systex | 9c0bce538a337a8334eb0299e33fbc80f9c294815ecc95bce3fa516f7c963880

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260709-par8esay2v
SHA256 9c0bce538a337a8334eb0299e33fbc80f9c294815ecc95bce3fa516f7c963880
MD5 db9c1c91bbdf194f950fdacec3de745c
SHA1 1131540d6f7233ef570c2e64727756b259a9c34a
SHA512 f33bb1c19dc055bb74c1090da05b46f06e10e8dd07c868e0d04404ce282f09b455dee000ff12ebe9a7c76096f9dcfb6bf589cdde49de751c49ef12f2f18ed9d2
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4528	trmjecwuomjebwtr.exe
1796	trmjecwuomjebwtr.sys
2900	CreateProcess.exe
3552	ywuomgezto.exe
2664	CreateProcess.exe
5784	CreateProcess.exe
1936	i_ywuomgezto.exe
3944	ztrljdbwto.sys
4220	CreateProcess.exe
5508	mjebwtomge.exe
1668	CreateProcess.exe
1436	CreateProcess.exe
2780	i_mjebwtomge.exe
596	wqoigaytql.sys
2000	CreateProcess.exe
748	ljdbvtnlgd.exe
5820	CreateProcess.exe
3300	CreateProcess.exe
2916	i_ljdbvtnlgd.exe
4676	dyvqoigays.sys
5864	CreateProcess.exe
2896	nlidbvtnlf.exe
3944	CreateProcess.exe
2344	CreateProcess.exe
1956	i_nlidbvtnlf.exe
2844	icavtnlfdx.sys
4152	CreateProcess.exe
5800	aysqkifays.exe
1484	CreateProcess.exe
2036	CreateProcess.exe
4540	i_aysqkifays.exe
2788	spnicausnk.sys
1128	CreateProcess.exe
468	spkicausmk.exe
2504	CreateProcess.exe
3344	CreateProcess.exe
4520	i_spkicausmk.exe
1192	khcauspkhc.sys
1344	CreateProcess.exe
5540	eczxspkhca.exe
5848	CreateProcess.exe
1792	CreateProcess.exe
5740	i_eczxspkhca.exe
2828	mkecxupmhe.sys
5788	CreateProcess.exe
6056	ecwupjhbzu.exe
4484	CreateProcess.exe
2632	CreateProcess.exe
1832	i_ecwupjhbzu.exe
4180	kecwuomgez.sys
3424	CreateProcess.exe
1352	ecwuomgezx.exe
2244	CreateProcess.exe
5156	CreateProcess.exe
4520	i_ecwuomgezx.exe
1948	ztromgebzw.sys
3940	CreateProcess.exe
5880	bwuomgeywq.exe
2748	CreateProcess.exe
4072	CreateProcess.exe
4712	i_bwuomgeywq.exe
2004	dbytqljdbv.sys
5468	CreateProcess.exe
3700	geywqoigby.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_1691805718\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_472232040\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_1739007243\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_1739007243\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_2023053693\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_2023053693\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_472232040\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_2023053693\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4668_2023053693\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysnlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuomjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkezwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgezto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkezwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysnlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgezto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebzwuom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1080	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2316	ipconfig.exe
2880	ipconfig.exe
904	ipconfig.exe
3556	ipconfig.exe
5388	ipconfig.exe
5888	ipconfig.exe
5076	ipconfig.exe
4180	ipconfig.exe
3516	ipconfig.exe
4800	ipconfig.exe
696	ipconfig.exe
3368	ipconfig.exe
2904	ipconfig.exe
2868	ipconfig.exe
4988	ipconfig.exe
5452	ipconfig.exe
360	ipconfig.exe
5252	ipconfig.exe
2800	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280724849439494"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{1BF81397-4BA0-4968-B85D-B80D9E5DEF80}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe
4528	trmjecwuomjebwtr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	i_ywuomgezto.exe
Token: SeDebugPrivilege	2780	i_mjebwtomge.exe
Token: SeDebugPrivilege	2916	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	1956	i_nlidbvtnlf.exe
Token: SeDebugPrivilege	4540	i_aysqkifays.exe
Token: SeDebugPrivilege	4520	i_spkicausmk.exe
Token: SeDebugPrivilege	5740	i_eczxspkhca.exe
Token: SeDebugPrivilege	1832	i_ecwupjhbzu.exe
Token: SeDebugPrivilege	4520	i_ecwuomgezx.exe
Token: SeDebugPrivilege	4712	i_bwuomgeywq.exe
Token: SeDebugPrivilege	3156	i_geywqoigby.exe
Token: SeDebugPrivilege	4216	i_daysnlidav.exe
Token: SeDebugPrivilege	5476	i_lidavtnlfd.exe
Token: SeDebugPrivilege	1940	i_cavsnlfaxv.exe
Token: SeDebugPrivilege	856	i_xrpkhcausm.exe
Token: SeDebugPrivilege	1952	i_mkeczurmke.exe
Token: SeDebugPrivilege	4472	i_omkezwupmh.exe
Token: SeDebugPrivilege	4124	i_rljebzwuom.exe
Token: SeDebugPrivilege	1920	i_oigbytrljd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4528	3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3224 wrote to memory of 2876	3224	2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2876 wrote to memory of 4668	2876	iexplore.exe	90
PID 4668 wrote to memory of 5088	4668	msedge.exe	91
PID 4668 wrote to memory of 2092	4668	msedge.exe	92
PID 4668 wrote to memory of 1080	4668	msedge.exe	93
PID 4668 wrote to memory of 2092	4668	msedge.exe	92
PID 4668 wrote to memory of 2092	4668	msedge.exe	92
PID 4668 wrote to memory of 1644	4668	msedge.exe	94
PID 4668 wrote to memory of 1644	4668	msedge.exe	94
PID 4668 wrote to memory of 2744	4668	msedge.exe	96
