systex | c9ad265ae60722a0db03f33fb7ee627bec27e15a38be4d1c3ab1c2daadceba30

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260706-2tsdraas9p
SHA256 c9ad265ae60722a0db03f33fb7ee627bec27e15a38be4d1c3ab1c2daadceba30
MD5 01ee40ea80e7e265d899c63b124a8518
SHA1 92556dca0d3fd0ab6c507b6aee9ae7cbb5c04f2e
SHA512 e3a3a96e7c43e7b7b787d8f0097b33055f60251c4f18167300abacd8dbb2ce0cda28b40d59883081bede7627916ffb897bc718e226531d07b2ca30b5c18ca26e
SSDEEP 3072:OuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4184	wrpjhbzurpjhbztr.exe
4448	wrpjhbzurpjhbztr.sys
1644	CreateProcess.exe
424	eztrpjhezt.exe
4988	CreateProcess.exe
5500	CreateProcess.exe
5704	i_eztrpjhezt.exe
4412	bzwrpjhbzt.sys
3600	CreateProcess.exe
4764	qomgebytrl.exe
2512	CreateProcess.exe
3428	CreateProcess.exe
1492	i_qomgebytrl.exe
6140	olgeywrojd.sys
1632	CreateProcess.exe
1904	igeywqoigb.exe
2332	CreateProcess.exe
5956	CreateProcess.exe
5168	i_igeywqoigb.exe
2744	ayvqoljdby.sys
2780	CreateProcess.exe
1552	aysqoljdbv.exe
3552	CreateProcess.exe
4480	CreateProcess.exe
5040	i_aysqoljdbv.exe
1112	avtnlfdxvq.sys
4460	CreateProcess.exe
5140	tnlfdysqki.exe
5552	CreateProcess.exe
2620	CreateProcess.exe
4664	i_tnlfdysqki.exe
3676	qkicavsnkf.sys
2988	CreateProcess.exe
5224	axvsnkifax.exe
4892	CreateProcess.exe
912	CreateProcess.exe
5092	i_axvsnkifax.exe
5712	pkicausmkf.sys
4732	CreateProcess.exe
3024	kicausnkfd.exe
2132	CreateProcess.exe
3104	CreateProcess.exe
2520	i_kicausnkfd.exe
2776	khcauspnhf.sys
2496	CreateProcess.exe
4908	jhczusmkec.exe
4148	CreateProcess.exe
2712	CreateProcess.exe
5556	i_jhczusmkec.exe
5004	jhezwurmje.sys
3392	CreateProcess.exe
4472	ecwurmkecx.exe
2792	CreateProcess.exe
5316	CreateProcess.exe
2856	i_ecwurmkecx.exe
264	pjhbzurmke.sys
3144	CreateProcess.exe
3812	wrojhbztrl.exe
3672	CreateProcess.exe
1428	CreateProcess.exe
5724	i_wrojhbztrl.exe
3964	tqomgebwtr.sys
5472	CreateProcess.exe
3228	ywtoljgbzt.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1745389425\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1745389425\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1804333479\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1505726946\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1505726946\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1745389425\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1745389425\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_98577816\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_1804333479\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsnkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgebytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqolfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgebytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqoljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqolfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrpjhezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsnkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtoljgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtoljgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrpjhezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqoljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5760	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3500	ipconfig.exe
3640	ipconfig.exe
4728	ipconfig.exe
2088	ipconfig.exe
5668	ipconfig.exe
2920	ipconfig.exe
3028	ipconfig.exe
2184	ipconfig.exe
4812	ipconfig.exe
1872	ipconfig.exe
5828	ipconfig.exe
1144	ipconfig.exe
4500	ipconfig.exe
2072	ipconfig.exe
2384	ipconfig.exe
5604	ipconfig.exe
3500	ipconfig.exe
2688	ipconfig.exe
4812	ipconfig.exe
5716	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{DC59C95E-DEF0-42DE-BC52-399217C937E8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe
4184	wrpjhbzurpjhbztr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5704	i_eztrpjhezt.exe
Token: SeDebugPrivilege	1492	i_qomgebytrl.exe
Token: SeDebugPrivilege	5168	i_igeywqoigb.exe
Token: SeDebugPrivilege	5040	i_aysqoljdbv.exe
Token: SeDebugPrivilege	4664	i_tnlfdysqki.exe
Token: SeDebugPrivilege	5092	i_axvsnkifax.exe
Token: SeDebugPrivilege	2520	i_kicausnkfd.exe
Token: SeDebugPrivilege	5556	i_jhczusmkec.exe
Token: SeDebugPrivilege	2856	i_ecwurmkecx.exe
Token: SeDebugPrivilege	5724	i_wrojhbztrl.exe
Token: SeDebugPrivilege	4576	i_ywtoljgbzt.exe
Token: SeDebugPrivilege	5636	i_gbytrljdbv.exe
Token: SeDebugPrivilege	6088	i_daysqolfda.exe
Token: SeDebugPrivilege	2052	i_faxsqkicav.exe
Token: SeDebugPrivilege	3956	i_kfcavsnkfd.exe
Token: SeDebugPrivilege	1420	i_fcxupnhfzx.exe
Token: SeDebugPrivilege	5908	i_khcwupmhfz.exe
Token: SeDebugPrivilege	5004	i_hezwrpjztr.exe
Token: SeDebugPrivilege	2588	i_jebwuomgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4184	2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 2548 wrote to memory of 5980	2548	2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 5980 wrote to memory of 3944	5980	iexplore.exe	89
PID 3944 wrote to memory of 5904	3944	msedge.exe	90
PID 3944 wrote to memory of 5760	3944	msedge.exe	92
PID 3944 wrote to memory of 488	3944	msedge.exe	93
PID 3944 wrote to memory of 488	3944	msedge.exe	93
PID 3944 wrote to memory of 488	3944	msedge.exe	93
PID 3944 wrote to memory of 5244	3944	msedge.exe	94
PID 3944 wrote to memory of 5244	3944	msedge.exe	94
PID 3944 wrote to memory of 4436	3944	msedge.exe	95
PID 3944 wrote to memory of 4436	3944	msedge.exe	95
PID 3944 wrote to memory of 4436	3944	msedge.exe	95
PID 3944 wrote to memory of 3616	3944	msedge.exe	96
