systex | 760af4dc26a6f780a21f9b39a1168592fa6dc5d37a36df8a8fa21324ebea71af

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260709-try5hsd191
SHA256 760af4dc26a6f780a21f9b39a1168592fa6dc5d37a36df8a8fa21324ebea71af
MD5 dd62c9b1a150f029f1602f7ede7219cc
SHA1 bff49be279af87afa28e5e29a1829bc5f212ff96
SHA512 acd8d646ad8a1f7bbfba6a5c91ec3216f07c3428a3e88859256e025dc9ec7aa40c06c9069f92cbc028a85ac89e5b67bef91a7a5873134bd65fe95445e6e5f54c
SSDEEP 3072:StFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLo:8FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2632	hcxupmhfzxrpjhcz.exe
5504	hcxupmhfzxrpjhcz.sys
2348	CreateProcess.exe
5876	khczurpjec.exe
788	CreateProcess.exe
4916	CreateProcess.exe
5484	i_khczurpjec.exe
3300	ezxrpjhezx.sys
1108	CreateProcess.exe
4748	mhezwrpjhb.exe
692	CreateProcess.exe
3812	CreateProcess.exe
3900	i_mhezwrpjhb.exe
4596	mjebwuomge.sys
2652	CreateProcess.exe
3564	bztrpjgebz.exe
6040	CreateProcess.exe
1860	CreateProcess.exe
2056	i_bztrpjgebz.exe
5068	trljdbwtom.sys
2380	CreateProcess.exe
4444	tolgeywqoj.exe
3080	CreateProcess.exe
4976	CreateProcess.exe
5124	i_tolgeywqoj.exe
2424	dbytqolgdb.sys
4272	CreateProcess.exe
3700	yvtqligayv.exe
4948	CreateProcess.exe
4984	CreateProcess.exe
1956	i_yvtqligayv.exe
4836	lfdyvqoiga.sys
5424	CreateProcess.exe
3156	sqkicavsnl.exe
6020	CreateProcess.exe
5976	CreateProcess.exe
1336	i_sqkicavsnl.exe
5068	sqkicaysqk.sys
5756	CreateProcess.exe
824	kifaxvsnki.exe
708	CreateProcess.exe
4296	CreateProcess.exe
4724	i_kifaxvsnki.exe
2944	pnhfaxspki.sys
4896	CreateProcess.exe
4384	qkicausmkf.exe
1192	CreateProcess.exe
596	CreateProcess.exe
5556	i_qkicausmkf.exe
4664	kecausmkec.sys
4700	CreateProcess.exe
4180	czusmhfzxr.exe
2912	CreateProcess.exe
3784	CreateProcess.exe
4112	i_czusmhfzxr.exe
3596	hcausmkecx.sys
1364	CreateProcess.exe
2056	uomhezxrpj.exe
5732	CreateProcess.exe
4548	CreateProcess.exe
2752	i_uomhezxrpj.exe
5084	rmkecwtrpm.sys
3168	CreateProcess.exe
5712	omgbzwrpjh.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_2097516124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_1110650123\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4632_1110650123\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbzwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcxupmhfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczurpjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbzwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkeczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkeczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczurpjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtqligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtqligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvsnki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2404	ipconfig.exe
3408	ipconfig.exe
2020	ipconfig.exe
3696	ipconfig.exe
780	ipconfig.exe
1160	ipconfig.exe
5048	ipconfig.exe
2588	ipconfig.exe
4500	ipconfig.exe
3772	ipconfig.exe
5244	ipconfig.exe
4720	ipconfig.exe
5556	ipconfig.exe
4076	ipconfig.exe
5808	ipconfig.exe
928	ipconfig.exe
2940	ipconfig.exe
5764	ipconfig.exe