PID 4668 wrote to memory of 2744	4668	msedge.exe	96
PID 4668 wrote to memory of 2568	4668	msedge.exe	97
PID 4668 wrote to memory of 2744	4668	msedge.exe	96
PID 4668 wrote to memory of 2568	4668	msedge.exe	97
PID 4668 wrote to memory of 2568	4668	msedge.exe	97
PID 4668 wrote to memory of 4736	4668	msedge.exe	98
PID 4668 wrote to memory of 3368	4668	msedge.exe	99
PID 4668 wrote to memory of 4736	4668	msedge.exe	98
PID 4668 wrote to memory of 4736	4668	msedge.exe	98
PID 4668 wrote to memory of 3368	4668	msedge.exe	99
PID 4668 wrote to memory of 3368	4668	msedge.exe	99
PID 4668 wrote to memory of 4960	4668	msedge.exe	100
PID 4668 wrote to memory of 4960	4668	msedge.exe	100
PID 4528 wrote to memory of 2900	4528	trmjecwuomjebwtr.exe	104
PID 3552 wrote to memory of 2664	3552	ywuomgezto.exe	107
PID 4668 wrote to memory of 1848	4668	msedge.exe	110
PID 4668 wrote to memory of 4124	4668	msedge.exe	111
PID 4668 wrote to memory of 1848	4668	msedge.exe	110
PID 4668 wrote to memory of 4124	4668	msedge.exe	111
PID 4668 wrote to memory of 4152	4668	msedge.exe	113
PID 4668 wrote to memory of 2708	4668	msedge.exe	114
PID 4668 wrote to memory of 2708	4668	msedge.exe	114
PID 4668 wrote to memory of 5344	4668	msedge.exe	117
PID 4668 wrote to memory of 5344	4668	msedge.exe	117
PID 4528 wrote to memory of 5784	4528	trmjecwuomjebwtr.exe	118
PID 4528 wrote to memory of 4220	4528	trmjecwuomjebwtr.exe	122
PID 5508 wrote to memory of 1668	5508	mjebwtomge.exe	124
PID 4528 wrote to memory of 1436	4528	trmjecwuomjebwtr.exe	127
PID 4528 wrote to memory of 2000	4528	trmjecwuomjebwtr.exe	131
PID 748 wrote to memory of 5820	748	ljdbvtnlgd.exe	133
PID 4528 wrote to memory of 3300	4528	trmjecwuomjebwtr.exe	136
PID 4528 wrote to memory of 5864	4528	trmjecwuomjebwtr.exe	141
PID 2896 wrote to memory of 3944	2896	nlidbvtnlf.exe	143
PID 4528 wrote to memory of 2344	4528	trmjecwuomjebwtr.exe	146
PID 4668 wrote to memory of 1880	4668	msedge.exe	148
PID 4668 wrote to memory of 860	4668	msedge.exe	149
PID 4668 wrote to memory of 2452	4668	msedge.exe	150
PID 4528 wrote to memory of 4152	4528	trmjecwuomjebwtr.exe	153
PID 5800 wrote to memory of 1484	5800	aysqkifays.exe	155
PID 4528 wrote to memory of 2036	4528	trmjecwuomjebwtr.exe	158
PID 4528 wrote to memory of 1128	4528	trmjecwuomjebwtr.exe	162
PID 468 wrote to memory of 2504	468	spkicausmk.exe	164
PID 4528 wrote to memory of 3344	4528	trmjecwuomjebwtr.exe	167
PID 4528 wrote to memory of 1344	4528	trmjecwuomjebwtr.exe	171
PID 5540 wrote to memory of 5848	5540	eczxspkhca.exe	173
PID 4528 wrote to memory of 1792	4528	trmjecwuomjebwtr.exe	176
PID 4528 wrote to memory of 5788	4528	trmjecwuomjebwtr.exe	180
PID 6056 wrote to memory of 4484	6056	ecwupjhbzu.exe	182
PID 4528 wrote to memory of 2632	4528	trmjecwuomjebwtr.exe	185
PID 4668 wrote to memory of 4624	4668	msedge.exe	187
PID 4668 wrote to memory of 4624	4668	msedge.exe	187
PID 4528 wrote to memory of 3424	4528	trmjecwuomjebwtr.exe	193
PID 1352 wrote to memory of 2244	1352	ecwuomgezx.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_db9c1c91bbdf194f950fdacec3de745c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Temp\trmjecwuomjebwtr.exe
  C:\Temp\trmjecwuomjebwtr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywuomgezto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2900
  - - C:\Temp\ywuomgezto.exe
      C:\Temp\ywuomgezto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywuomgezto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5784
  - - C:\Temp\i_ywuomgezto.exe
      C:\Temp\i_ywuomgezto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4220
  - - C:\Temp\mjebwtomge.exe
      C:\Temp\mjebwtomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1436
  - - C:\Temp\i_mjebwtomge.exe
      C:\Temp\i_mjebwtomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Temp\nlidbvtnlf.exe
      C:\Temp\nlidbvtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidbvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Temp\i_nlidbvtnlf.exe
      C:\Temp\i_nlidbvtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4152
  - - C:\Temp\aysqkifays.exe
      C:\Temp\aysqkifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\i_aysqkifays.exe
      C:\Temp\i_aysqkifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1128
  - - C:\Temp\spkicausmk.exe
      C:\Temp\spkicausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\i_spkicausmk.exe
      C:\Temp\i_spkicausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\eczxspkhca.exe
      C:\Temp\eczxspkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1792
  - - C:\Temp\i_eczxspkhca.exe
      C:\Temp\i_eczxspkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5788
  - - C:\Temp\ecwupjhbzu.exe
      C:\Temp\ecwupjhbzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupjhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2632
  - - C:\Temp\i_ecwupjhbzu.exe
      C:\Temp\i_ecwupjhbzu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3424
  - - C:\Temp\ecwuomgezx.exe
      C:\Temp\ecwuomgezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5156
  - - C:\Temp\i_ecwuomgezx.exe
      C:\Temp\i_ecwuomgezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3940