PID 3944 wrote to memory of 3616	3944	msedge.exe	96
PID 3944 wrote to memory of 3616	3944	msedge.exe	96
PID 3944 wrote to memory of 5888	3944	msedge.exe	97
PID 3944 wrote to memory of 5888	3944	msedge.exe	97
PID 3944 wrote to memory of 5888	3944	msedge.exe	97
PID 3944 wrote to memory of 5696	3944	msedge.exe	98
PID 3944 wrote to memory of 5696	3944	msedge.exe	98
PID 3944 wrote to memory of 5696	3944	msedge.exe	98
PID 3944 wrote to memory of 4296	3944	msedge.exe	99
PID 3944 wrote to memory of 4296	3944	msedge.exe	99
PID 4184 wrote to memory of 1644	4184	wrpjhbzurpjhbztr.exe	103
PID 424 wrote to memory of 4988	424	eztrpjhezt.exe	106
PID 3944 wrote to memory of 5768	3944	msedge.exe	109
PID 3944 wrote to memory of 5768	3944	msedge.exe	109
PID 3944 wrote to memory of 2448	3944	msedge.exe	110
PID 3944 wrote to memory of 2448	3944	msedge.exe	110
PID 3944 wrote to memory of 2856	3944	msedge.exe	112
PID 3944 wrote to memory of 2112	3944	msedge.exe	113
PID 3944 wrote to memory of 2112	3944	msedge.exe	113
PID 3944 wrote to memory of 4524	3944	msedge.exe	116
PID 3944 wrote to memory of 4524	3944	msedge.exe	116
PID 4184 wrote to memory of 5500	4184	wrpjhbzurpjhbztr.exe	117
PID 4184 wrote to memory of 3600	4184	wrpjhbzurpjhbztr.exe	121
PID 4764 wrote to memory of 2512	4764	qomgebytrl.exe	123
PID 4184 wrote to memory of 3428	4184	wrpjhbzurpjhbztr.exe	126
PID 4184 wrote to memory of 1632	4184	wrpjhbzurpjhbztr.exe	130
PID 1904 wrote to memory of 2332	1904	igeywqoigb.exe	132
PID 4184 wrote to memory of 5956	4184	wrpjhbzurpjhbztr.exe	135
PID 4184 wrote to memory of 2780	4184	wrpjhbzurpjhbztr.exe	139
PID 1552 wrote to memory of 3552	1552	aysqoljdbv.exe	141
PID 4184 wrote to memory of 4480	4184	wrpjhbzurpjhbztr.exe	144
PID 3944 wrote to memory of 1432	3944	msedge.exe	146
PID 3944 wrote to memory of 3832	3944	msedge.exe	147
PID 3944 wrote to memory of 2288	3944	msedge.exe	148
PID 4184 wrote to memory of 4460	4184	wrpjhbzurpjhbztr.exe	151
PID 5140 wrote to memory of 5552	5140	tnlfdysqki.exe	153
PID 4184 wrote to memory of 2620	4184	wrpjhbzurpjhbztr.exe	156
PID 4184 wrote to memory of 2988	4184	wrpjhbzurpjhbztr.exe	160
PID 5224 wrote to memory of 4892	5224	axvsnkifax.exe	162
PID 4184 wrote to memory of 912	4184	wrpjhbzurpjhbztr.exe	165
PID 4184 wrote to memory of 4732	4184	wrpjhbzurpjhbztr.exe	169
PID 3024 wrote to memory of 2132	3024	kicausnkfd.exe	171
PID 4184 wrote to memory of 3104	4184	wrpjhbzurpjhbztr.exe	174
PID 4184 wrote to memory of 2496	4184	wrpjhbzurpjhbztr.exe	178
PID 4184 wrote to memory of 2712	4184	wrpjhbzurpjhbztr.exe	183
PID 3944 wrote to memory of 5080	3944	msedge.exe	185
PID 3944 wrote to memory of 5080	3944	msedge.exe	185
PID 4184 wrote to memory of 3392	4184	wrpjhbzurpjhbztr.exe	191
PID 4472 wrote to memory of 2792	4472	ecwurmkecx.exe	193
PID 4184 wrote to memory of 5316	4184	wrpjhbzurpjhbztr.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_01ee40ea80e7e265d899c63b124a8518_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Temp\wrpjhbzurpjhbztr.exe
  C:\Temp\wrpjhbzurpjhbztr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eztrpjhezt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1644
  - - C:\Temp\eztrpjhezt.exe
      C:\Temp\eztrpjhezt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eztrpjhezt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Temp\i_eztrpjhezt.exe
      C:\Temp\i_eztrpjhezt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qomgebytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3600
  - - C:\Temp\qomgebytrl.exe
      C:\Temp\qomgebytrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qomgebytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3428
  - - C:\Temp\i_qomgebytrl.exe
      C:\Temp\i_qomgebytrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1632
  - - C:\Temp\igeywqoigb.exe
      C:\Temp\igeywqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igeywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5956
  - - C:\Temp\i_igeywqoigb.exe
      C:\Temp\i_igeywqoigb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqoljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2780
  - - C:\Temp\aysqoljdbv.exe
      C:\Temp\aysqoljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqoljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4480
  - - C:\Temp\i_aysqoljdbv.exe
      C:\Temp\i_aysqoljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\tnlfdysqki.exe
      C:\Temp\tnlfdysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2620
  - - C:\Temp\i_tnlfdysqki.exe
      C:\Temp\i_tnlfdysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvsnkifax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2988
  - - C:\Temp\axvsnkifax.exe
      C:\Temp\axvsnkifax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvsnkifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:912
  - - C:\Temp\i_axvsnkifax.exe
      C:\Temp\i_axvsnkifax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4732
  - - C:\Temp\kicausnkfd.exe
      C:\Temp\kicausnkfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3104
  - - C:\Temp\i_kicausnkfd.exe
      C:\Temp\i_kicausnkfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2496
  - - C:\Temp\jhczusmkec.exe
      C:\Temp\jhczusmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2712
  - - C:\Temp\i_jhczusmkec.exe
      C:\Temp\i_jhczusmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3392
  - - C:\Temp\ecwurmkecx.exe
      C:\Temp\ecwurmkecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5316
