systex | c903d7ae4bf6461634098add326da39de71fd2c38fec2d976015e2f8b953edda

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260704-mgbsxaes2x
SHA256 c903d7ae4bf6461634098add326da39de71fd2c38fec2d976015e2f8b953edda
MD5 798fa99ad9153395dea227921c89f9d6
SHA1 21281b999c8448736cb0b817e061685232167bc6
SHA512 5a45811a6957a0a8d7abcc5f29b4bd40b6ebd67f2ba3b1668e387e20bfe0ac66a57910153db5d9da29f9ad056c749b4c8e48acefddb7a2f30a6f60de5f860781
SSDEEP 3072:xuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2836	wrljdbwtomgeywqo.exe
4952	wrljdbwtomgeywqo.sys
4796	CreateProcess.exe
1808	ztrljeytom.exe
4124	CreateProcess.exe
5104	CreateProcess.exe
5280	i_ztrljeytom.exe
6812	rljdywtolj.sys
3088	CreateProcess.exe
5516	jgbytrljgb.exe
5504	CreateProcess.exe
6628	CreateProcess.exe
3272	i_jgbytrljgb.exe
1660	dywqolfdbv.sys
3328	CreateProcess.exe
688	aysqligayt.exe
3156	CreateProcess.exe
5364	CreateProcess.exe
3332	i_aysqligayt.exe
5884	lfdxvqniga.sys
2208	CreateProcess.exe
2168	dxvpnlfday.exe
4296	CreateProcess.exe
6936	CreateProcess.exe
5544	i_dxvpnlfday.exe
3852	snkicavsqn.sys
3708	CreateProcess.exe
1332	snkicavsqk.exe
2628	CreateProcess.exe
3260	CreateProcess.exe
3384	i_snkicavsqk.exe
6660	ausmkhfdxv.sys
3956	CreateProcess.exe
2332	ausnkfcxvp.exe
916	CreateProcess.exe
6964	CreateProcess.exe
4316	i_ausnkfcxvp.exe
3436	pkhcamkecw.sys
3640	CreateProcess.exe
6160	hczurmkecw.exe
6684	CreateProcess.exe
3292	CreateProcess.exe
4484	i_hczurmkecw.exe
2940	rpjhecwurp.sys
4480	CreateProcess.exe
6528	romhezxrpb.exe
6048	CreateProcess.exe
5180	CreateProcess.exe
5732	i_romhezxrpb.exe
5636	bzwrpjhbzt.sys
1468	CreateProcess.exe
1500	pjhbzwrojh.exe
5612	CreateProcess.exe
6412	CreateProcess.exe
7116	i_pjhbzwrojh.exe
5348	qoljdbwtom.sys
1792	CreateProcess.exe
5368	rojgbztrlj.exe
3332	CreateProcess.exe
5692	CreateProcess.exe
4192	i_rojgbztrlj.exe
7144	bywqolgbyw.sys
6892	CreateProcess.exe
2464	tnigdytqli.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_675042250\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_49917116\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_49917116\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_23670142\crs.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_675042250\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_23670142\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_23670142\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6028_23670142\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnigdytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljdbwtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljeytom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnlfday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsmkhfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsmkhfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romhezxrpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnlfday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romhezxrpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljeytom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnigdytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbzwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbzwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtolgeywq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1244	ipconfig.exe
4636	ipconfig.exe
5520	ipconfig.exe
972	ipconfig.exe
4276	ipconfig.exe
6524	ipconfig.exe
1112	ipconfig.exe
2796	ipconfig.exe
4332	ipconfig.exe
4648	ipconfig.exe
3180	ipconfig.exe
4584	ipconfig.exe
6168	ipconfig.exe
5156	ipconfig.exe
4888	ipconfig.exe
1436	ipconfig.exe
6440	ipconfig.exe
3996	ipconfig.exe
1252	ipconfig.exe
2016	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276343569068051"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{B52C33B1-A9D8-4FC9-9273-66048FD5E1EF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2836	wrljdbwtomgeywqo.exe
2836	wrljdbwtomgeywqo.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5280	i_ztrljeytom.exe
Token: SeDebugPrivilege	3272	i_jgbytrljgb.exe
Token: SeDebugPrivilege	3332	i_aysqligayt.exe
Token: SeDebugPrivilege	5544	i_dxvpnlfday.exe
Token: SeDebugPrivilege	3384	i_snkicavsqk.exe
Token: SeDebugPrivilege	4316	i_ausnkfcxvp.exe
Token: SeDebugPrivilege	4484	i_hczurmkecw.exe
Token: SeDebugPrivilege	5732	i_romhezxrpb.exe
