systex | 1642c2607e1e89b7778458577c933969d57b62f379cd89a3e2cd3c8dc107b270

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260702-vcbaksh17t
SHA256 1642c2607e1e89b7778458577c933969d57b62f379cd89a3e2cd3c8dc107b270
MD5 ac5d47588107ee2be23fcc8d34d6f60d
SHA1 db4558c9baa3c74d3f7dd08cdff640b58d7af2b8
SHA512 cfc08e994f8071a146d9fd32ea439be9ce054de681d9d332aafa7bdeda81337a9be793639eec3d5fda2a778a07f1b70591dca61f55bad0006fd81ee282400c07
SSDEEP 6144:ovzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:ovzsVKZzGjSGecvX
TLSH
T1C6847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3200	trljebwtrljdbzwq.exe
3628	trljebwtrljdbzwq.sys
888	CreateProcess.exe
1420	ywqomjdbwt.exe
760	CreateProcess.exe
5216	CreateProcess.exe
5984	i_ywqomjdbwt.exe
2356	bytrligbyt.sys
2268	CreateProcess.exe
1248	nljdbvtolg.exe
5688	CreateProcess.exe
4720	CreateProcess.exe
3064	i_nljdbvtolg.exe
1640	bvtnlgdyvt.sys
2840	CreateProcess.exe
5408	ysqligdyvt.exe
4560	CreateProcess.exe
6076	CreateProcess.exe
4128	i_ysqligdyvt.exe
6060	qnlfdxvsnl.sys
2420	CreateProcess.exe
4792	qnlfdxvqni.exe
5600	CreateProcess.exe
4500	CreateProcess.exe
1672	i_qnlfdxvqni.exe
5868	kicausnkfd.sys
2184	CreateProcess.exe
832	causnkfcax.exe
3604	CreateProcess.exe
692	CreateProcess.exe
4716	i_causnkfcax.exe
1280	hfaxupnhfz.sys
204	CreateProcess.exe
4448	xrpmkeczxr.exe
5292	CreateProcess.exe
764	CreateProcess.exe
2272	i_xrpmkeczxr.exe
4092	ecxupnhfzx.sys
1584	CreateProcess.exe
4260	ecwupmhfzx.exe
4660	CreateProcess.exe
2068	CreateProcess.exe
4128	i_ecwupmhfzx.exe
5916	wuomhezxrp.sys
1380	CreateProcess.exe
4412	rmjebzxrpj.exe
5628	CreateProcess.exe
2728	CreateProcess.exe
4748	i_rmjebzxrpj.exe
5368	jebwtrljeb.sys
1392	CreateProcess.exe
1296	wtojgbzwro.exe
5176	CreateProcess.exe
3016	CreateProcess.exe
2540	i_wtojgbzwro.exe
3040	trljdbztrl.sys
3144	CreateProcess.exe
2272	igdywtrljd.exe
4744	CreateProcess.exe
1284	CreateProcess.exe
4692	i_igdywtrljd.exe
4912	qoigaytqli.sys
5692	CreateProcess.exe
4640	gdywqoigay.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_882508966\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_882508966\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_5941762\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_5941762\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1101188763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_60852847\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_5941762\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_5941762\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_60852847\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqligdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvsmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomjdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvsmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywromje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtojgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspjhecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspjhecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomjdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywromje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtojgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdywtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtrljdbzwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqligdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdywtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvtrljdb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4092	ipconfig.exe
468	ipconfig.exe
4308	ipconfig.exe
1584	ipconfig.exe
1328	ipconfig.exe
3208	ipconfig.exe
2536	ipconfig.exe
2768	ipconfig.exe
4580	ipconfig.exe
916	ipconfig.exe
4064	ipconfig.exe
3704	ipconfig.exe
2300	ipconfig.exe
908	ipconfig.exe
2956	ipconfig.exe
1736	ipconfig.exe
2856	ipconfig.exe
2624	ipconfig.exe
4764	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274846240233361"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{3AB120D2-3A4B-44F6-B6E4-A27CBE5FCD3B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe
3200	trljebwtrljdbzwq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5984	i_ywqomjdbwt.exe
Token: SeDebugPrivilege	3064	i_nljdbvtolg.exe
Token: SeDebugPrivilege	4128	i_ysqligdyvt.exe
Token: SeDebugPrivilege	1672	i_qnlfdxvqni.exe
Token: SeDebugPrivilege	4716	i_causnkfcax.exe
Token: SeDebugPrivilege	2272	i_xrpmkeczxr.exe
Token: SeDebugPrivilege	4128	i_ecwupmhfzx.exe
Token: SeDebugPrivilege	4748	i_rmjebzxrpj.exe
Token: SeDebugPrivilege	2540	i_wtojgbzwro.exe
Token: SeDebugPrivilege	4692	i_igdywtrljd.exe
Token: SeDebugPrivilege	1848	i_gdywqoigay.exe
Token: SeDebugPrivilege	2016	i_ysqnlidayv.exe
Token: SeDebugPrivilege	2692	i_nhfdxvpnif.exe
Token: SeDebugPrivilege	3124	i_mkfcxvsmkh.exe
Token: SeDebugPrivilege	2152	i_xspjhecaus.exe
Token: SeDebugPrivilege	5084	i_uomhezxrpj.exe
Token: SeDebugPrivilege	3064	i_mgeywromje.exe
Token: SeDebugPrivilege	1068	i_igbytrljdb.exe
Token: SeDebugPrivilege	4028	i_gdyvtrljdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 3200	3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3360 wrote to memory of 1368	3360	2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1368 wrote to memory of 5440	1368	iexplore.exe	90
PID 5440 wrote to memory of 4776	5440	msedge.exe	91
PID 5440 wrote to memory of 2800	5440	msedge.exe	92
PID 5440 wrote to memory of 1652	5440	msedge.exe	93
PID 5440 wrote to memory of 2800	5440	msedge.exe	92
PID 5440 wrote to memory of 2800	5440	msedge.exe	92
PID 5440 wrote to memory of 5036	5440	msedge.exe	94
PID 5440 wrote to memory of 5036	5440	msedge.exe	94