  - - C:\Temp\i_ecwurmkecx.exe
      C:\Temp\i_ecwurmkecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Temp\wrojhbztrl.exe
      C:\Temp\wrojhbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1428
  - - C:\Temp\i_wrojhbztrl.exe
      C:\Temp\i_wrojhbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtoljgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\ywtoljgbzt.exe
      C:\Temp\ywtoljgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtoljgbzt.exe ups_ins
    3⤵
    PID:1532
  - - C:\Temp\i_ywtoljgbzt.exe
      C:\Temp\i_ywtoljgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    PID:4744
  - - C:\Temp\gbytrljdbv.exe
      C:\Temp\gbytrljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    PID:3616
  - - C:\Temp\i_gbytrljdbv.exe
      C:\Temp\i_gbytrljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysqolfda.exe ups_run
    3⤵
    PID:4680
  - - C:\Temp\daysqolfda.exe
      C:\Temp\daysqolfda.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysqolfda.exe ups_ins
    3⤵
    PID:5516
  - - C:\Temp\i_daysqolfda.exe
      C:\Temp\i_daysqolfda.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkicav.exe ups_run
    3⤵
    PID:2184
  - - C:\Temp\faxsqkicav.exe
      C:\Temp\faxsqkicav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkicav.exe ups_ins
    3⤵
    PID:5872
  - - C:\Temp\i_faxsqkicav.exe
      C:\Temp\i_faxsqkicav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcavsnkfd.exe ups_run
    3⤵
    PID:5412
  - - C:\Temp\kfcavsnkfd.exe
      C:\Temp\kfcavsnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcavsnkfd.exe ups_ins
    3⤵
    PID:800
  - - C:\Temp\i_kfcavsnkfd.exe
      C:\Temp\i_kfcavsnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    PID:3040
  - - C:\Temp\fcxupnhfzx.exe
      C:\Temp\fcxupnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    PID:1716
  - - C:\Temp\i_fcxupnhfzx.exe
      C:\Temp\i_fcxupnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcwupmhfz.exe ups_run
    3⤵
    PID:3372
  - - C:\Temp\khcwupmhfz.exe
      C:\Temp\khcwupmhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcwupmhfz.exe ups_ins
    3⤵
    PID:2816
  - - C:\Temp\i_khcwupmhfz.exe
      C:\Temp\i_khcwupmhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwrpjztr.exe ups_run
    3⤵
    PID:4316
  - - C:\Temp\hezwrpjztr.exe
      C:\Temp\hezwrpjztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwrpjztr.exe ups_ins
    3⤵
    PID:1820
  - - C:\Temp\i_hezwrpjztr.exe
      C:\Temp\i_hezwrpjztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run
    3⤵
    PID:5812
  - - C:\Temp\jebwuomgey.exe
      C:\Temp\jebwuomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins
    3⤵
    PID:2384
  - - C:\Temp\i_jebwuomgey.exe
      C:\Temp\i_jebwuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljdbvt.exe ups_run
    3⤵
    PID:1140
  - - C:\Temp\bwtrljdbvt.exe
      C:\Temp\bwtrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x300,0x7ffc0e35c188,0x7ffc0e35c194,0x7ffc0e35c1a0
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,7671804386262343164,133353727490898608,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:11
      4⤵
      System Time Discovery
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,3483278187253557586,18099905783794113648,262144 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,965464449931185585,3101893909510609514,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,1239766701783966722,18259399736540408323,2097152 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5672345619402272464,9611546877469745327,2097152 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,4661511272535840486,9614701895892651806,2097152 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,2735083199441761342,13144260934369032259,2097152 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,16364717072826652538,13297321093540468493,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,6684946076820976096,15626009119132285975,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,15801282280237797314,11432533385354440951,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4422175753871470772,6270335028863082448,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4422175753871470772,6270335028863082448,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16606511973011962463,8244690421045319791,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,1003109704104684797,16547017476497927403,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,11489631711720230967,5237865437478111745,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,14606706789110399891,4990728383253819835,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,12336888774255551548,13064501863948546201,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10761731931643660223,13541167454077469483,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,16343861529315331046,17134486197735870716,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,4173068438546637283,2659523044967317296,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,9540039885887714538,8597767968156792337,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2096,i,12166691863706116631,13004256419197820198,262144 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:10
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,8071975195606024782,11237661070954307478,524288 --field-trial-handle=2816,i,12199859917321944462,2161315070795277896,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5140