Token: SeDebugPrivilege	7116	i_pjhbzwrojh.exe
Token: SeDebugPrivilege	4192	i_rojgbztrlj.exe
Token: SeDebugPrivilege	824	i_tnigdytqli.exe
Token: SeDebugPrivilege	5660	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	2432	i_ifdxvsqnif.exe
Token: SeDebugPrivilege	6752	i_vsmkhfdxvq.exe
Token: SeDebugPrivilege	1852	i_mkecxupnhf.exe
Token: SeDebugPrivilege	5932	i_ecwupmkecx.exe
Token: SeDebugPrivilege	5704	i_mjhezxrpjh.exe
Token: SeDebugPrivilege	2488	i_ywuomgezwr.exe
Token: SeDebugPrivilege	2192	i_ljdbzwtolg.exe
Token: SeDebugPrivilege	3480	i_ywtolgeywq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 2836	6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 6124 wrote to memory of 4272	6124	2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4272 wrote to memory of 6028	4272	iexplore.exe	91
PID 6028 wrote to memory of 4736	6028	msedge.exe	92
PID 6028 wrote to memory of 5268	6028	msedge.exe	94
PID 6028 wrote to memory of 7028	6028	msedge.exe	96
PID 6028 wrote to memory of 7028	6028	msedge.exe	96
PID 6028 wrote to memory of 6188	6028	msedge.exe	95
PID 6028 wrote to memory of 6188	6028	msedge.exe	95
PID 6028 wrote to memory of 6188	6028	msedge.exe	95
PID 6028 wrote to memory of 4332	6028	msedge.exe	97
PID 6028 wrote to memory of 4332	6028	msedge.exe	97
PID 6028 wrote to memory of 4332	6028	msedge.exe	97
PID 6028 wrote to memory of 6972	6028	msedge.exe	98
PID 6028 wrote to memory of 6972	6028	msedge.exe	98
PID 6028 wrote to memory of 6972	6028	msedge.exe	98
PID 2836 wrote to memory of 4796	2836	wrljdbwtomgeywqo.exe	101
PID 1808 wrote to memory of 4124	1808	ztrljeytom.exe	104
PID 2836 wrote to memory of 5104	2836	wrljdbwtomgeywqo.exe	107
PID 6028 wrote to memory of 6752	6028	msedge.exe	110
PID 6028 wrote to memory of 2372	6028	msedge.exe	109
PID 6028 wrote to memory of 6752	6028	msedge.exe	110
PID 6028 wrote to memory of 2372	6028	msedge.exe	109
PID 6028 wrote to memory of 1500	6028	msedge.exe	112
PID 2836 wrote to memory of 3088	2836	wrljdbwtomgeywqo.exe	117
PID 5516 wrote to memory of 5504	5516	jgbytrljgb.exe	119
PID 6028 wrote to memory of 4868	6028	msedge.exe	122
PID 6028 wrote to memory of 4868	6028	msedge.exe	122
PID 6028 wrote to memory of 4868	6028	msedge.exe	122
PID 6028 wrote to memory of 5160	6028	msedge.exe	123
PID 6028 wrote to memory of 5160	6028	msedge.exe	123
PID 6028 wrote to memory of 5160	6028	msedge.exe	123
PID 2836 wrote to memory of 6628	2836	wrljdbwtomgeywqo.exe	124
PID 6028 wrote to memory of 5640	6028	msedge.exe	128
PID 6028 wrote to memory of 5640	6028	msedge.exe	128
PID 6028 wrote to memory of 5640	6028	msedge.exe	128
PID 2836 wrote to memory of 3328	2836	wrljdbwtomgeywqo.exe	129
PID 688 wrote to memory of 3156	688	aysqligayt.exe	131
PID 2836 wrote to memory of 5364	2836	wrljdbwtomgeywqo.exe	134
PID 2836 wrote to memory of 2208	2836	wrljdbwtomgeywqo.exe	138
PID 2168 wrote to memory of 4296	2168	dxvpnlfday.exe	140
PID 2836 wrote to memory of 6936	2836	wrljdbwtomgeywqo.exe	144
PID 6028 wrote to memory of 6988	6028	msedge.exe	146
PID 6028 wrote to memory of 4408	6028	msedge.exe	147
PID 6028 wrote to memory of 5608	6028	msedge.exe	148
PID 2836 wrote to memory of 3708	2836	wrljdbwtomgeywqo.exe	151
PID 1332 wrote to memory of 2628	1332	snkicavsqk.exe	153
PID 2836 wrote to memory of 3260	2836	wrljdbwtomgeywqo.exe	156
PID 2836 wrote to memory of 3956	2836	wrljdbwtomgeywqo.exe	160
PID 2332 wrote to memory of 916	2332	ausnkfcxvp.exe	162
PID 2836 wrote to memory of 6964	2836	wrljdbwtomgeywqo.exe	165
PID 2836 wrote to memory of 3640	2836	wrljdbwtomgeywqo.exe	169
PID 6160 wrote to memory of 6684	6160	hczurmkecw.exe	171
PID 2836 wrote to memory of 3292	2836	wrljdbwtomgeywqo.exe	174
PID 2836 wrote to memory of 4480	2836	wrljdbwtomgeywqo.exe	178
PID 6528 wrote to memory of 6048	6528	romhezxrpb.exe	180
PID 2836 wrote to memory of 5180	2836	wrljdbwtomgeywqo.exe	183
PID 6028 wrote to memory of 5904	6028	msedge.exe	187
PID 6028 wrote to memory of 5904	6028	msedge.exe	187
PID 2836 wrote to memory of 1468	2836	wrljdbwtomgeywqo.exe	190
PID 1500 wrote to memory of 5612	1500	pjhbzwrojh.exe	192
PID 2836 wrote to memory of 6412	2836	wrljdbwtomgeywqo.exe	195
PID 2836 wrote to memory of 1792	2836	wrljdbwtomgeywqo.exe	199
PID 5368 wrote to memory of 3332	5368	rojgbztrlj.exe	201