  - - C:\Temp\bwuomgeywq.exe
      C:\Temp\bwuomgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4072
  - - C:\Temp\i_bwuomgeywq.exe
      C:\Temp\i_bwuomgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5468
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    PID:988
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysnlidav.exe ups_run
    3⤵
    PID:3536
  - - C:\Temp\daysnlidav.exe
      C:\Temp\daysnlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysnlidav.exe ups_ins
    3⤵
    PID:2744
  - - C:\Temp\i_daysnlidav.exe
      C:\Temp\i_daysnlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidavtnlfd.exe ups_run
    3⤵
    PID:5492
  - - C:\Temp\lidavtnlfd.exe
      C:\Temp\lidavtnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfd.exe ups_ins
    3⤵
    PID:3084
  - - C:\Temp\i_lidavtnlfd.exe
      C:\Temp\i_lidavtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnlfaxv.exe ups_run
    3⤵
    PID:3896
  - - C:\Temp\cavsnlfaxv.exe
      C:\Temp\cavsnlfaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnlfaxv.exe ups_ins
    3⤵
    PID:2016
  - - C:\Temp\i_cavsnlfaxv.exe
      C:\Temp\i_cavsnlfaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhcausm.exe ups_run
    3⤵
    PID:5000
  - - C:\Temp\xrpkhcausm.exe
      C:\Temp\xrpkhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausm.exe ups_ins
    3⤵
    PID:4816
  - - C:\Temp\i_xrpkhcausm.exe
      C:\Temp\i_xrpkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurmke.exe ups_run
    3⤵
    PID:3428
  - - C:\Temp\mkeczurmke.exe
      C:\Temp\mkeczurmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurmke.exe ups_ins
    3⤵
    PID:3608
  - - C:\Temp\i_mkeczurmke.exe
      C:\Temp\i_mkeczurmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omkezwupmh.exe ups_run
    3⤵
    PID:4284
  - - C:\Temp\omkezwupmh.exe
      C:\Temp\omkezwupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omkezwupmh.exe ups_ins
    3⤵
    PID:3772
  - - C:\Temp\i_omkezwupmh.exe
      C:\Temp\i_omkezwupmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebzwuom.exe ups_run
    3⤵
    PID:6008
  - - C:\Temp\rljebzwuom.exe
      C:\Temp\rljebzwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebzwuom.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_rljebzwuom.exe
      C:\Temp\i_rljebzwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run
    3⤵
    PID:5456
  - - C:\Temp\oigbytrljd.exe
      C:\Temp\oigbytrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    PID:1840
  - - C:\Temp\i_oigbytrljd.exe
      C:\Temp\i_oigbytrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc68fec188,0x7ffc68fec194,0x7ffc68fec1a0
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,15503323942203025562,17572783716123816132,262144 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,9376319249114463800,16914580213980212035,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
      4⤵
      System Time Discovery
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,17666755111904911451,6763317161785512213,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12627141809172641578,5311052251221579846,2097152 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,16428193185921638415,3595876580921992399,2097152 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,9724253542976266945,550119025159595598,2097152 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,6023385172216921866,1134624641202675331,2097152 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3451662081216762848,8038837657813068222,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,15617822171403513664,13294969960467832797,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,207493306180615396,5287115551502806029,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,8095503089874565204,3126512435809482174,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,8095503089874565204,3126512435809482174,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1148375838851349721,10567822621055156625,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,1658355749765182208,11893823829675254466,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10088678520181410475,15049188943040877949,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9142997510753974888,3556048900395871401,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,9328971999780077620,14923804521070728868,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,3685578825327081185,7798376923718032631,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,10931148278445184972,12182633320040158578,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,7115209405259373914,12368336252915478948,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,1725260689528654143,11551178956773906936,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5600,i,12870915353669097681,6038858939805964410,262144 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:10
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,5973632111426481195,5120686831865110936,524288 --field-trial-handle=2712,i,17159070976069625250,5930755524297562789,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1504