C:\Temp\wrpjhbzurpjhbztr.sys
C:\Temp\wrpjhbzurpjhbztr.sys
1⤵
- Executes dropped EXE
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2496

C:\Temp\bzwrpjhbzt.sys
C:\Temp\bzwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:4412

C:\Temp\olgeywrojd.sys
C:\Temp\olgeywrojd.sys
1⤵
- Executes dropped EXE
PID:6140

C:\Temp\ayvqoljdby.sys
C:\Temp\ayvqoljdby.sys
1⤵
- Executes dropped EXE
PID:2744

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:3676

C:\Temp\pkicausmkf.sys
C:\Temp\pkicausmkf.sys
1⤵
- Executes dropped EXE
PID:5712

C:\Temp\khcauspnhf.sys
C:\Temp\khcauspnhf.sys
1⤵
- Executes dropped EXE
PID:2776

C:\Temp\jhezwurmje.sys
C:\Temp\jhezwurmje.sys
1⤵
- Executes dropped EXE
PID:5004

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
- Executes dropped EXE
PID:264

C:\Temp\tqomgebwtr.sys
C:\Temp\tqomgebwtr.sys
1⤵
- Executes dropped EXE
PID:3964

C:\Temp\gdyvtolgby.sys
C:\Temp\gdyvtolgby.sys
1⤵
PID:564

C:\Temp\olgdyolida.sys
C:\Temp\olgdyolida.sys
1⤵
PID:5668

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
PID:5008

C:\Temp\nkfdxvpnlf.sys
C:\Temp\nkfdxvpnlf.sys
1⤵
PID:5988

C:\Temp\kfcxusmkhc.sys
C:\Temp\kfcxusmkhc.sys
1⤵
PID:5712

C:\Temp\spkhczukec.sys
C:\Temp\spkhczukec.sys
1⤵
PID:2624

C:\Temp\jhczxromhe.sys
C:\Temp\jhczxromhe.sys
1⤵
PID:5996

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
PID:3008

C:\Temp\bwtoljdbyt.sys
C:\Temp\bwtoljdbyt.sys
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avtnlfdxvq.sys

Path C:\Temp\avtnlfdxvq.sys
Size 293KB
SHA256 b7d4c2b42118aa00374f708a2d02037787f74cb2b6ded0413195bf8b7decebed
MD5 1c267daccedbb4cb1715dd3f94aaf1e0
SHA1 bd680f71e4de67d4730cfddcb65fef1f6bb7c521
SHA512 82baf1d80dff5fb43e523e02d227092fe74833139fabeb0b8aeda6b2deb6ab1bb1a709468780a8ea9a7c9a60fcb4b810d9e58aeb11dc31e91e67c5847b901430
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axvsnkifax.exe