C:\Users\Admin\AppData\Local\Temp\2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_798fa99ad9153395dea227921c89f9d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Temp\wrljdbwtomgeywqo.exe
  C:\Temp\wrljdbwtomgeywqo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljeytom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4796
  - - C:\Temp\ztrljeytom.exe
      C:\Temp\ztrljeytom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljeytom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5104
  - - C:\Temp\i_ztrljeytom.exe
      C:\Temp\i_ztrljeytom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbytrljgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3088
  - - C:\Temp\jgbytrljgb.exe
      C:\Temp\jgbytrljgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbytrljgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6628
  - - C:\Temp\i_jgbytrljgb.exe
      C:\Temp\i_jgbytrljgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqligayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\aysqligayt.exe
      C:\Temp\aysqligayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqligayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_aysqligayt.exe
      C:\Temp\i_aysqligayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnlfday.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2208
  - - C:\Temp\dxvpnlfday.exe
      C:\Temp\dxvpnlfday.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnlfday.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6936
  - - C:\Temp\i_dxvpnlfday.exe
      C:\Temp\i_dxvpnlfday.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicavsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3708
  - - C:\Temp\snkicavsqk.exe
      C:\Temp\snkicavsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicavsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3260
  - - C:\Temp\i_snkicavsqk.exe
      C:\Temp\i_snkicavsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3956
  - - C:\Temp\ausnkfcxvp.exe
      C:\Temp\ausnkfcxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6964
  - - C:\Temp\i_ausnkfcxvp.exe
      C:\Temp\i_ausnkfcxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3640
  - - C:\Temp\hczurmkecw.exe
      C:\Temp\hczurmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3292
  - - C:\Temp\i_hczurmkecw.exe
      C:\Temp\i_hczurmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romhezxrpb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4480
  - - C:\Temp\romhezxrpb.exe
      C:\Temp\romhezxrpb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romhezxrpb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Temp\i_romhezxrpb.exe
      C:\Temp\i_romhezxrpb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzwrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1468
  - - C:\Temp\pjhbzwrojh.exe
      C:\Temp\pjhbzwrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzwrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6412
  - - C:\Temp\i_pjhbzwrojh.exe
      C:\Temp\i_pjhbzwrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1792
  - - C:\Temp\rojgbztrlj.exe
      C:\Temp\rojgbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\i_rojgbztrlj.exe
      C:\Temp\i_rojgbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnigdytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6892
  - - C:\Temp\tnigdytqli.exe
      C:\Temp\tnigdytqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnigdytqli.exe ups_ins
    3⤵
    PID:2928
  - - C:\Temp\i_tnigdytqli.exe
      C:\Temp\i_tnigdytqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    PID:4348
  - - C:\Temp\bvtnlfdyvq.exe
      C:\Temp\bvtnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    PID:6600
  - - C:\Temp\i_bvtnlfdyvq.exe
      C:\Temp\i_bvtnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvsqnif.exe ups_run
    3⤵
    PID:2960
  - - C:\Temp\ifdxvsqnif.exe
      C:\Temp\ifdxvsqnif.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:7008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvsqnif.exe ups_ins
    3⤵
    PID:4492
  - - C:\Temp\i_ifdxvsqnif.exe
      C:\Temp\i_ifdxvsqnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsmkhfdxvq.exe ups_run
    3⤵
    PID:5656
  - - C:\Temp\vsmkhfdxvq.exe
      C:\Temp\vsmkhfdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsmkhfdxvq.exe ups_ins
    3⤵
    PID:524
  - - C:\Temp\i_vsmkhfdxvq.exe
      C:\Temp\i_vsmkhfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupnhf.exe ups_run
    3⤵
    PID:3428
  - - C:\Temp\mkecxupnhf.exe
      C:\Temp\mkecxupnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhf.exe ups_ins
    3⤵
    PID:2480
  - - C:\Temp\i_mkecxupnhf.exe
      C:\Temp\i_mkecxupnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmkecx.exe ups_run
    3⤵
    PID:6832
  - - C:\Temp\ecwupmkecx.exe
      C:\Temp\ecwupmkecx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmkecx.exe ups_ins
    3⤵
    PID:5884
  - - C:\Temp\i_ecwupmkecx.exe
      C:\Temp\i_ecwupmkecx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhezxrpjh.exe ups_run
    3⤵
    PID:6108
  - - C:\Temp\mjhezxrpjh.exe
      C:\Temp\mjhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhezxrpjh.exe ups_ins
    3⤵
    PID:2796
  - - C:\Temp\i_mjhezxrpjh.exe
      C:\Temp\i_mjhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywuomgezwr.exe ups_run
    3⤵
    PID:4344
  - - C:\Temp\ywuomgezwr.exe
      C:\Temp\ywuomgezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywuomgezwr.exe ups_ins
    3⤵
    PID:5924
  - - C:\Temp\i_ywuomgezwr.exe
      C:\Temp\i_ywuomgezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbzwtolg.exe ups_run
    3⤵
    PID:6252
  - - C:\Temp\ljdbzwtolg.exe
      C:\Temp\ljdbzwtolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbzwtolg.exe ups_ins
    3⤵
    PID:1116
  - - C:\Temp\i_ljdbzwtolg.exe
      C:\Temp\i_ljdbzwtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtolgeywq.exe ups_run
    3⤵
    PID:2144
  - - C:\Temp\ywtolgeywq.exe
      C:\Temp\ywtolgeywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtolgeywq.exe ups_ins
    3⤵
    PID:6844
  - - C:\Temp\i_ywtolgeywq.exe
      C:\Temp\i_ywtolgeywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffeb14bc188,0x7ffeb14bc194,0x7ffeb14bc1a0
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,438796397782462586,8156978628544996038,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
      4⤵
      System Time Discovery
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,13706050238028188649,11553327094147975325,262144 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
      4⤵
      PID:6188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,4896437415629974186,5147127041090520814,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
      4⤵
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,13176946846530136120,1728505188645650879,2097152 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,15043385942242324992,8867758577686178383,2097152 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,1513300405412480484,14129545161905075465,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17726951862969042802,14188747463239240337,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,6755690762202567647,4588490241521366561,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:6984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,6755690762202567647,4588490241521366561,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6400,i,16087261559946220133,12247730364398977814,2097152 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5956,i,15420396178159799350,502792954939952420,2097152 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5756,i,4622644650092642909,8043797726330109080,2097152 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,7093047445763353593,1741825004855411350,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,12150676744906167957,6238014205777684692,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,13600100799590966109,17920330423747600181,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,14690411339548145142,3772173829928491813,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,11421244524668973418,9010308596949781571,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,8218699809244562560,16360177816403764481,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,13572439444007725240,327627555595291434,262144 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:10
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1216,i,15726750473717319969,11003242716168760599,524288 --field-trial-handle=2468,i,4746464203082234932,17554649220668729977,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:980