C:\Temp\trmjecwuomjebwtr.sys
C:\Temp\trmjecwuomjebwtr.sys
1⤵
- Executes dropped EXE
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1236

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
- Executes dropped EXE
PID:596

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:4676

C:\Temp\icavtnlfdx.sys
C:\Temp\icavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:2844

C:\Temp\spnicausnk.sys
C:\Temp\spnicausnk.sys
1⤵
- Executes dropped EXE
PID:2788

C:\Temp\khcauspkhc.sys
C:\Temp\khcauspkhc.sys
1⤵
- Executes dropped EXE
PID:1192

C:\Temp\mkecxupmhe.sys
C:\Temp\mkecxupmhe.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\kecwuomgez.sys
C:\Temp\kecwuomgez.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\ztromgebzw.sys
C:\Temp\ztromgebzw.sys
1⤵
- Executes dropped EXE
PID:1948

C:\Temp\dbytqljdbv.sys
C:\Temp\dbytqljdbv.sys
1⤵
- Executes dropped EXE
PID:2004

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:3664

C:\Temp\nlidbvtnlf.sys
C:\Temp\nlidbvtnlf.sys
1⤵
PID:1828

C:\Temp\dausqnifax.sys
C:\Temp\dausqnifax.sys
1⤵
PID:5896

C:\Temp\xusmkfcxvp.sys
C:\Temp\xusmkfcxvp.sys
1⤵
PID:3364

C:\Temp\xupnkeczxr.sys
C:\Temp\xupnkeczxr.sys
1⤵
PID:3196

C:\Temp\omkecwrpmh.sys
C:\Temp\omkecwrpmh.sys
1⤵
PID:2612

C:\Temp\mjhbzwuomj.sys
C:\Temp\mjhbzwuomj.sys
1⤵
PID:2420

C:\Temp\rljdbvtolg.sys
C:\Temp\rljdbvtolg.sys
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkifays.exe

Path C:\Temp\aysqkifays.exe
Size 376KB
SHA256 5ef04e0c613bc00309703a164a651fef9c7d56ee996301708273d861eaf545e8
MD5 5a0fb9bd7b7b1263eefa21ca87903b3c
SHA1 f2d8cdecf57cac7475648a9a224650902c072238
SHA512 71ced38f102cb4e8a99ee0764cf7ff81ec8e820cffadf56238bada67aba795462f3898a3cd3dae5585952bd8103301f6b3ea23ce5d1d4500b80dec889ec648d1
SSDEEP 3072:fFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigays.sys

Path C:\Temp\dyvqoigays.sys
Size 293KB
SHA256 c4164e00054356bd17cf28529ae91970520fe8814e775fa8b4015e88ca1229b7
MD5 b4cbe98dfb1abeb410fc0685fff5d3e4
SHA1 5651968e689706254d1eaf96636522eebc631587
SHA512 33bc27f8763e27680df20591e23138f446da73f6ac3493d18527254d88c45e973650d95524bd738958e516ce9191162ea77d935b1a2178a7d69c3cf98c034623
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T19A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkifays.exe