PID 5440 wrote to memory of 1296	5440	msedge.exe	96
PID 5440 wrote to memory of 424	5440	msedge.exe	97
PID 5440 wrote to memory of 1296	5440	msedge.exe	96
PID 5440 wrote to memory of 1296	5440	msedge.exe	96
PID 5440 wrote to memory of 424	5440	msedge.exe	97
PID 5440 wrote to memory of 424	5440	msedge.exe	97
PID 5440 wrote to memory of 2716	5440	msedge.exe	98
PID 5440 wrote to memory of 2716	5440	msedge.exe	98
PID 5440 wrote to memory of 2716	5440	msedge.exe	98
PID 5440 wrote to memory of 908	5440	msedge.exe	99
PID 5440 wrote to memory of 908	5440	msedge.exe	99
PID 5440 wrote to memory of 908	5440	msedge.exe	99
PID 5440 wrote to memory of 3172	5440	msedge.exe	100
PID 5440 wrote to memory of 3172	5440	msedge.exe	100
PID 5440 wrote to memory of 1156	5440	msedge.exe	104
PID 5440 wrote to memory of 1152	5440	msedge.exe	105
PID 5440 wrote to memory of 1156	5440	msedge.exe	104
PID 5440 wrote to memory of 1152	5440	msedge.exe	105
PID 3200 wrote to memory of 888	3200	trljebwtrljdbzwq.exe	106
PID 5440 wrote to memory of 2000	5440	msedge.exe	109
PID 1420 wrote to memory of 760	1420	ywqomjdbwt.exe	111
PID 5440 wrote to memory of 4228	5440	msedge.exe	114
PID 5440 wrote to memory of 4228	5440	msedge.exe	114
PID 5440 wrote to memory of 2728	5440	msedge.exe	115
PID 5440 wrote to memory of 2728	5440	msedge.exe	115
PID 3200 wrote to memory of 5216	3200	trljebwtrljdbzwq.exe	118
PID 3200 wrote to memory of 2268	3200	trljebwtrljdbzwq.exe	122
PID 1248 wrote to memory of 5688	1248	nljdbvtolg.exe	124
PID 3200 wrote to memory of 4720	3200	trljebwtrljdbzwq.exe	127
PID 3200 wrote to memory of 2840	3200	trljebwtrljdbzwq.exe	131
PID 5408 wrote to memory of 4560	5408	ysqligdyvt.exe	133
PID 3200 wrote to memory of 6076	3200	trljebwtrljdbzwq.exe	136
PID 3200 wrote to memory of 2420	3200	trljebwtrljdbzwq.exe	141
PID 4792 wrote to memory of 5600	4792	qnlfdxvqni.exe	143
PID 3200 wrote to memory of 4500	3200	trljebwtrljdbzwq.exe	146
PID 5440 wrote to memory of 5980	5440	msedge.exe	148
PID 5440 wrote to memory of 6020	5440	msedge.exe	149
PID 5440 wrote to memory of 828	5440	msedge.exe	150
PID 3200 wrote to memory of 2184	3200	trljebwtrljdbzwq.exe	153
PID 832 wrote to memory of 3604	832	causnkfcax.exe	155
PID 3200 wrote to memory of 692	3200	trljebwtrljdbzwq.exe	158
PID 3200 wrote to memory of 204	3200	trljebwtrljdbzwq.exe	162
PID 4448 wrote to memory of 5292	4448	xrpmkeczxr.exe	164
PID 3200 wrote to memory of 764	3200	trljebwtrljdbzwq.exe	167
PID 3200 wrote to memory of 1584	3200	trljebwtrljdbzwq.exe	171
PID 4260 wrote to memory of 4660	4260	ecwupmhfzx.exe	173
PID 3200 wrote to memory of 2068	3200	trljebwtrljdbzwq.exe	176
PID 3200 wrote to memory of 1380	3200	trljebwtrljdbzwq.exe	180
PID 4412 wrote to memory of 5628	4412	rmjebzxrpj.exe	182
PID 3200 wrote to memory of 2728	3200	trljebwtrljdbzwq.exe	185
PID 5440 wrote to memory of 1532	5440	msedge.exe	187
PID 5440 wrote to memory of 1532	5440	msedge.exe	187
PID 3200 wrote to memory of 1392	3200	trljebwtrljdbzwq.exe	193
PID 1296 wrote to memory of 5176	1296	wtojgbzwro.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_ac5d47588107ee2be23fcc8d34d6f60d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Temp\trljebwtrljdbzwq.exe
  C:\Temp\trljebwtrljdbzwq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqomjdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:888
  - - C:\Temp\ywqomjdbwt.exe
      C:\Temp\ywqomjdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqomjdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\i_ywqomjdbwt.exe
      C:\Temp\i_ywqomjdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2268
  - - C:\Temp\nljdbvtolg.exe
      C:\Temp\nljdbvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4720
  - - C:\Temp\i_nljdbvtolg.exe
      C:\Temp\i_nljdbvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqligdyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2840
  - - C:\Temp\ysqligdyvt.exe
      C:\Temp\ysqligdyvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqligdyvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Temp\i_ysqligdyvt.exe
      C:\Temp\i_ysqligdyvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2420
  - - C:\Temp\qnlfdxvqni.exe
      C:\Temp\qnlfdxvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4500
  - - C:\Temp\i_qnlfdxvqni.exe
      C:\Temp\i_qnlfdxvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfcax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\causnkfcax.exe
      C:\Temp\causnkfcax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfcax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:692
  - - C:\Temp\i_causnkfcax.exe
      C:\Temp\i_causnkfcax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmkeczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:204
  - - C:\Temp\xrpmkeczxr.exe
      C:\Temp\xrpmkeczxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmkeczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:764
  - - C:\Temp\i_xrpmkeczxr.exe
      C:\Temp\i_xrpmkeczxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1584
  - - C:\Temp\ecwupmhfzx.exe
      C:\Temp\ecwupmhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2068
  - - C:\Temp\i_ecwupmhfzx.exe
      C:\Temp\i_ecwupmhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1380
  - - C:\Temp\rmjebzxrpj.exe
      C:\Temp\rmjebzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2728
  - - C:\Temp\i_rmjebzxrpj.exe
      C:\Temp\i_rmjebzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtojgbzwro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1392
  - - C:\Temp\wtojgbzwro.exe