C:\Temp\wrljdbwtomgeywqo.sys
C:\Temp\wrljdbwtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4932

C:\Temp\rljdywtolj.sys
C:\Temp\rljdywtolj.sys
1⤵
- Executes dropped EXE
PID:6812

C:\Temp\dywqolfdbv.sys
C:\Temp\dywqolfdbv.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
- Executes dropped EXE
PID:5884

C:\Temp\snkicavsqn.sys
C:\Temp\snkicavsqn.sys
1⤵
- Executes dropped EXE
PID:3852

C:\Temp\ausmkhfdxv.sys
C:\Temp\ausmkhfdxv.sys
1⤵
- Executes dropped EXE
PID:6660

C:\Temp\pkhcamkecw.sys
C:\Temp\pkhcamkecw.sys
1⤵
- Executes dropped EXE
PID:3436

C:\Temp\rpjhecwurp.sys
C:\Temp\rpjhecwurp.sys
1⤵
- Executes dropped EXE
PID:2940

C:\Temp\bzwrpjhbzt.sys
C:\Temp\bzwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:5636

C:\Temp\qoljdbwtom.sys
C:\Temp\qoljdbwtom.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\bywqolgbyw.sys
C:\Temp\bywqolgbyw.sys
1⤵
- Executes dropped EXE
PID:7144

C:\Temp\dyvqoifdyv.sys
C:\Temp\dyvqoifdyv.sys
1⤵
PID:6904

C:\Temp\fdxvpnkiga.sys
C:\Temp\fdxvpnkiga.sys
1⤵
PID:4556

C:\Temp\vsnkfcxusq.sys
C:\Temp\vsnkfcxusq.sys
1⤵
PID:5280

C:\Temp\vsnkfcxvpn.sys
C:\Temp\vsnkfcxvpn.sys
1⤵
PID:2684

C:\Temp\fzxrpmhfzx.sys
C:\Temp\fzxrpmhfzx.sys
1⤵
PID:484

C:\Temp\mjebzurpmh.sys
C:\Temp\mjebzurpmh.sys
1⤵
PID:2000

C:\Temp\hbzuomjecz.sys
C:\Temp\hbzuomjecz.sys
1⤵
PID:4812

C:\Temp\mjebwtolge.sys
C:\Temp\mjebwtolge.sys
1⤵
PID:2784

C:\Temp\wtnljgeywq.sys
C:\Temp\wtnljgeywq.sys
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkhfdxv.sys

Path C:\Temp\ausmkhfdxv.sys
Size 293KB
SHA256 398378899448880b523c919f185ecb40bccebde29ed67d1484a8c594a9528970
MD5 a743d75eeecde4da906d20f9dbbe0f63
SHA1 b97daf796dd731f44c07681eb38e1a5c245e2370
SHA512 00f0351eb31208ac5fdb421468cb90332bbe732541559250d4a0d37a93f04d8dd8396fc58b3e50f12f11f91c701dc23c310f6549e355bee4fef1988d08a9f756
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T196545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfcxvp.exe

Path C:\Temp\ausnkfcxvp.exe
Size 389KB
SHA256 61437588e882dbfa4238a74e4b60f977f7eec02e84b5778082a585a3faa027f1
MD5 91249208ed07ce6e9f870f30db99e264
SHA1 fc87323675f41421c24cc35cfdc59a4386f9cb54
SHA512 86216fac260029949788e909ad93aa422cffdcbc5df1033f227afb60dc4a7690c350a714032437fcd941891984528dc700a8d95a50a8bd231d97e6f0a45c8bc5
SSDEEP 3072:ouxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ouxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqligayt.exe

Path C:\Temp\aysqligayt.exe
Size 389KB
SHA256 9024c3ffc2e8f7697c476018c8dd74ba0fe88d5991acbea2e5bef031044abdeb
MD5 b5efc75444466e7bda8938032b22df72
SHA1 b560b5173a8c4d170b31e99d0614154a75900369
SHA512 73bac1956281bd8e4f520875417044cd65593a60c335331dd8ce0b6a72e53a32b3378e435a0af52293dd3ac7722f29a93451510333508fcaf35ec61231e03375
SSDEEP 3072:muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnlfday.exe