Path C:\Temp\i_aysqkifays.exe
Size 376KB
SHA256 571b8249aec408ecb9f6f514fb3b9cbf10df7c914d9766b26a8a83f621acf874
MD5 7450597deb1ce981d6fd366590f9a24e
SHA1 32b9954022569f01d91694bb7f20c45d2ea5ea0b
SHA512 c314ba2e9414455368bb609216d58edc7143e92e813e3074273c1e673c515b17af8ad9eae0c0c57a2cb37752752bd8944eaf397cac2af3766c157af02c9864c6
SSDEEP 3072:KFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 376KB
SHA256 4cd61c02c3e13f079d5917707d981df2c5aa539bbc5ec22fbf8c84f0cba253a1
MD5 0bd5949973017ad1f90a997eda7bf7af
SHA1 fe07c846e526df5e1fc66b605bbb3995c6ca02c3
SHA512 d4766049057a908d2c1a2dbd3b49e4423903ead3c96d53ffaf3badd35b6e2c9ca4d54b1ce221c2ec726e3f1ff9000f841169a2028748d3a260fb3b9704b9e3f4
SSDEEP 3072:5FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjebwtomge.exe

Path C:\Temp\i_mjebwtomge.exe
Size 376KB
SHA256 f51c5e56a57a77ce9feece0258d567b2b40ffc1393b860e709cdaeb91639dd29
MD5 47b28a48ba9048e895a2659f04142178
SHA1 23e0b34f273cd51bb685c95449e3e95bf3b9f971
SHA512 3308671feb0b0efb8ac950a2489d9375f754002418652434c9591e68188bba3f692eecef52aff52152e4b9312b91b4b15d9bbdafb7989e83c9c72df29f4915ae
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlidbvtnlf.exe

Path C:\Temp\i_nlidbvtnlf.exe
Size 376KB
SHA256 9a44168ca41f763b6c66ff0292ad370260e58c856a822124adc99c23613cd4d6
MD5 ed9301891478fbf781b3e972ad659a36
SHA1 3a932ad814046e38c9f3512103c5bce4cae3edcc
SHA512 f863dfb3ed4f0d011077d5355a679bd8eabbf2d99be2cf02394407f3611fd27c353393b7f652107bd6dac92a8b08314ea4c18de16a5e1438c2c819bd9a7305d6
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywuomgezto.exe

Path C:\Temp\i_ywuomgezto.exe
Size 376KB
SHA256 57877341c371d85a28e2b0b463b1efca9c3199fffbdf172756a8b763353d4155
MD5 adc1ed843b197772428c76b25abe4172
SHA1 162ac911b11876d3911363651277f647badf6d45
SHA512 9754f5ec0a9dca47881698c8faf3997716374bc3a3f70b6b0f3096a64271c5d3524410fdae204dda0527544770edb93a312876d70c92a8d98b4fde559bc6a7ea
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavtnlfdx.sys

Path C:\Temp\icavtnlfdx.sys
Size 293KB
SHA256 365104da42131162d3475f6ccc2f0dc220219f97bb5a377dd9b5fd385b66f249
MD5 61a000472ee9a588eece5b5e537caf3b
SHA1 f5ff28b477609e02a231dc07be4f7d57fec45043
SHA512 007e8884feb5ecf117e620ddbc6b9233c229de727963a6d240695910bad0746eb06f6453c2b525a661ca11229aac6b9bbc1eb447e206ad07232ff3e93cb5836d
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 376KB
SHA256 f54489b89fbd67805ab7b0034e9ffb2aff90899f38e53b945ccb1fdca9a46aa8
MD5 9154ce3de3a14c44076a6b02a437936e
SHA1 272bb214630dcb45ddd6564855d5aaa464f7fa96
SHA512 232bc78d479c8f20715bc10ce8893b302d60c9b7a0a544ad787aeed1f19117375679a6dc1d834beaf66d5742d6fb38f70d8f524dfa5f2763639d3fa59eb320af
SSDEEP 3072:pFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwtomge.exe

Path C:\Temp\mjebwtomge.exe
Size 376KB
SHA256 e42a35b402d6ea88d9f44e420fa0f5da349c0873900eed33b2ad3781cb8a90e2
MD5 ba90a411be571c7c0d350c4a53206112
SHA1 ef4583a5e6990db37e1d9be090fcc2d619a56925
SHA512 f68b1003294bc9bc7ed85a5522f8ced609712c7b5a42303113bad3b5fbbff3ef408d279eb36098df66eb2b93331247b498ab984f32b5bed0acb96f4b00b05ba2
SSDEEP 3072:HFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidbvtnlf.exe

Path C:\Temp\nlidbvtnlf.exe
Size 376KB
SHA256 3a94793347c6fb2e87a586caa6f346a202dc45f1eaedeef4e7ca53a7ea43c537
MD5 92561d0cd41a26b6bd7ac7720277fad2
SHA1 f68ec4c050dbe77553d8e2673fa84e2e6e8afc1e
SHA512 e5c60141cfb3b031a212258ce5963384c0526fc8616a3cab57283af22497f12fd326e748a8f1077431b608929e3f486db2d9133c09c4c2e2ba8d732817de63d3
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.exe