      C:\Temp\wtojgbzwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtojgbzwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3016
  - - C:\Temp\i_wtojgbzwro.exe
      C:\Temp\i_wtojgbzwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdywtrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Temp\igdywtrljd.exe
      C:\Temp\igdywtrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdywtrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1284
  - - C:\Temp\i_igdywtrljd.exe
      C:\Temp\i_igdywtrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\gdywqoigay.exe
      C:\Temp\gdywqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    PID:5572
  - - C:\Temp\i_gdywqoigay.exe
      C:\Temp\i_gdywqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnlidayv.exe ups_run
    3⤵
    PID:3996
  - - C:\Temp\ysqnlidayv.exe
      C:\Temp\ysqnlidayv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnlidayv.exe ups_ins
    3⤵
    PID:3084
  - - C:\Temp\i_ysqnlidayv.exe
      C:\Temp\i_ysqnlidayv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfdxvpnif.exe ups_run
    3⤵
    PID:3060
  - - C:\Temp\nhfdxvpnif.exe
      C:\Temp\nhfdxvpnif.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfdxvpnif.exe ups_ins
    3⤵
    PID:1640
  - - C:\Temp\i_nhfdxvpnif.exe
      C:\Temp\i_nhfdxvpnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkfcxvsmkh.exe ups_run
    3⤵
    PID:4488
  - - C:\Temp\mkfcxvsmkh.exe
      C:\Temp\mkfcxvsmkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkfcxvsmkh.exe ups_ins
    3⤵
    PID:3236
  - - C:\Temp\i_mkfcxvsmkh.exe
      C:\Temp\i_mkfcxvsmkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspjhecaus.exe ups_run
    3⤵
    PID:2676
  - - C:\Temp\xspjhecaus.exe
      C:\Temp\xspjhecaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspjhecaus.exe ups_ins
    3⤵
    PID:5436
  - - C:\Temp\i_xspjhecaus.exe
      C:\Temp\i_xspjhecaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    PID:5684
  - - C:\Temp\uomhezxrpj.exe
      C:\Temp\uomhezxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    PID:2616
  - - C:\Temp\i_uomhezxrpj.exe
      C:\Temp\i_uomhezxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywromje.exe ups_run
    3⤵
    PID:3852
  - - C:\Temp\mgeywromje.exe
      C:\Temp\mgeywromje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywromje.exe ups_ins
    3⤵
    PID:2148
  - - C:\Temp\i_mgeywromje.exe
      C:\Temp\i_mgeywromje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbytrljdb.exe ups_run
    3⤵
    PID:4284
  - - C:\Temp\igbytrljdb.exe
      C:\Temp\igbytrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbytrljdb.exe ups_ins
    3⤵
    PID:6100
  - - C:\Temp\i_igbytrljdb.exe
      C:\Temp\i_igbytrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvtrljdb.exe ups_run
    3⤵
    PID:4080
  - - C:\Temp\gdyvtrljdb.exe
      C:\Temp\gdyvtrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvtrljdb.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_gdyvtrljdb.exe
      C:\Temp\i_gdyvtrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4028
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc81b0c188,0x7ffc81b0c194,0x7ffc81b0c1a0
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9627347565730659762,6988098493671944184,262144 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,14965310105298431227,3441036992393294177,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,6382317760665326599,1696614089128446007,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,15218262997537448924,2215306019383184922,2097152 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,6379214540863020049,3396384758492067466,2097152 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16954111883128327630,13156719567927418686,2097152 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,9975094646996877735,2705609917584246998,2097152 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,8347525823207848266,6250494463863112138,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,796557015002079144,15064251640833408819,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,16154554606248189578,16311736495383904589,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,15491808873628315186,11476335316989938990,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,15491808873628315186,11476335316989938990,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,14960233693237154603,12759749423799130932,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,11114732727423051253,1300096442974488851,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,12559012559661923393,17634355148536028542,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,12400121880150866990,14306758244063071300,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,6092804667557356579,9658882890685236675,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,1219055515163226846,4145216760308638200,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,6191863899332100191,5644722885203666734,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,16924730655874559485,15282877568325930319,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,5736735433346718039,17380781221346823684,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5540,i,15116303479542871209,16207331997478502238,262144 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:10
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,3956244461636960647,660340336182785702,524288 --field-trial-handle=2324,i,18426229457462030169,10574554639339982106,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4904