Path C:\Temp\dxvpnlfday.exe
Size 389KB
SHA256 5b939303774c6ee1f19d05f2e3e4c89c985a453aef426df8478230b1fe1c194d
MD5 d5c0fa8966cc94db551c759e80417756
SHA1 e0738178b6164fd17c0024042b3012c591d39d07
SHA512 56deab3b9c0cc47a4c0e16b7da9591751ac44f5644fda44c942999f0e9b65614f16c2939c65b41e6e7122c7c8d9b396a0f98aadf20c5a43fb03bf55eb30c7293
SSDEEP 3072:uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqolfdbv.sys

Path C:\Temp\dywqolfdbv.sys
Size 293KB
SHA256 4ed40224aeec226828066314c8144d109bcdd1761424c6943b00563db786b921
MD5 aecd88ea6992a2650849ab964797d569
SHA1 6110e91a031bc0caf75b548119ac19729507360c
SHA512 a985a47150d622106fe0e9142b7409e0865ca8c02e0504c4d830312eaa80ecd5a35a1be1c6c3129cd099651d2d39dfaaf7bebdf2f38e7f43abe285e50906db01
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausnkfcxvp.exe

Path C:\Temp\i_ausnkfcxvp.exe
Size 389KB
SHA256 c9dfe5af7632d2b55ecbde27074858eed657e53a8eb053508e8608190f96c14b
MD5 4c863d687d335532bf431cac97d69c85
SHA1 520229445b290ce0add0ef3d7945f9ae21db2e18
SHA512 e06914312de1aa8b3380fa6effba9a6d852d636ce27d14904c2417d2370b11f8955ccf90bb2c2a916a232b0effc60e8251a3177af8d7d3b8db6b2d20037b2e04
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqligayt.exe

Path C:\Temp\i_aysqligayt.exe
Size 389KB
SHA256 2897ac9987eb1fdf50856f41dba5d6ff5bae543724d1792f43fb8e0daf13fd62
MD5 0625eb4b7b359ea83fb0742b296433c1
SHA1 f82685263bf39d0effd5717b08d9f1da90dfe201
SHA512 3d4ce37f18b32b9b8869256004a20476e092496f3d7276c8f4370b2ba493c2b46762b0609d22c3e1027e7a256729bd56de1c8f8db6979cc3401c7956705361aa
SSDEEP 3072:Uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnlfday.exe

Path C:\Temp\i_dxvpnlfday.exe
Size 389KB
SHA256 cb4c7cef943beacd84a88b662fc667c1a69e2bf8ae9578ea64a7eb7dae3f65f1
MD5 906ff1255da5954698bd694be79cb20c
SHA1 b73e0fb6bf1a69b9dd693b66329353e7bfa680e5
SHA512 f8faa4df97d3df0ab7ffc93c1c619493dbcc22db6f5b3a971b1671856f9fcb26b186881bd8216a4b71beaccf9e684a44e4c2d6007a04d9ef44816ddd8e86722e
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbytrljgb.exe

Path C:\Temp\i_jgbytrljgb.exe
Size 389KB
SHA256 2cb130b9c64c635341a3a167f5b973f59ae75415efe45a8714d7dae51bcc823a
MD5 ea92955f1354fb69a2573caa8c417c19
SHA1 3c2e5891fd762e8e1a6269cbe7ab88692199578b
SHA512 af3442e94dc0348d0257df60978a21e3c97c9980943ed7239c788a039799bfff66dcbe309a62ce93011f94f763218786a56f2b40fc620160810a4bb287c390ff
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkicavsqk.exe

Path C:\Temp\i_snkicavsqk.exe
Size 389KB
SHA256 8575d6f052463a0d8847978bb7908dd6de4bb01870d421318200c00a0d4091ae
MD5 eb5bb6fd87ffd152ee706f44afb8914a
SHA1 36feba142e7a5291b185b7fca779b7aaa37ea642
SHA512 0ea92b9d1dea3d9d8c540c15dc3924d1a61a35342e25e2ee958bf988fdff192c4c0177ed06e8484562f44c632729dfd73e576ecef3a389c9d247b515ef0f339c
SSDEEP 3072:1uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljeytom.exe

Path C:\Temp\i_ztrljeytom.exe
Size 389KB
SHA256 578ca4bde479744363e761e94478b2563c1186b734eaaee49eda1da21eac4df7
MD5 0692659c35ffe89258301139b5a89b31
SHA1 7787b670aff402d6cd418f238657cc3c0db5202b
SHA512 16ee027b0c75acc24aa45f5c684d5f9c314af21cb84d5e44b7d203a1c3f3dd9c0e4e52641ebcab641862f2592728292bfa3d9d038ab16de2e86981bb8ecc4313
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytrljgb.exe

Path C:\Temp\jgbytrljgb.exe
Size 389KB
SHA256 6c2180c426a8e5aa446e183add7f048865ade1c0867bad4d8986d9bacee30d08
MD5 730c716b0801eec6b4806d65542c8e2e
SHA1 854816d224783f50b30517d1875c3e7c83c2d003
SHA512 6f7a4eaa9c6064c9f0855dc1593bcbd3e351813f51f8bd3f30e721dd747f2a929ae02f39b07f594a8348e9bc29b0516211adeebcdd7e28ad913f0e19a6e064fd
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqniga.sys

Path C:\Temp\lfdxvqniga.sys
Size 293KB
SHA256 7eee7714de9955031ae32a726fd593e39716cb08a910712c2c94dc181897dbc5
MD5 70a860ca29a6f405100df0efaf047005
SHA1 e4347b16f460535e014baa32fcd347f134acd41d
SHA512 8676abe0485a0342aef24e26c880e27b2a7d1c456a305551e45391e97daa6ee95737fb2835b3df80184a5834845fe2cefce5b3b11b7b4e3b0ed6e495b52c1ea3
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdywtolj.sys