Path C:\Temp\axvsnkifax.exe
Size 365KB
SHA256 b3e892a1377d668944d4f147a7089fa4ea7a6f8a40572eb87a7cbfa42a4b7395
MD5 888d0fcb770df00e8f6dc76c82d7ec77
SHA1 e572482eff8f3e095d06af46318d31fd9e3395a7
SHA512 0d0f723d6299bf62882cc71e479e99a8daae9e98f500d660ab0d506249a1ef87e387c0dd6d838f940031978612babb7454fc8fdfdf18556793b569b1a2e1422e
SSDEEP 3072:buxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqoljdbv.exe

Path C:\Temp\aysqoljdbv.exe
Size 365KB
SHA256 e2ef61db48f9fd7cdebe356dd3b85dbb3fbfd6df0acbe11b346f291633d140e5
MD5 244c7929cbb21187a83f4764771cd589
SHA1 c85170f38493a87bc14dca2909b424106d9f2805
SHA512 551b2d74873644fb1a0d22e49f100be0a177b42e67edd4a5b8baa294a9d0c5fe2de410cecd9782014b1eec9c76f47b1a2bff0f0c94d730b89ec5d0710ab83531
SSDEEP 3072:AFuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBL8:WuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvqoljdby.sys

Path C:\Temp\ayvqoljdby.sys
Size 293KB
SHA256 6afee543e10ae739b95ed69cd6ec83c47f8feeca9e381b5f979f6a12d7e57c18
MD5 4e3211572ebdabf9e0634c1c915accaa
SHA1 725a6fe7cb24f27d49fbe9c71d012c85979e6c8c
SHA512 66d89f642b83d1222963ceb87acaa6f0b01c394fae81915478619c437128bf2f8588d3aadf5eb571588bd221d4945f81ba303ea641ba20ff57b092e8a9a48a7e
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzwrpjhbzt.sys

Path C:\Temp\bzwrpjhbzt.sys
Size 293KB
SHA256 07d3fe8712e3448b103fb08b0ec79c5d8d5b39e5f5bb9ab0eb49caf341f6e462
MD5 bfc02937403619430f8f4d121232b077
SHA1 542deebc7b1670fc38fafc72b7593e66283f0033
SHA512 5df6b009565090b39b856adb74faa5febea72dabeed039d8dc164665db616a21bfb193f7ca6743d2d2ea7f33273dffa8b5b9aa7a1672e7cb6bd512661b090e9d
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eztrpjhezt.exe

Path C:\Temp\eztrpjhezt.exe
Size 365KB
SHA256 9636be2e4f8dc0291a9b44df6b6f3f71b81d3f50a6ba4f6abc46d6deb0d58343
MD5 6f829bb86a7fdaa6b33450b52ebe7cd6
SHA1 257e97f30daa5197414203b3fcf6e49e8850db4c
SHA512 0f720e3906401c8a3e085da627dc32c339297d573ac903416ad9cc59820b6c5af590b19623b7e87efe9cb31ce4650383f3c6857e832dde6d7ccb26720e975bdd
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqoljdbv.exe

Path C:\Temp\i_aysqoljdbv.exe
Size 365KB
SHA256 85affc301532d3a6d191886904cbd2740edca397299d2f0727473ffda1fc7d34
MD5 d77ace0ab4b5ff3be315a524b56199bf
SHA1 d0d0ddd9b1f6b57335fde42db2c877f5921e463b
SHA512 30913b9dd12e739c21bada583bfd02a4f64541024dcf9883386b7bd7e61d7f3a0711c83b73f89f60be32fc87282e16ee2a9af3b18082aeebfd499e6156595140
SSDEEP 3072:suxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eztrpjhezt.exe

Path C:\Temp\i_eztrpjhezt.exe
Size 365KB
SHA256 10c063d3dd3ad9f1a7853639a4efbc8b573288dc08e57d3182d5935c8c25222d
MD5 ffe4dff24895e11c5fb97b07e87b9629
SHA1 28873d5bd51c8cfd7b592bd60579d27306150379
SHA512 e2a0ccd1f0009182fc00fbf73368b65c0349b9f77326cbb255227bcac041c592265beae2d8c0c422472970850f4560867771826ee3b39faa7557a487ade67d39
SSDEEP 3072:IuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igeywqoigb.exe

Path C:\Temp\i_igeywqoigb.exe
Size 365KB
SHA256 add5f9ccce76c510c654e1d1397981bfd7edc870bb14602e60610ce7d9296bb4
MD5 f25ecc978b5a19ba416f3c76f1a6cf65
SHA1 45bf96b956e8bf0013b3c1aaa1eb36b86304b1e9
SHA512 cf4517574c25c6e57762cc504c62fb28223f382ea015303b9cca5ab5bcb548dd19b11ec2f4dc8c238ff5a0980185351a8a956eae0209f7380f18463602b7e279
SSDEEP 3072:HuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qomgebytrl.exe