C:\Temp\trljebwtrljdbzwq.sys
C:\Temp\trljebwtrljdbzwq.sys
1⤵
- Executes dropped EXE
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5616

C:\Temp\bytrligbyt.sys
C:\Temp\bytrligbyt.sys
1⤵
- Executes dropped EXE
PID:2356

C:\Temp\bvtnlgdyvt.sys
C:\Temp\bvtnlgdyvt.sys
1⤵
- Executes dropped EXE
PID:1640

C:\Temp\qnlfdxvsnl.sys
C:\Temp\qnlfdxvsnl.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:5868

C:\Temp\hfaxupnhfz.sys
C:\Temp\hfaxupnhfz.sys
1⤵
- Executes dropped EXE
PID:1280

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\jebwtrljeb.sys
C:\Temp\jebwtrljeb.sys
1⤵
- Executes dropped EXE
PID:5368

C:\Temp\trljdbztrl.sys
C:\Temp\trljdbztrl.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\qoigaytqli.sys
C:\Temp\qoigaytqli.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
PID:4772

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
PID:4556

C:\Temp\xvpnhfaxsq.sys
C:\Temp\xvpnhfaxsq.sys
1⤵
PID:3476

C:\Temp\upnhfzxusm.sys
C:\Temp\upnhfzxusm.sys
1⤵
PID:2564

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
PID:2684

C:\Temp\ojhezwtrlj.sys
C:\Temp\ojhezwtrlj.sys
1⤵
PID:3900

C:\Temp\rljgeywuom.sys
C:\Temp\rljgeywuom.sys
1⤵
PID:3332

C:\Temp\lgeywqoige.sys
C:\Temp\lgeywqoige.sys
1⤵
PID:1808

C:\Temp\yvtnlidays.sys
C:\Temp\yvtnlidays.sys
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdyvt.sys

Path C:\Temp\bvtnlgdyvt.sys
Size 293KB
SHA256 6bb61153cca40e7831737b3e42efb2405b9ef1a393004ed552988ae0c9dbd9f2
MD5 690627de46c05354e6956914371ec656
SHA1 320322423905a126d25e761b4d34c1565f49312a
SHA512 cd1efb44e9eccb4fa2fdab010d1827029298d69bd440d7d5b9ae770f7c7de491a8baaec51592c09fff0d3995bcef7b1ea89b3cd3c6c0d16411fc1ff171374a5a
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrligbyt.sys

Path C:\Temp\bytrligbyt.sys
Size 293KB
SHA256 ba81d1afcd33f7923f9ab793c303712d2fe341faf8dbb0e0fe8bc560cbc52e7f
MD5 9f668fca63b6f5d8d0a8ffd15a12500b
SHA1 38dc33cd5d1ad4b06e4e87c10b58d316e65124f4
SHA512 20bd4a978589b030eaa2a505b005d6d0c8bcc0923e8fd9d31ef6fb2a90de214e86ede045d05f99957030d2d9156561cdbd22b1d31732c5d85e73ada241e3784b
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkfcax.exe

Path C:\Temp\causnkfcax.exe
Size 376KB
SHA256 911285d0f081cb8cd416f0e7c0c97846f30be947d3676e374a42e91004887679
MD5 53e7245b7d75fbcbe4714790ab949d4e
SHA1 6998dcd475155b685384d66aab1507a06a1f3dfc
SHA512 9ec6c2bbb2962c216fb121a6a9510e497bd6c5fe4056263c67a56d4dd942690a18148b009208ce4593ae81f038dadd3c2269db2ccfea07cbd4a6d6b770744784
SSDEEP 6144:MvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:MvzsVKZzGjSGecvX
TLSH
T171847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxupnhfz.sys