Path C:\Temp\rljdywtolj.sys
Size 293KB
SHA256 ee74227f3be3371b613100ac618c75b1cefa54af213124a296c0f1f36e1e331a
MD5 f4fbe4dbdc34f6af88fac3e99ed94e77
SHA1 d56b325b8834c245661ea69f82b22a1b1ec2cdba
SHA512 f2c0a9415e5e8da00ab8bd6022e1b14be8a6b9ecf3840564d0168390d1ce498086a3cb43a9456febf1192729a752f74346e1728ab1e1ce31fcecdd3197c32d50
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdO:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicavsqk.exe

Path C:\Temp\snkicavsqk.exe
Size 389KB
SHA256 f9a759d4bda75b82ab276ca01d9fd23daf0fa886575cd5008abe693969dcd593
MD5 6526fdbcb57f81092f940fe029dccec6
SHA1 181dd4e36b5e9773b5611035cf467a317a7d799c
SHA512 3ca0804a57ca171190dc91522a56fbe3077f8ef8833db4f0a58715c8801ab37fd90e9b46468b34bf3fd7cac916f5b69e1e09c34a189ec5663b79c52efd56fb58
SSDEEP 3072:+uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicavsqn.sys

Path C:\Temp\snkicavsqn.sys
Size 293KB
SHA256 fa6749f5f432da2799207370f3910c2339f51103b87dfc293b43e4cc14bf2acd
MD5 fe0f7f40345001b9c6b90a83f5e7f7fc
SHA1 0ca4c998b0f65cb05bd3eb740413dc49086896a4
SHA512 5f4fbd6f4960d0dc1d6994947d2bf61996518364136a94e679a92b300d544268ee8b4f224861dcc28a14864a3c07d681187c77a01cf6d44f2d5391056c57c47b
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T12D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrljdbwtomgeywqo.exe

Path C:\Temp\wrljdbwtomgeywqo.exe
Size 389KB
SHA256 23c8f8ac313b0fdfd0553ab49d308fdea60ac14ea1d8b7cf49a873954f2bff5b
MD5 ad717522b81f212909bb180287ff6f4e
SHA1 59e65aed9a6b3c5924c99ca7251a75fc7ff58918
SHA512 e28d01f93dc524affe23db7ae993ab7254ac99704ba7172885b98eca4184713284e0d47ff7db79b0e753c10882d3f89d92ca4aa2e278474da903d66c91376162
SSDEEP 3072:Juxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrljdbwtomgeywqo.sys

Path C:\Temp\wrljdbwtomgeywqo.sys
Size 293KB
SHA256 44b5d945d87af7b0815e54f3ca5c2f36cebce7a96598e06944a5295b65c78e73
MD5 7ea8e6847cbfd0e6248dc43245989bff
SHA1 e94184531cfdf8cdb1bada48a80570f9fac45024
SHA512 9c6a37f4e1bf9eab43762eb83e54b88103d3e4262ac6cab2b087536c984951ccb8a80446fb003cdc994d35f02bb2e866bff156691982d4e604d883134291571b
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljeytom.exe