Path C:\Temp\spkicausmk.exe
Size 376KB
SHA256 44de0df0aee31b294d16af330a39c2e3cfea517095688e8089cd4a627ecaa613
MD5 70308ed91011e93996e2a1669435588d
SHA1 aa61a23367faae4a0ca19c74238e5fe6c476925c
SHA512 f86a3db4def2d097e9a1b6b43d9e152b8667579332ba2fb64af52237b88d71b74a35e8818f7ffd501a2b477bfb9a5edc0d5b81209a09e095d0e60420525b3ce6
SSDEEP 3072:HFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnicausnk.sys

Path C:\Temp\spnicausnk.sys
Size 293KB
SHA256 9ceaa2b79f218d958dbbdb73a6bf0f947931b88eab8ff664ff26f15c1a3cbdd9
MD5 bc15e412b8e2fc6ca58bbbba2b5855eb
SHA1 925385dd99b774c64cd85eb620b3090dbb4eaeeb
SHA512 702b9646d3ec64af7e49c4aa6c278be4bb724e79a77b6633bf08d50d6a7fed13487416ef54964e9e76f4389e382060d5229528e2f7d33fd4fdcfa1b0cdb2dc44
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuomjebwtr.exe

Path C:\Temp\trmjecwuomjebwtr.exe
Size 376KB
SHA256 88e02c2e58ef9a5dcd4afb7e70e67aa6663f8e4fafc917b9c51a2fd8fc947b84
MD5 d0bda8fd31cac5bb074cfa727278016a
SHA1 260efc78fc3f32a1720201f88d1e1e5b107ccf1c
SHA512 85d85ce58144e474b458993b7e8aae4740347ca84881bee74fad650044a601cbf493bd9c7161f07c8788ceeae2d25112e6ee869bf78908fda51d5ed537e0cc51
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuomjebwtr.sys

Path C:\Temp\trmjecwuomjebwtr.sys
Size 293KB
SHA256 bf4953469c6d8185bd054fea968655d73b2ee50e1aecca52b7c3aeffc02afdf6
MD5 637ed7ecade3f0bd802fb940fee9bab2
SHA1 a8439a9490379e4493382a0dfa61496eedf3af6f
SHA512 b0d2f4eef204a0ddfab99f294c9c1bf7a425bd46c95b5601efbc8788f6a6adc3824955a8f8eaaed09d48606953ee56a61d8130adf3ea6f310e0c4dd9b9c22d96
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaytql.sys

Path C:\Temp\wqoigaytql.sys
Size 293KB
SHA256 f68ad3ff0db3e54a05a2b2aa59c173395f22d2fa9b6b957431cf9ca957ecf64c
MD5 86fa6076be17a681652e1f98c7680098
SHA1 aae21181d78dcad59dea283c2dd37b4be521ad9c
SHA512 59a35d29c52909402d78329e3818af3d22e8ef0345ef5baa655b30ee993f37dfbb4ced5efe2fb159ba4b02e8d9e4ea688c0f58ed66e7952666cdad54b65436f1
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T148545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywuomgezto.exe