Path C:\Temp\hfaxupnhfz.sys
Size 293KB
SHA256 07fad0a4138d6fca04cf938cb6029853c5efbc426661a8db0730ccb4dcc060f1
MD5 d804e845c9faa7626b396f2107d2c0bd
SHA1 c54e4bb5b9f79ec1ab60d79416c8a819372f897b
SHA512 737196a72b8b58c43d3d88a3d74d80a3f4ed95042f126162f03dc7a30729b2e7177cc8e302918f42a9a38f7fac4b980e5d9c11df348a4d367a3760a97e2c1bb8
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causnkfcax.exe

Path C:\Temp\i_causnkfcax.exe
Size 376KB
SHA256 1d01f28e2742f9259297df7dd0f00876e952541c5798dce93a17a84a5833990f
MD5 06a6fa22c765466bca1d5930574cd7d2
SHA1 982935ae8da0be4d3ea34f2f31e747bfa4ceca59
SHA512 8f905639f1a4c02faa727c188fe7d61d0f10a35ab3136e7af1167154176dc8fbf76d572d10c60f3ca1eafbaf00ee8a174e10fdffc82355a44319d92d28185df4
SSDEEP 6144:QvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:QvzsVKZzGjSGecvX
TLSH
T131847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljdbvtolg.exe

Path C:\Temp\i_nljdbvtolg.exe
Size 376KB
SHA256 2bf9c9bb6b061a4a3fc8d7a69fa433187d1650ced935f7ff10b8b5e7b60f1d24
MD5 d34f31dec1f9c805a368487dd3fe471f
SHA1 f064ed7ac2ff5af1b3d6ed0afe24bae5505978b6
SHA512 55fa0f37fd114126f11ccfa56b0a4257c5614af06a3138a14b9aa32fc69b92f5234cf94c84aa664253e623d304079d10827783c9779489e49c494e8e23bbb2bd
SSDEEP 6144:8vzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:8vzsVKZzGjSGecvX
TLSH
T1F0847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdxvqni.exe

Path C:\Temp\i_qnlfdxvqni.exe
Size 376KB
SHA256 c759440e782ada935cec7f0cfe34ab4618d734b3caf9f0289af6d42fbbc7fb83
MD5 0f4cfa2df0cb58908430832abdb28380
SHA1 03ed029adedd99207372e5210ffaa9915ad097ad
SHA512 c130e2b044908761a8797fbe997f8ff2b8c8b742f43181880cd1296b5d70e049a3f16d015c31f74eaf23d21c27ac3a7cae06c4557da7b698ca929b64008daaf6
SSDEEP 6144:JvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:JvzsVKZzGjSGecvX
TLSH
T171847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpmkeczxr.exe

Path C:\Temp\i_xrpmkeczxr.exe
Size 376KB
SHA256 5abcd0b38c9ac8dee5a88dda6fb3f0d0c4cfcb41ab35ebb67b84d94952adce08
MD5 a01d8646f7b72ab5ebf260e88b05ce5a
SHA1 76fb83972e63e1171b6e9d1c2b45a1f80ad09133
SHA512 4e856803e1a3c76bac52a9c8fce203b5d7d24ee8b072970a968d21c79d5116351a219bfdf6742b1606d38d7df8a93ef1ee3534921ac9798e9f2ce69e4104d097
SSDEEP 6144:uvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:uvzsVKZzGjSGecvX
TLSH
T12C847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqligdyvt.exe

Path C:\Temp\i_ysqligdyvt.exe
Size 376KB
SHA256 f8597943110e52551762645e86381e7b50210d4a6d4e322779908817ee22dd81
MD5 4e83e3a71b34893195a4f279e0d8d391
SHA1 6ab9d077e5d44f0c91255c434e721eab3d1127b3
SHA512 450f6d6092333e88511ac305ab4f4aa25a747bcc60a3cb728fc051513d1531dda6e77d9cbd141211a0f22c0dc1f7ac008940ed7da7920b44deeead38fe71ff75
SSDEEP 6144:MvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:MvzsVKZzGjSGecvX
TLSH
T11D847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqomjdbwt.exe

Path C:\Temp\i_ywqomjdbwt.exe
Size 376KB
SHA256 ae6ca0901c22c3304e517d373d31f8ce101e7abbf63616e476ce5717d28307d8
MD5 3c81ffe156f7f089c7e356cd52e3f0e5
SHA1 357b07bd6103a346944942a8ab99eeb37384b9d6
SHA512 d945e20591a0baf77b01652a7792a1c3d93d82044d0bdd2d7e63ee4307fa427faf7ae5d997f0f408499a4891295f5593aea2581ca2a0cffdb8a91f2e59d76853
SSDEEP 6144:EvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:EvzsVKZzGjSGecvX
TLSH
T15B847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfd.sys

Path C:\Temp\kicausnkfd.sys
Size 293KB
SHA256 a8c5c93b45361f10512588a37e276bb83ea021814ffbd988c0dfee9cb6dd6349
MD5 41399b55434f19e8186cfe47e43fa690
SHA1 2920b957965ee87f5f3818d7ba64e9274f229476
SHA512 e0e290a76819aa0ab3e77e040e010956916a9f2fa176232c954ef18b776633adb90aaafdc966ac74f0ad5d687a613a971318dbf8ee6f72470d1e3c7458b90dd8
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtolg.exe

