d340acb715d0b6555f92df20e0f483f1a939e72e5f3f26
MD5 9ebd808e7ad9fcb8b21954f9e6be5735
SHA1 29f350430927296f02b0a026c356df5a8816e970
SHA512 0100f08b5606917e39fd7b5f2e6f9249afbe4acb4ca028151b4022ea3b1363eab9526fba387ea5704292b3126d4c384276ba3a3a937e530ccbdb0ec8a62d4cff
SSDEEP 384:nhiF1tNn/s3n9S08Nh8TUNTUlIRrRznNXp9X+foDMCpF797vIHOObjI9G6w7xALN:IF1j+9tUwgPJMC797vIH29Mx8
TLSH
T1F5E2B1F198D38A76D8AE4B97633D2E469EFCC1A3B5884984B7C85D0CCD831BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cc4a5e4097dbf43852572bfb05f84ba9522150c0d0dbaa2276d456196bc82772
MD5 e03eb93e1abc91e56d4ba6c8c0562a79
SHA1 1b42b7036414a971e5d1b99a9b270bc2a085ab81
SHA512 fbcc23b1bf15589719b02f95747c5dca4a57ab1b44d62c5a967ab4f0a62a93248b2f5f6704554f7d233665966b6a973d6cbecccf4e7047521236577afbb7a4fe
TLSH
T1901132F15C3E29C2D07E0DAFB0472AEC90D89316F4D434782858ED58927E61E12808BF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 c0be9b5918aedc4899030ca3360539091e3408b6dc7af77e5a325d6c79bd334f
MD5 595ef450a69b6bade743ba7cc06f5590
SHA1 0045d00ef8941139f5b1926f1a7b8eac499fa3ff
SHA512 ac67c75a5274a15b6b62fec3fd2c69e49e1e8ddcf5808633a30642c6eab4db3c8d088508db1350ca67603e7abf382d4e91264174560bccf6402e4f524993aa71
TLSH
T14F0141E25C2A28C3C4BF0E6F60433AFD90D8D31AF1E470781888DE54527961E12418BF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 c8076491333ed821a37e2c86322b092b545a28678154eaa0850ef4320a678958
MD5 c44a5c72f2ed98d0100e7d1bcedb8596
SHA1 bb4837717fd1afa98533bcdd9b00d9c7506f4146
SHA512 918659fc076735f91cc7683eaa57fedb9835c228ca56b98e6896749db73ea260e7729b47d82606041bbce7dc1f4e716f0b2424c89a87dead15a94131b4efdfec
TLSH
T1151144E15C2A29C3D47E0EAFA0432AED90D8D31AF4D430781888ED54923D11E12418BF
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3c488998fc672417b08ea80875cd0924f8b82dce5d29591a111acaf868e20fd7
MD5 8789f480968d2c1d4a8bc17827a09b09
SHA1 f82625e57159ed185bcf2c09b32c09a1a924a09a
SHA512 cebf67a2dd5be3623880053850f5233d2b263d5e079f24b2ec2af0a669c2d96cf32821014a96692440bfcfb87902691a7199dd8c37ab8440bd723f514030c0f9
TLSH
T16D71008356A9D6B2C1DE9BF102835644F1FB2238073330200BA1598AEA30A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/484-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1048-202-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1280-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1280-208-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1384-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1476-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1852-147-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2032-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2360-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2428-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3312-50-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4576-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4592-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5200-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5524-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5524-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6092-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6092-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6548-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6656-216-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6816-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download