Path C:\Temp\ywuomgezto.exe
Size 376KB
SHA256 f5e04e0449d87f307073b764aee8fe7c705d3925f1ca5a9af18636ab9eb2b8cf
MD5 85ac78c102aea0115c7f920142d0c50c
SHA1 612d03a4f9c0eeb771fdc677554bbc27b09878cb
SHA512 14aa4c930cfbaaeca33d41031ae33ce813681338865f2672bf4a24edf55d3847549c997bc6f7ee9340bdf193e08ae2945ee256a0c8bdf2c47d4ca37c746b6a62
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 293KB
SHA256 ad5d663017baa8e42f5b74c0460a56bc8cbde29f4edf57b6dbba7ea182026ab4
MD5 d7bed81b8bc291182ee7e4ae9069758b
SHA1 739add54ac02810932b94b1293bf32d9c4694cd4
SHA512 3337f470b2ff63ab1bf4096d7b918ff89ae94fd96adafc814a911ccf940f1d7caf6ac19817b47bb5620fd36d5ffee08f22dab733d01744aeac5b85168694fd06
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 44c494fa5f209cc22f32b9ab5693767e11e0da2cb4e09239956d14b04e51d989
MD5 08ed1709ca6dabfe7483dc3e3290e742
SHA1 11b7480084af5f26c28ae54f26b34788972407f2
SHA512 8f039ef5d675b4917014089682db69bff70acf7257be0efe5adb5d18ff06f5654fb778129473f42cb18a2c148136a0d11dfee91d9d4b7c811010719551c56dde
TLSH
T15A511F910B370BC1DFE94EB3F5D09486B9F364468A8FAEB86C50E338488B3C190617B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599215.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599215.TMP
Size 3KB
SHA256 317035198e737d9b8469d2e7bd48b15bebfbfcc14827997cc15740043203a590
MD5 6c94bec3501b07f7ba09855e2f705e45
SHA1 c83a555569acc510df9231601ef3c18de62a0746
SHA512 2487e953ad5a015697f590267b48985ca5bcafbed61bde47d315bc969e8711daae43db6674ed4c99990295a25884df4be9bff9390f6c7d94698812ee29bc43b8
TLSH
T1C951EE910B370BC1DFE95EB3F5D0948AB9F364568A8FAEB86C50E378488B3C19061771
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ddccddfab024581aa1837c5a044911d32a7bc3f80dc7565c29c4802d2da24496
MD5 e1626fead7a11daf2ec292a31adfa54a
SHA1 312521e585bb521180f87b4d4fac29249858c3eb
SHA512 3c67b75f9b4272e89d9322867bada8c67a21111dcbb3209ed076bdf2b2c45b483d4f1b4bb073327c853a4687a723f54ceaa0dc9ca15906dc49e2c26bc399d9bb
TLSH
T12D51CDF7C3E8866DC90156F0BA147E2BCE2D0914832C3D5A89E4AE1BA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e8e7760fd8828360b6a0f1206db3d53712a31706911da5ae55a496ca10961dc
MD5 f0e8e5db783f0627501f83ac069b91d3
SHA1 eff53796d2f5a72ad76216576f178ccccb978bc3
SHA512 ca84f23fffa4d4313c855440f6fc9dbc9d39b2de4f716e504fe1ccd381bb4d6237f5b7e53c3a720bcb930a13f6caccd082b239b7352d7cfeb1b72845dd6c3d01
SSDEEP 192:sxRpROyM/jK1Ml8wCr/fysy3bMZXzoA8pi/g6+WNIYtZIbl9WqDGiJIgtJ:sxRpY8r/fysyry+i/5IsiZXd13
TLSH
T1C352DA16AA249D37CCDBD20CFA557F53D6F81573A2901E44AAFCDA0C04E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6a03d4ae5a0d21013d592eb35cc3855d02d65e87b2edf02b84ff8a10be27be42
MD5 8d32614adbf52755629638728b7b1533
SHA1 504cfe1a5a2fe43f2e85deac4a137d8c2905cdc8
SHA512 823d6e745750d0c0a59b5a8c84ffddd22dbccc999909261b0656ddd88c1442d06ab28e1ce15c3e14ed401e1ff0ae9e03cbc8bd1893390f9a521851a3f4cdd66c
SSDEEP 192:sxRCROyM/jK1Ml8wCr/fysW3bMZfzoA8p9M/g6+WNC5X/YtZIWl9WqDGiJIgDNJ:sxRC48r/fysWry2O/5M/siOXd1T
TLSH
T19862EC16AA249D37CCD7D20CFA557F63D6F81573A2901E44AAFC9B0C04E66DD611382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d592f958dea275271274e9ee2b28c8666a93767f3e1274562829f39eea97c752
MD5 4ad49ea1e9c04181636c1df49fea4b2f
SHA1 bad557fb5af5e013f84a059259721db9d921f222
SHA512 b262a3f74eeed3231142ae16abb630cbf1d7c65ef3898fb79b25ba38fce2ae03e7851645d9739c1285f2da7a038d982a03da9938635f0781346a94535ffdf06a
SSDEEP 192:sxRCROyM/jK1Ml8UQoCr/fysW3uMZfzoA8prM/g6+WNC5X/YtZI+l9WqDGiJIgDx:sxRC4qPr/fysW+y2Q/5M/siGXd19
TLSH
T13B62DA16AA249D37CCD7D208FA557F63D6F81573A2901E48AAFCDB0C04E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 feb3741a40f617f6709e54ca2310fb970cfd25327a107a20c105f6c655f27f37
MD5 b977ac8c923634fe57cc681ea22e4318
SHA1 65fa92f9d78a87989fc61f9c1923fd16100a6944
SHA512 f07786c47936a86753be2d755014072961e95627640bb504dd8f73111b04c9f52b17b62e6a32bc4c5c75691807a316b029ddb37e4960ea7c75a26e9a5456a257
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFd:dOwS1wBzwRbYE761wiWg1zwsfMZwKu11
TLSH
T182E2EC3B684CCB7F4F404A9CEC29BE9A6DE801CF56D8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469f3279-0872-42fc-b165-8ce5a101341b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\469f3279-0872-42fc-b165-8ce5a101341b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6664dfb89b9970ed6c15fa8042e42bdf1a2578157f9fad9ac284abfaa595e145