Path C:\Temp\nljdbvtolg.exe
Size 376KB
SHA256 778cc8c94ad2e0355f603f69efae70b0768e5d7bfc15d211513153884af49ce4
MD5 1022138df0c6ac2dab2211f5472825a9
SHA1 b07cbe61070c9249f4cbbe0108071b2833ffb9da
SHA512 a1c72c9f51d9990db3a5207f46989a572d909ac56a4d87d072f71b5640db042506baa2887c9dd8bf752aff635492af010d4e95df495ae2187d2858819271c62b
SSDEEP 6144:cvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:cvzsVKZzGjSGecvX
TLSH
T132847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvqni.exe

Path C:\Temp\qnlfdxvqni.exe
Size 376KB
SHA256 e6e6969cb2a19cb7ab98bd0b3084e6205439c3aa6447b338c13bb11e5f04fa58
MD5 30b93581022f9e1a77e986ef012c9662
SHA1 13f4e9ed7f85fb8d3386e18aa80c97183f0777eb
SHA512 929fa56a3ed6639d606fd44d396cd71805baeeead16055be5498008b3ccb761cf80a0f5bcec7eb9015ed8608702863adca79a5772dafee5ab4e5bca67616eb86
SSDEEP 6144:lvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:lvzsVKZzGjSGecvX
TLSH
T157847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvsnl.sys

Path C:\Temp\qnlfdxvsnl.sys
Size 293KB
SHA256 09f37a3bc94a01168b9c82c0eeddac8b8606fd5e16d1bbd601bdb2414611d182
MD5 b684388129a2aff0d6393a5776a560f3
SHA1 3d315a585ba28878f774092555dfd15df2dd14ed
SHA512 ff5b9932be5ee8d2d38aefb28795ae382c1cdadefc974c0f3491cc11ad738d887a846b1ad11d10336f28318c7d56ab29f3f89c126cadcf5323a685148c597d13
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T16E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwtrljdbzwq.exe

Path C:\Temp\trljebwtrljdbzwq.exe
Size 376KB
SHA256 29a057a1c549190f7e738931884d48a8e9848e29b6ea3e7d96e8973850d6d8b0
MD5 d2165a222733ed747210bd79b10f9071
SHA1 ce6dba9e0ab86a4217f52088fd4bf7dfe9a28403
SHA512 0995dd2bf2ca60718e45f04f9fe56bd02268faa1126dcf76de803b42b0ef0dc5c70c93159ca569f7c6b4485e1373be77bae0cef791858369c09ab6d49b15239e
SSDEEP 6144:YvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:YvzsVKZzGjSGecvX
TLSH
T1AD847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwtrljdbzwq.sys

Path C:\Temp\trljebwtrljdbzwq.sys
Size 293KB
SHA256 0343863122463c8fd39dac8a95e0e5ee81d30a579dc0342b086b2609eab5bf2a
MD5 c40e0435df499f9c5bf83741439363e2
SHA1 b28af774d73771e0340861746654b5989ebd4034
SHA512 fb57a793d926276eedf50516412ea25e0a85590c7be938f208cfda31f08349a14a62ecefdf4318a4a03b9dd5a99e2f4b6047e4f691d3d9add768d0e7a7a59127
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmkeczxr.exe

Path C:\Temp\xrpmkeczxr.exe
Size 376KB
SHA256 d53a9dd784b1114d847f575ee962d6ebf8bbf6ecb29608e17ef439073e2c3ebb
MD5 4cc8cc0accfcd4b0d7bad88cea71344b
SHA1 1550f025ab98ae748a9f8413237feef3706dfbad
SHA512 4899dcd101588032d4dd49f774530e5cb92a3f17e3a0379e0a0b88573192d3896886d7e8945f667b42e297b1a554974e9deed328536de224b570e898cff5f5a8
SSDEEP 6144:IvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:IvzsVKZzGjSGecvX
TLSH
T179847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqligdyvt.exe

Path C:\Temp\ysqligdyvt.exe
Size 376KB
SHA256 0179a528ccbe1c1205b81feaf6faed3f915e9af375364203c76dcad18040f2c9
MD5 b70373709ccb4536ebe29c2f9ebbafd8
SHA1 c5c997bacfb5b42507371dc9cb7f7634baac1821
SHA512 4310ac74754ff38305c501c049a0eabe73bc9d00f22d5c3f6ffd0ce854eb5a452c50c2ad7d0ca3b99f4e917415f7bea2834894118e4eaae81f682eb3bf5bcef4
SSDEEP 6144:YvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:YvzsVKZzGjSGecvX
TLSH
T168847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomjdbwt.exe