Path C:\Temp\ztrljeytom.exe
Size 389KB
SHA256 092545dd9c44a4f3c8049372566fb8ec9bd02d10962d7708e486fd9fc910c332
MD5 4e61134d28374d5cc2d04679a37e9cbb
SHA1 724edcf9a5591d2fa010013d6c331f4a195107fd
SHA512 ac30701793e3714430992e7bab0458137a12c7549a3e9c3c1f4a5abb50238ca87bc35538a08b94553259cf72c15d2a05bfe7e3bf72bc29e1061a4732b14c90a9
SSDEEP 3072:euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55097ae3e8e09b80bce3e3812987755ecca81384247ee729ac4262e176ac5f09
MD5 c1487ee49f8ccdda3c17fbfc8fc5855d
SHA1 22e1d68df0a4913cac107ff5af4cb564d869972f
SHA512 cdb748df700c498fc821f44fbc432a65b818ee7361fa8899d196bb2c32c7c86bd90573282a6465e8a2d722cbc27ecdf3b960978409d4ad6fc7fe8483e801e91f
TLSH
T1FFD0C0703F08B841C5D4313045378700BE924116340FC200F052C10C4C398E4BBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068243c4584907cd5534c5544cd99e57be64a6790401ecb34e138b941be50d8
MD5 487201c9d5f8581b404c328a57b95064
SHA1 9118509fc3137d34e8bd3939f3883afe9e9beffe
SHA512 6e13ca057d8cd084911b83c51e96582deab6bc970f1d4d15642021e2d461c0a71257fc4e9734447735b2fbe584808ce6833fbe556372a5954dea7135d7b571e7
TLSH
T1E8D080747F18B841C5D53571553B8700BE964116355FC645F052D10C4C398E5FBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 298dbfd720b4c23219184ee34c22486818d53dc1cb117db25400c864c8cddcb6
MD5 7972c23af2eeeeb9f7a4aeb624c7087d
SHA1 f5f4330c0c62758acc19c539c5880471cc9e56e7
SHA512 5908210aac901fef9eff627fa7b5b46b45b9a613aeed72265a21f77e6f607324b37fabf98b92bcf04cdc5d42a687cf4bcbba9ff6fd21ca754a9b5d5b5c4fce05
TLSH
T122E022BAD821EC6B18F90B5961A4024AEB5613172A40496BBA3C810D8FF163A128A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1c4181a48bc7ad0d189adc07cddd899657fa2ef4c788f6a5331bc15eda066624
MD5 a53b73295da754c8cb29c2827cc8e3b9
SHA1 7f6629d9a5a9ad633856a272c21a46393765c614
SHA512 f58ff78586930017a1052da78625fcbe32da514d33743c0b481bc2e6b1dedba519bb640cc5f3ff30b16a909ffeedcc74975c1fd80fc5ead9e14609cddecb5d73
TLSH
T15841AFF783E8856D8D0155F0AA146E2FDE2D0915432C3D5AC9E4AF1B93E3471E182A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ed700ea689f7c89f9e9ee8adea6b093ff7c30db168e489f502fc21afeef87ed3
MD5 cd7405f7841097ab1810b9e84b2e7388
SHA1 99aca95fc2df58b59961bd1be579d91db1bff94a
SHA512 de8f6539a2ae25c4b11c6d142a9e0296c6e3ed1eadd56e4b4d3b3406800e2fcfa13d3d0941019455e7efd5fd1ebac348db47f9e8eded84972f4622a75378e98f
SSDEEP 384:sxRtTq3J/fxscw515OhvNQH/5g/QvT3Ub:sxu3J/fzQiu/5CQvTi
TLSH
T1A372E9166938993B9CDBD219FA857FA3D2F81573E1904E44AAFC8B0C11E76DC211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d0c52e0032cf9c58a97e41af17604d027509562c1522474da56b075b9e3b9aca
MD5 0e0317d8e66e0b439f713f5d1027ee3e
SHA1 12f65fe6b3e682d0152344593e93293536e433d2
SHA512 ecaa24d73ddd9f6a9fe59d73ddca42dca974c839a12898a17961af61976eeb8cda97f8d19f2fa8e0f98d256040854e42e4c48d83f79e361c5cc151597944b2e2
SSDEEP 192:sxRtRuyMqZjK1Ml8wcJ/fxsEqm7Z5Oh+2NBzoA8pw/g6+WNIYYmtvT9GHnEIgjaJ:sxRthCJ/fxsEV15OhvN8w/5IkvT3jW
TLSH
T15C62D8156A38993B8CDBD219FA457FA3D6FC1533A1905E48AAFC8B0C11E76DC211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4246d8538dba45c4665b75d33a911e0c0246e29b769cd0095bad2c4c19654965
MD5 7d3bcb377db0169dcfd0be7ba17c4de5
SHA1 1f3b675132d724f9b4b3c4a76552e90386062d12
SHA512 aa90beca6b0e063226b05790add08485b048b307dbd4508c89608ac324fd30888ca197e920cd97fdb8c449d209f61695e70fdd2eda16a18b75645e2a98750c30
SSDEEP 192:sxRtRuyMqZjK1Ml8wcJ/fxscqm7Z5Oh+2NdzoA8pr7/g6+WNCgW/YY0tvT9GHnE1:sxRtTCJ/fxscV15OhvNQH/5g/KvT3OW
TLSH
T11C72D8156A34993B8CDBD219FA857B63D6FC1573E2904E48AAFC8B0C11E76DC211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 978699104d9926067af196c790b4bb6f33dc31892fb56cfae69241843a0a64fc
MD5 d64fe602741741fd2253a62affcd94e1
SHA1 e2bdd17df7396e92cdd9c9d5677aa19073b741a7
SHA512 7fece155a3db775beab5f3eed17d8226b881aa2461106b1b54559f5f9d319bbc29a9d92acf7e5677e2c98964f84d55d883ed01392f6db7406a76eb3742b539ae
SSDEEP 768:57pWlr7pLuL7S3WgTXf0F8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBAVdRtAroYAt6:57pWl9E7S3WgTXf0Fu1jaWAVntLYAA
TLSH
T1FEE2EC7B684CCB7F4F804E9CEC297E9E6DE802CF56D8895447EA840C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3a5223fc96e41a34f1d7a40a43656763be6b034f8c7d96d1801b6bbdccb03b98
MD5 731414c9de4aa67ffa6c75b1afe813ba
SHA1 63d2073924419a38e17dacca2e9ae7519e54808a
SHA512 3aeadcbe0339dca2957332c5430a54d92a4b8a05ca0758df32d1958d0492f29e446461b88c8a49dd0537a11bd1fa00160442a3dc7581488959b806a4ff861aac
SSDEEP 384:97SnL5NRMtAPjvR3R8LLAZrK610IK4cZ0/IAie3+7S6nkM94Z9Lr76TmtNFn3v20:ShJtf3BlQ1KbhJv385g
TLSH
T188B26151707B2700387E250A93B9842E5A4630A230DEF87B77A975E26F67E004FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a4950fc641e20c071d1aad1872c23a98581befc402313e4e423a078471069ee2
MD5 07f4d97c082434ef8fd02f5fdfbceabc