MD5 b3627fcbd62440cd9734436a11c40d7b
SHA1 2cb12bcf89ca4a88847583d322179589b2856f6d
SHA512 f4db05a84f2a3c86f5c94e0573eb0de11c187d4823fc6bff6f12003e3c9e0f5b3e2cb8a02c56a27c78b9476a4da6a67e340024ffa750b7d13da8c5c25923d729
SSDEEP 768:CIrv+4UNbdX3Y/Hl4hPqu37BtAwjUSzZYUikB+:CIbsbR3Yfl4YuoThUJI
TLSH
T1CD03BF32985499379CF7C286B24B7A43BFB45163D6C51F94C8ED2B0D828B15C234BA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8850a9c979a0234a5a1257165aa967f4d15d6ac2d8cfb9bd1bf7fc968a14b422
MD5 bdf05ed91c7d00662824dd6e1e456044
SHA1 7a952d51be8a2e44b3e0c27e9bbc61ad5b337315
SHA512 bfe5288271cda93cfc70d41087ad9ce7f387f2f576e3b6fc0c6933792d6ad61ced0cb8d920f07dbe32cfc335f59b0b725585801abf2b00fb60186947e1e583fa
SSDEEP 768:n6rv+4UNbdO3CJg4hPpu37BtAwjUSzF/b9MdcI:n6bsbE3CK4TuoT2b+dH
TLSH
T1F413C031E8548A739CFBD295B28B3A53BFF41163C9C51F84D8EA6B0C45871AC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 72352ff50f8155ae1bcb27b28d1a5eb34a6087a3a76adc75f6dc4f0abfae3192
MD5 02a03def4261321a6b334bd7b72386e2
SHA1 909b4ed907b521243fdde02741fd2d6be859df5a
SHA512 5a372ac2050fcf50102161eec5db9a3196c422c4015a5d7ee5393bba4349de9ea545d0f969e145fcb1d959c1b14609f0b917f54169a3c11d283ab53bcef4fe0b
SSDEEP 384:n1HtNn/s3n9Sf38NJpssMK37bMz2fppP4yL3HFYUmDvuh3n39WoBtAdEF7jgHKXy:1Hj+9Q3v2g4hPMu37BtAwjUSzF/b9Md1
TLSH
T143F2AF71AC408D638CDB9295735A2B92AFF04173C5C52F88D8E96F0D448326C274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c8984787935df462418326a79f7a73acfe732a7b87a6eaa28f5cb7c02ab1eb38
MD5 0ee43373e3490d1de770321bb7db10b7
SHA1 f4cdd12a78152d1fc5f719040a9acc862f96190d
SHA512 8b5b405a887cbd877de7206504f684f6f5b5ba34e5d47c3732526d715ed8aa313d8f55d94235061f20cbb394d8fbdcdc9847e7920710429a38f7d0ffcdb116a7
SSDEEP 384:nnHtNn/s3n9Sf38NJwssMK37bMz2fppP4yL3HFYUmDvuh3n39WoBtAdEF7jgHKXy:nHj+9Q3C2g4hPMu37BtAwjUSzF/b9Md1
TLSH
T1E5F2AF71AC408E639CDB9396735A2B92AFF04177C5C52F84D8E96F0D458326C274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 24f38fe84a4ab5ed008f64d6dbf70776156b1409eead384140a9280c660e9b6a
MD5 3ffa4a34c1c9329985326c87cc3df3a7
SHA1 55649a29cd220e213ee0c8694dbfdb0bafb2587d
SHA512 cc2c9a5243b9b2d5bbb184e96a5d1755229ae996ceb550033473ae43d2a06e0dc9e33928ae17850f7b5c6cb08545dd1c82428a0ebd3b7a19a5466e9d0bbcc476
SSDEEP 768:tlF1j+9j3kwgg90cPTu37BtAwjUSzF/b9Md1:ts9j3RzuoT2b+d1
TLSH
T1D01318F198C38A36D89E8797637D2E469EFCC163B5885984BBD55E0CCC821BFD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

72a405e4-f044-4165-9063-6d1e9daccd0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\72a405e4-f044-4165-9063-6d1e9daccd0d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4668_252229616\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 615502ec8d11bfa8e57d2bbf09a1d34fd2bb02290104900fe0fe7a3710e0d68e
MD5 0d213e26419699fb3e953495d3194c39
SHA1 ac6fd7bfd39f825c39e2e8012c022a5c28a881a1
SHA512 085bf5b0c32753ed8c28b210e51e6d05ca9d36ba5cac81eca5d8c9fbba1bdba2f3fde31f22d1e85957e7ed0bd40ca513511111642f22d3bd96c0a0bb416079b1
TLSH
T18671239357B9C5B3C1DE5FF102835248F5FB22384B2330350B926546AB30A7E24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/596-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/596-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1192-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1192-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1704-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1796-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1828-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1948-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2004-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2612-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2788-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2844-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3364-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3664-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3944-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4180-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5896-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download