Path C:\Temp\ywqomjdbwt.exe
Size 376KB
SHA256 a91c578bfec3f144d583da1e9379fb22c046a6f30aab5ba0c13a23e4e0b8e7d5
MD5 e57fb0352159ca1a3842574adc044377
SHA1 52d5fc649850afc45dc3f63ba41eeb788f50a435
SHA512 50a2eadfb6cf317337955adb1537b9ca62d0573417c5feb6c62d00ccf4d525bb45a9d8335fce59698db6e5a2902346eb763490f644dd1ddec93c34c069d2e74f
SSDEEP 6144:TvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:TvzsVKZzGjSGecvX
TLSH
T1A6847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 08c223d0eae1b52184430c243af80232e9b026266034a7fb1d8e57ad06e185a0
MD5 a8902d76d8392e421efe8113510b747a
SHA1 e74d759ed58ef467426177f4b5291ff412c61b4d
SHA512 eafb21e74826d3f7f680d7f5ddf555ecef1be959c3ed5ccde513938459347f3d2199223f1e0c524fb3509b70cec67e24d322a72fd60fa75ed6c5f119df84b19b
TLSH
T1836172B691726AEBFB2DA07553FA9E9C33B0C49E04072F35E694F2F8CD4676494D6010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ab69.TMP
Size 3KB
SHA256 62210155e7a1653a91143957b0269db54cc9dc7b68c12445dce0591e692af9a8
MD5 13e4cfbf0f64006a24187a69d597e225
SHA1 8a0668901fb23a7faf4fcc9f639b73da9736005d
SHA512 edee5129298de8a5f3a22c60e62f2eb87ee8e4875fb97507c1b345f97ac0dc146b17dd19ab079842bf7cb84c932cf32eaa21f0e9eb174294a882d49c6515e678
TLSH
T1BE6170B691726AEBFB2DA07563FA9E9C33B0C49E04072F35E684F2F8CD4676494D2010
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd7b0bcebcec32c8da26426ffb2df5573ebdf56e393d1b38a0eb5f31da1a38d8
MD5 67045dd2a4c54d8008fc1d6eec9a1f1a
SHA1 e9baae3002de60e1806c37443189b9ef0734771c
SHA512 2d4d88569f827ab5e6d04bade167fc1dd522fe9d7dd94763bc427a1b3bc47471c4172fb302aeb3d322c5c28f78bd6e9e249e1b6764992cadce56c2364619fbe9
TLSH
T148519FF7C3E8856D890196F4BA186E2BCE1D0954832C3D5AC9E4AF1B93F3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 047dc426c79b9216dd5d881493bd2913727ebc2b18e64628f5df35aeedbcdff6
MD5 d361e9636bc68538b23cc89f999e81a5
SHA1 8bc1a3d8fe4d21bc57b3f7a9d659c3f96daff353
SHA512 8c4d0a06d097189d96066c9a2866f938c141d3f93271ead7eb31355c84d3ee129a854aeaf9e0e98654c73ab27521a53d7e0e5d33c8b64123aecf29440e81bd67
SSDEEP 192:sxR0RR/yM/jK1Ml8wcq/f6szD5wZpz0zoA8p9c/g6+WNCZm/YwpQG/IgtJ:sxR0RFCq/f6szlupzVC/5J/d3
TLSH
T1AD62E915AA245D77CCDBD20DFA557F63D6F91563A2940E44AAFC8B0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 370ff0d9b7eafcc6254bdf7274b43ec2990558c18fa86ad3bf1ec75de6ee8c90
MD5 858eb63c74585d3937353486eea5ca99
SHA1 37d260561f3bf4a816d5a9f7228967f2945c78cf
SHA512 bc0cbd244fc4c6013d71cfe38d06ba6784ff307c05e6a33a7bd31b0d173b844d5d72ad424edeb3ca2951421d244778e6bac8371330f8764bac66c80fc3928f2e
SSDEEP 192:sxR0qR/yM/jK1Ml8wcq/f6szD5wZpz0zoA8p9c/g6+WNCZm/YwpQG/IgDxJ:sxR0qFCq/f6szlupzVC/5J/dv
TLSH
T1FA62E916AA245D77CCDBD20DFA457F63D6F91563A2940E44AAFC8B0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 547c6481b7a834dd52bb8b6b33fb1edc4114ba3a65fdcce0a1ec69b32e11968b
MD5 6a1a191b60948d8f50d541234b5b9304
SHA1 938d4ebc6ec5f703119463d23f50a3ed6aa817ab
SHA512 01920ac91910c2432573dfe92897b3393227c31a2b55a3c39bee4478f236646f35e6d05ca1fec787ea553c99dac06b92cb2971be679d8fe986299022868c74b1
SSDEEP 192:sxR0qR/yM/jK1Ml8UQ7cq/f6szDwwZpz0zoA8prc/g6+WNCZm/Yw2QG/IgDjJ:sxR0qFqgq/f6szsupzVw/5J/E5
TLSH
T14C62E716A9245D77CCDBD60DFA457FA3D2F91563A2940E44AAFC8B0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2f09b214fc3eeea5dca5bfbfe9b80d8ccae344bfc6dfe5da6698d8e5d3734dc4
MD5 89cc1c67f0a338c48c4df5fe933f3cd7
SHA1 26d4e6b16f57e9e2e674268d15a3ca25a6f6a1d1
SHA512 79d6bf9723469bf50cb947ad25acb0ae97347a86574274500ce036effbd7176a20180dd46d00999baf2b236b889ed7f8c4860c0dc75933153f20292c2424a42a
SSDEEP 768:Ra7VjA7pLuL7wZWgmofLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+Mid4vBroIsy:Ra7VjME7wZWgmofLku1jaVMiav67y
TLSH
T11BE2FD3B680CCB7E4F804ADCEC29BD9AADED01CF5AD8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 264c6a1b8bc116ba64a78b7390aa69919a7e71d28bcef5fc072b0481386d9fa8