Path C:\Temp\i_qomgebytrl.exe
Size 365KB
SHA256 c2d3b3d94c1e2a692c0e161e73c11fc3ad8e395aed2e6eb233ed23b8e7c8a050
MD5 1f0d8c6f0869c0380ba882330561fe21
SHA1 b7a6fc37918d31538b6fdcf11311a155ca1daa24
SHA512 0cd363874fd1972902e7f124694954189a2c0a4a4cf08ae3baa7987c99185f75297117707beb15ed0ffe72359a36e0995113759c6d814f0d2056ae071ee7b464
SSDEEP 3072:WuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdysqki.exe

Path C:\Temp\i_tnlfdysqki.exe
Size 365KB
SHA256 faf51bb09e9318560b99f241ba251a9ee92259256581ce10b69a2d03afb438c3
MD5 124c0ffd3ac89ae0414c48f98c676c07
SHA1 286b469f9a65abcb542aaaeb2e5af9ebd825745b
SHA512 e2994a224b8f049f85241f43f929dcbff010952ecf673df0179d1df8a19a9bc23225070ea9065816b32b44aa77ee6e27106b5a4b0f0bb5d618c8954fbfa58a78
SSDEEP 3072:guxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:guxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igeywqoigb.exe

Path C:\Temp\igeywqoigb.exe
Size 365KB
SHA256 e5c2768354ec72ec2b259697e19568956a1eb3db715f162b9be2a744aa3db9a0
MD5 78cc3a2c8dca267ed166109df7f8b8c1
SHA1 a77dabc89e4e1ece638f0f76d45d7ac50f1eb6c1
SHA512 c5cf4c693ac3340a03ce840dab63134314bc9f44dc478b5deb2f85c9eeed7425e838d0625e9555dc42aa00ed605f57f3bf4d874b52a91a8d5f3b0ea9987c2d27
SSDEEP 3072:IuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywrojd.sys

Path C:\Temp\olgeywrojd.sys
Size 293KB
SHA256 ce19bdc0d8a093471016e3da37ec74966c7c05d041471a291767091f8a886c65
MD5 5bacee8e49724e1ab1c1747cab76561f
SHA1 3f7c56007af7adb424e5c3e05d11def52fbbb4ce
SHA512 2071cc5d31eb9dabdfdd4dfedb6375f4ec5bf538d94bb8ca863c61974d094a0fc8114520435d01d599040c25d288bddcdd0fea1397aa22500e0e63f4e63d9ccf
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnkf.sys

Path C:\Temp\qkicavsnkf.sys
Size 293KB
SHA256 718998a927011dd910248fe5e585ac0bc5f688944ce5d22a8ec27578c4b35c0c
MD5 d6165694d0509ec598076d33bf62855c
SHA1 71980a10416aad61dcf8d57f50015881e0088199
SHA512 a0348dce93e87007b605950d33be85ab1ba048d35a2cc2befe98cb2324cb07276ce85246733f926a4c9a49e31de39a0f2772c8a0b87f45018aa7437b559077d0
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomgebytrl.exe

Path C:\Temp\qomgebytrl.exe
Size 365KB
SHA256 3793f74efad13f5fde65a738b109e549dbab7bac5f389727c2b824881d04fa2b
MD5 61a958661befe804aa987e42fe39742f
SHA1 5cf200cfbafa42c6d9b29cbc8bf6e0e903c21530
SHA512 a38e403efe44f8bfc4f9407108d7415e330a299a3995e6b2fd149a7955f8d7466220d79e96e87c543a059efc61b5807fe6f2105bdf2400d9ff40cac6e9611a3e
SSDEEP 3072:nuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdysqki.exe

Path C:\Temp\tnlfdysqki.exe
Size 365KB
SHA256 bb5b11030df889fede552eedfeafc7136cc187372a79167025d8396770a3f932
MD5 2a8e2e06549907faa837b204c2b75030
SHA1 f7056b8ed5d0122a395fdfb3fe917dfa321b8b65
SHA512 644f83ed6461402a525f0b36379e5d48e1b7ae25e33fd41de1b9f87c0151972d2942e635c37c09829ac80145d639c17410ca858679e2d21408f6efd168b95d13
SSDEEP 3072:zuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbzurpjhbztr.exe

Path C:\Temp\wrpjhbzurpjhbztr.exe
Size 365KB
SHA256 05aa2a48c93877e24ddee4d7a72225fdd3c8c0507e60e4c59c97c1dfe620f462
MD5 6546cb77732997583f9d161b83a2ea7a
SHA1 fced7e243d67baa371e7442380f38cab69e37c59
SHA512 fe3e11b7d75764b7d550e510b9e5fc09cee0e890369338a7c913318ae8f778abc38c6627b0f0f53bf7dce8bade763b2b5ee83164a0379961341ffec537517907
SSDEEP 3072:EuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbzurpjhbztr.sys