SHA1 410ba971b302fbdafaaf7903ce4442f44e543bcf
SHA512 a8475584d58e1a4a1ab31b7439ab62125b9bfdea70e78d11f5b6ddf6288de02b159c9613efbb3f3e280ab245c8741ff240d89ee79518de472c3c5d76506be412
SSDEEP 384:njiF1tNn/s3n9Sv8Nm8TUNTUlIR3t7bRlgTHQWUthfCIGNpUpjVmn15wbAjEJL1c:OF1j+9SvwgvbRl8rWlGNq5Vmn12bfJLG
TLSH
T1E0C23836EC94CA6BADE68FC9B709764AEEE4126781DC59D8DDD80D4D00D72DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fab781e3576bec8a15771044ad53e2e68c78ed8c79d43dbbd7de4356e86d0d0c
MD5 28f7ac94d0c1409eaeb47b720b9446bb
SHA1 2b2196e009800c405e6225184fb2ff0addcc22ee
SHA512 a848032310800e20fc4bb2083a82b6dd78c1d58c10d56f60624d91760202ed7467cc5696cb492c46bdd18dc700bba12cc8f5c8928b0e67d5812745787799d19d
SSDEEP 384:n4iF1tNn/s3n9Sp8Ne8TUNTUlIR+t7bRlgIrrWUthfCIGNpUpyXXAdUOObjI9G6a:DF1j+9oHwgkbRlxiWlGNqEQdU29Mv
TLSH
T19FD26B36D855CE67ACE68BD9B35A7A9BEEE01267C48C5DC8D9D85E0C00C71ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4ecd58c26486e2da95f66ce753eef22ed5acb25ca154ef3cc447a96ab23a5d03
MD5 3f9edd14dedc123a0e675c786fc3ead6
SHA1 ef37568ba1acab1ea4107bfa0d2913fc7dc18f01
SHA512 10cef1af087d415db129f7323424b4d8b8173a1fad3f4ee613627fd1a4d295fb1e562c37fc4707e78c4ec799fc770761993fbbae3ff43823dc9e18d6764641fd
SSDEEP 384:n5iF1tNn/s3n9Sn8Ne8TUNTUlIR+t7bRlg0rrWUthfCIGNpUpyXXAdUOObjI9G6a:QF1j+9aHwgkbRlZiWlGNqEQdU29Mv
TLSH
T156D26B36D855CE67ACE68BD9B31A7A9BEEE01267C48C5DC8D9D85E0C00C71ED070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6820773cff53a66039109916103dfee4382a720735b254a8074c00d2dd10291c
MD5 8a59467cdf30e42f317dd86afa3d2f4d
SHA1 0fbdd7c80d7865798b2643516dbc9f51020624be
SHA512 1d24d3dd51437b530d6344d6d60893c254083cb23f8711b41c82303af7d795e0957e422a2b90d2713501120fc5f78c7b6d339ef621fb3566608b7d60db82810f
SSDEEP 384:n9iF1tNn/s3n9Sw8Ne8TUNTUlIR+t7bRlgIzrWUthfCIGNpUpyXXA5UOObjI9G6a:0F1j+9VHwgkbRl9iWlGNqEQ5U29Mv
TLSH
T16FE2B3F598D78977D89E4B87633D6E469AFCC167B4884988BBC84D0CCC821BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 915d60e94aa6b6fbd27ea68d980856b87a8f1ad96d7945a789b87e4cf3abec24
MD5 0e2d5f26457ebba6048a22d1875d4789
SHA1 0027f63021bfd92841b9e6f0acfdec77855bca83
SHA512 ccc7edcb58ee612c729ea9f80ca13159935399c3542d2972102b7e187ff1985310004cb97d53b06fc5bc3d1793edb678a7297a2a5e732729db3432810928356a
TLSH
T1513171E098383AD1C4BE09AF744B34FCA8D8C326F928343C6854ED98403E08E268083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7d04bac93c39e44f5108a9bfb2eb7a59110c8049565f5bf795ea62f5df0eea35
MD5 2aad24759a7fcaea9779601b5014abe0
SHA1 64bd2e68406d57922b397337a1a4a36805be2214
SHA512 03db6038b98a0552139f42f4000b64b7c73a5c2d287de00d91d026f378de5787d955fb4b8cd01981a6787c1ce650589f5818e829e29ee65bb4a83a55cee1e123
TLSH
T19C3140E0883829D1D4BE09BF744F24FC99E8D727F4A5343D2858ED59817D29D268043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 65dac5bdd962a2ad778dd6318f040d067be02832ded6437e5ff49eff9296d51f
MD5 2b4f70d63e09bbdebed15f4dc6e3e607
SHA1 a6e278394ddf536c4ce9be2d73b5c3e80c6f3bd1
SHA512 4babb852099c5a07b1d27f9153ecae049b9e358e06a94bf70b3dc8c7a7a47e0c0eea401042e9bdd4129bd70a651d7eeb7c7a5e3f901fc8a7ee52999e444922bd
TLSH
T1D63141E0983C29D2D4BE09BF741B34FC99E8D727F86435396454ED58513A19D368043F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a181fe1ac810fbe82f8d231fa7109fe3a326b4c8ced84f8e8f9f9483a5c98689
MD5 ba38ccfb699edfe74be7f5e4200359ed
SHA1 8b20984e787d795ee00e0812a0e327421f5e4f4b
SHA512 8a3533f9b6d4a6b55aab0ffd2bf72bbf9182ef8b873f2ce813c0ca627478ce3689e9439677f8e2237403223cb91f19c6ab758c109ac1466635e680d556ae51b6
TLSH
T1EC71008356B8D6B3C1DA5FF102835604F6BB2278472370200BA15586AA30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/484-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1660-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2000-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2784-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2836-349-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2940-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3436-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3852-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4556-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4952-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5280-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5636-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5884-214-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6660-248-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6812-158-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6812-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6904-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7144-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download