MD5 265dd3296c24bfc218d3e026f3a08834
SHA1 66a7016906b9ba113be18ef941be00dc902e1d84
SHA512 f65ff4ca3eeafc62603b43e432274f2b033314b419a318d5fd89bef2d45366e8b0ab13c0e4eaea8a4aebcc6f1479281ba4edb2737c837141dd66ff0d20c8d251
SSDEEP 96:K00AKRO6Km8KzapYp8IamqwWuzjgwwK4lgSwcgwDyYdHKvWK8cF:az3cYp8IamqXuzcwElgSPgwDyYdHKvWQ
TLSH
T1A491980670B71700387D295A96A8846B82C2347230ABF97F3BB861D95F76F404EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4690.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4690.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a331499b20c71069f20032a9723c6f2188f031f0c9a29ca2fdb64336495407dd
MD5 bc156b6872ae90b28ffb3e3fbae4853b
SHA1 c5b9ef54454f76c579eb257679bd41a56eb10e40
SHA512 6c253cfa0e272d9f50a3230d5d0381d2d33377752fbabfc748526a5b1cf9e706d1a7eaec77bdad0fa77798d4993013a789ea90abc27f3b8c0975d2e68bc27dc2
SSDEEP 768:rj+9t37H/jy6iLzydq2dlcnSl0bCTwZWEDl8BvTPaMwE:+9t3Diz2dynSl6b/Dl0WMwE
TLSH
T1DBF2AE70BC099E278CE7D688B2476A97AEF401B355851ED4CEDC6F0D018379D271793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 29527a3185d3effd42cac546e7cfd187a6461c5c8bbf0fcda334818fc35e2e40
MD5 1e116a9229c0c6f1a3789e9b6c3211f2
SHA1 4743657f548365ced358cfec761d4b4970adb84f
SHA512 54f7c5ce7129a6d6160d4ed4007e96e15076d4df03c60129870265fd3f2de3e9039f85f145ac91f664e136338b43defe7f3d53eebb19d7118b8f37cf854ed1c5
SSDEEP 768:Jrv+4UNbdr3Hn/jy6iLzFq2dlcnSl0bCTwZisY+8rEnk:Jbsbl3Xis2dynSl6boDrEk
TLSH
T1AE03BF31ED189A339CE2C688B64B3A177EF841A355C50BD4CDDE2F0D428B69E131B963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 92d9b7f5415f52d168d855ba4cbdee9789081077bad9e9c21ec7286c5393122e
MD5 3ee498ca283881a7383806a095e76a73
SHA1 f164e7d8b535b5cc7a9def4e1ac8f5d0d32ef435
SHA512 93a924c207e3c55b9afeea8f5dd5f1c9f095842d2cf355044c2a282ec73fdf142cbd4d5ee807daf5ba23acf982bec70f104762d3113cd24873d9096cf72d6077
SSDEEP 768:lj+9t3eH/jy6iLzydq2dlcnSl0bCTwZWEDl8BvTPaMwE:Q9t3Siz2dynSl6b/Dl0WMwE
TLSH
T1EFF2AD70BC099E278CE7D688B24B6A97AEF801B355851ED4CEDD6F0D018379D271783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a2052a0594c06b8d1c89ad968bb6d01be76a0eff78783debe0b68504d22be34c
MD5 63baf204e3df0b530e2e83dbd82b8bd1
SHA1 6ef26dbfdd86f148fed060f267951136e15d418d
SHA512 3e4b9a62964a8a6b1e8bb72d070ca63fe6e7d6beac32be959b247959f76ab2478c19fe8409b2ce879e97a76ae5613a81474f555233a48575270435c1627db406
SSDEEP 768:3IF1j+9c3Qwg/WSiLzyiq2dlcnSl0bCTwZWEDl8BvTPaMwE:19c3qik2dynSl6b/Dl0WMwE
TLSH
T1A11319F198C78A36D8AE8787A73E6D4699FCC16375841994BBD81E0CCC832BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5440_2144709365\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c0248b90489aaf6dcb9303d53aa026582c58f22e71008423c2c6368544139f26
MD5 b69ec6b4801e4e43870557fcdee89cd7
SHA1 8c44ccbe1c31eb2b396b1f346e8dbb08862fc1f4
SHA512 5e48e89b27e68ff0647ae79476bf9a10607ab12f2aa59ed046c42a28de5f79cf6e8eb88572d49fa2c05d03899d5f0c80c305dc040c046e47d8a0e018c63c24e4
TLSH
T12C71238357B9D6F3C5DE9FF102835644F2FB22380B2330600B515546EB30A7A14B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1280-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1640-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-511-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2356-200-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2564-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3040-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3332-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3628-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3900-508-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-516-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4556-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5368-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download