Path C:\Temp\wrpjhbzurpjhbztr.sys
Size 293KB
SHA256 b689e44d6371a9ff42c15b4f62270e30a3097d25c2ce90378a8adf39a9661384
MD5 5061e6e214d53f31a3f86661f7060784
SHA1 758b6c37bfe276afa4cafcd2a3154610fff5aed7
SHA512 98d0eb027826d71a5b88e1e5ecf7c5dadc94dcbf048c9a348c6f5edc234b0185280006226370d9cdd183e843f672c062c152f236c0885016eb9ef9debfad2ed3
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 149c5b7d934cf782c24578b0ddc702d65a79b5b21545b90ac634deb884e31ec8
MD5 cc6a747515e3934a1c6c76e98ec565a0
SHA1 f72af25937fa7a855ef92c576182f847f80aa315
SHA512 83ce6934570d42cf3ccb41801038feed500e0a0822dcb9e8826126a2f3fd4110c8ffa6d67319180211907d3563b54a34a562fba815d4f8927b3d999f60c329c2
TLSH
T124615D7683754BF2CB95EE7D0DF50489BAB3882622077E125CB8A3748C7E7449093730
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598265.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598265.TMP
Size 3KB
SHA256 51b9e4b9b491cb34e5ee73f7c8d9ecb111103def7788034ac1d265129c2c2fcd
MD5 2ea7c600f98a91560db26ef250657b90
SHA1 745679ff7c5b92d035546d3cb607f56c5dcf63a7
SHA512 2062201c6106c27a58d58f9ff375b8b68d7ac407e358cd45a7c954a064fdb19d302f0ff7ae4a93351772bf0f28ce4e2360dc5104de396523f9462230c6fd7311
TLSH
T1A3613D7683754BF2CBA5EE7D0DF10489BAB2885622037E125CB8A3748C7E7449493730
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a3bd5402419959281beafa7c7d67d6174c7618b693facec4759f4627e0846f5a
MD5 7726301941e078e3399a5932ebb5d164
SHA1 d54f820a7e9cee5286865a4ed0c805bd0e1c3719
SHA512 c19ee3f0ad72e4ae06fd2a2a25572580e0156a3521832b04d5df4dc2ebc5b886e6283c9b775b1ce4556eea378f58c28ed1fe279a81409d30ee4aad0ed8061a64
TLSH
T15751CEF3C3E9866DC91156F0AB147E2BCE2D0914432C3D5AC9E4EF5B93E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a6bcc4f4bcf5844abbe884e6754e3eb4f3f17135e473dd9281f94d1e9a00660b
MD5 76f04a698feb67d2b7bcbc9bfec71cba
SHA1 aed23edd390e901628860962717e3fb33467255e
SHA512 a12efcd96bbbb06b6fa5ae1d91909b197aa404796bec727ae5f2ea631a715b5a1afae0e5361b4e45881869bcd00c5be2f513b1c5a519356f3eac3dd080456911
SSDEEP 192:sxRlRoyM/jK1Ml8wCc/f4scnWqWpZ/zVzoA8p9n/g6+WNCTg/YPLdlSGXIgDCJ:sxRlq8c/f4slnn/z4Z/5d/mDK
TLSH
T10F62C816AA3499778CDBD20DFA557F53D6F85573A2901E44AAFCCA0C01E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 07dc26742f202089e656a1bfb4a5091c346f1036dc8a554fefab7697e7babb2d
MD5 455aa3fdbf7a2313e66637e7feca3ed8
SHA1 3d818c4ea3ea97b3a6b3913f11b3c8bf0c45605b
SHA512 0acbc52fc52fab92fa1b9b7fd118482ef3cb54f6ab6231fea488bba0ca9e63754bad6a9a4ed52467372e6582f1388fc77c6c11692f890f8098c5e7c9678075fd
SSDEEP 192:sxRlRoyM/jK1Ml8UQGCc/f4scnWqWpZ/zVzoA8prn/g6+WNCTg/YP/dlSGXIgDCJ:sxRlqqhc/f4slnn/z4j/5d/QDK
TLSH
T1F662C816AA3499778CDBD20DFA55BF53D6F85473A2901E44AAFCCA0C01E76EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a190cf85f65ad6594543fe97920267c26163b219a087d794dc7a78a2603f848c
MD5 66f9221c24f6a0f69ffca3368665b631
SHA1 30b1200d6ee6a83fc866652807919a5604722407
SHA512 8a7b7b94ff184dbb559441fe5b94cdfcdff5b38d3d74804173f29116f4cbc00167e7991320225518a0440d0dd284e0e95353709a5d420a1f1d303da1e0fbd6d2
SSDEEP 768:5+McBM7pLuL7MpWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5cfj/eProVX8:5+McBwE7MpWgFZfslu1jaKcfTecVX8
TLSH
T178E2EC3B680CCB7F4F804A9CEC29BD9A6DE801CF9698C95447FA841C03C66EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb653d99-51f3-44c8-b650-1c6ff02c942b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb653d99-51f3-44c8-b650-1c6ff02c942b.tmp
Size 14KB
SHA256 92baeb0f4d0bb71e7ed0f7fe996abf0e5e60930b5d297ddf0ad8bdb1f7a21866
MD5 766ca4ad52a6fcf477f6b747117e1848
SHA1 63fdbeea328e17eeb0615fb437e0f7e3a4096e80
SHA512 3e813e62880d68c5208d226459e78ca8106f963891c3f2027f0084132d93ab223a2cddde00cd2dfa745bd5709106bd64d04004bcabc9d9e85d26451e5b321997
SSDEEP 192:sxRGRoyM/jK1Ml8wCc/f4sBnWqWpZ/zVzoA8p9n/g6+WNCTg/YPLdlSGXIgtJ:sxRGq8c/f4sInn/z4Z/5d/mD3
TLSH
T1D162C816AA3499778CDBD20DFA557F53D6F85573A2901E44AAFCCA0C01E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3ebce39829ecdf15dc6244b217e92ca17eb3f09463c202f2637843d0879e92c8
MD5 beb257931202b8aa199db3759dc3b1fe
SHA1 09feed66952145bdbf7572f040cb7be0c272efc3
SHA512 d5551e4efb62831e399bc3e5a4cd35e15b1d9dc33a381ff11ca6c3ce44b43384767a918c522dcb229a643e947b2178e73b6dc4bc10573f44758ce11d3885274e
SSDEEP 768:Dirv+4UNbdl3DvmvJGkMf5g5WFbxsz56f0+ynobKUixK:Dibsbr3bFfe5WkQ5GUX
TLSH
T19603CF36E86489B78EF7D685B24B36477FB811A3D6C10E84C9ED3B0D469B49D2307863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8b9900fe0ae1fdd01fe1b76806fca28c20c6e1b9c0031af84d4cb77b0619c94c
MD5 d835227334864ae18e1d4da684040c37
SHA1 11dad381ab90307c52ab9a795f1de7ebeca2a09a
SHA512 94ebacfda36126c804fd275f71026da6900af9b016030e5708cc7468eae65f7e0bb644fa209bff044cc92031c8858a5c7a2a0e6b52223f9554de248ba80c900d
SSDEEP 768:Bhj+9A3baKy/4ClJGkMf5eSC5sk5WFbxsz56f0+ynobrb9MS:B89A3bap4TflCyk5WkQ5fb+S
TLSH
T151F2BF31A8258DB34EE7D649F2573B8BBEF416B3C6C50D88D9DCAB0D0A8399D5707812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5b5182a4f79d4f387c58335267d9fd30101f321806177dab67d8f23088b9e92d
MD5 4d5e421e06ffcc3e9dabb382f00b5971
SHA1 425f4a77648b91e1dfaa1fbe5d56709eea276165
SHA512 28147ca429a2b64cdb102b0b31d8cabea5d18aac5908202cf92d7bea0cfbade69c0b9d5e1ef7dbfdbaa76fc00e70c6cb397661d770b45202af91cf41abbcef72
SSDEEP 768:Zkj+9A3bNKy/4vUif5eSC5sk5WFbxsz56f0+ynobrb9MS:Zz9A3bNp4HflCyk5WkQ5fb+S
TLSH
T1D9132AF594D38973C9AE9747A37E2E46ADBCD163B6880884B7D85E0CCC825BFC706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ff65f0d4e577cfbca34a00e70b527c3f137d55273b6679a60fee6d7bb4cbfba0
MD5 13ef29c832d14e5a19024f7f766f64be
SHA1 737b4b0c769eef4f20f6041f960f5700522c4d12
SHA512 8d3e60b51364ee4a95ed592024e76da9c4c65fcb9ac6bb8d97eaa884c7c1578cc7336ea7e4fe12f7ce534400b499fbb62e212f3ba342f0149c39c2b766ac8661
SSDEEP 768:BYrv+4UNbdq3baKy/GlJGkMf5eSC5sa5WFbxsz56f0+ynobrb9Mu:BYbsb03bapvflCya5WkQ5fb+u
TLSH
T17013CF31F86889B34EF7D645F2973A477EB415B3CAD50E88D5D9AB0C0A878DD270B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

5de7d698-b8ef-4b98-b582-1ee27f2aba53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5de7d698-b8ef-4b98-b582-1ee27f2aba53.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3944_2130969038\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 fc6c01abcb5a38ad48a396c431bec0a7318f1d26ed231478fc08651dd4b72be3
MD5 ea513eab54cddc367a41281ee5d468c4
SHA1 505c90859820b0c7e4f10f0f16b009ec694e4ef8
SHA512 094b86de49e92912df168b067b0c54b98dec0983eb2b57e1b89ffa8a9c0fc666eeb19de9d2c8968933b8e1246533dd8c8225882d7f0e6bb8c095f5e5af47baea
TLSH
T1B67100835AB9DAB2C19A5BF002839248F2BB2278072330754B555556AA30A7E58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/564-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1112-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2124-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2744-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2776-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3008-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3676-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3964-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4412-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4448-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5004-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5712-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5712-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5996-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download