5512	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{0837C18B-56C5-48CD-AD84-91B43C6E3041}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe
2632	hcxupmhfzxrpjhcz.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5484	i_khczurpjec.exe
Token: SeDebugPrivilege	3900	i_mhezwrpjhb.exe
Token: SeDebugPrivilege	2056	i_bztrpjgebz.exe
Token: SeDebugPrivilege	5124	i_tolgeywqoj.exe
Token: SeDebugPrivilege	1956	i_yvtqligayv.exe
Token: SeDebugPrivilege	1336	i_sqkicavsnl.exe
Token: SeDebugPrivilege	4724	i_kifaxvsnki.exe
Token: SeDebugPrivilege	5556	i_qkicausmkf.exe
Token: SeDebugPrivilege	4112	i_czusmhfzxr.exe
Token: SeDebugPrivilege	2752	i_uomhezxrpj.exe
Token: SeDebugPrivilege	204	i_omgbzwrpjh.exe
Token: SeDebugPrivilege	2856	i_oljebwuomg.exe
Token: SeDebugPrivilege	3020	i_jdbvtnlgdy.exe
Token: SeDebugPrivilege	5544	i_yvtnlfdxvq.exe
Token: SeDebugPrivilege	2060	i_aysqkidavt.exe
Token: SeDebugPrivilege	3432	i_kifaxvpnhf.exe
Token: SeDebugPrivilege	1692	i_cxupnhfzxr.exe
Token: SeDebugPrivilege	2840	i_urmkeczurp.exe
Token: SeDebugPrivilege	5784	i_hbzurmjecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 2632	5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 5148 wrote to memory of 1368	5148	2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1368 wrote to memory of 4632	1368	iexplore.exe	89
PID 4632 wrote to memory of 1308	4632	msedge.exe	90
PID 4632 wrote to memory of 4496	4632	msedge.exe	92
PID 4632 wrote to memory of 1560	4632	msedge.exe	93
PID 4632 wrote to memory of 4496	4632	msedge.exe	92
PID 4632 wrote to memory of 4496	4632	msedge.exe	92
PID 4632 wrote to memory of 4204	4632	msedge.exe	94
PID 4632 wrote to memory of 4204	4632	msedge.exe	94
PID 4632 wrote to memory of 4616	4632	msedge.exe	95
PID 4632 wrote to memory of 4616	4632	msedge.exe	95
PID 4632 wrote to memory of 4616	4632	msedge.exe	95
PID 4632 wrote to memory of 3888	4632	msedge.exe	96
PID 4632 wrote to memory of 3888	4632	msedge.exe	96
PID 4632 wrote to memory of 3888	4632	msedge.exe	96
PID 4632 wrote to memory of 5600	4632	msedge.exe	97
PID 4632 wrote to memory of 5600	4632	msedge.exe	97
PID 4632 wrote to memory of 5600	4632	msedge.exe	97
PID 4632 wrote to memory of 4904	4632	msedge.exe	98
PID 4632 wrote to memory of 4904	4632	msedge.exe	98
PID 4632 wrote to memory of 4904	4632	msedge.exe	98
PID 4632 wrote to memory of 2168	4632	msedge.exe	99
PID 4632 wrote to memory of 2168	4632	msedge.exe	99
PID 2632 wrote to memory of 2348	2632	hcxupmhfzxrpjhcz.exe	103
PID 5876 wrote to memory of 788	5876	khczurpjec.exe	106
PID 4632 wrote to memory of 1944	4632	msedge.exe	109
PID 4632 wrote to memory of 1260	4632	msedge.exe	110
PID 4632 wrote to memory of 1944	4632	msedge.exe	109
PID 4632 wrote to memory of 1260	4632	msedge.exe	110
PID 4632 wrote to memory of 4264	4632	msedge.exe	112
PID 4632 wrote to memory of 1988	4632	msedge.exe	113
PID 4632 wrote to memory of 1988	4632	msedge.exe	113
PID 4632 wrote to memory of 4864	4632	msedge.exe	115
PID 4632 wrote to memory of 4864	4632	msedge.exe	115
PID 2632 wrote to memory of 4916	2632	hcxupmhfzxrpjhcz.exe	117
PID 2632 wrote to memory of 1108	2632	hcxupmhfzxrpjhcz.exe	121
PID 4748 wrote to memory of 692	4748	mhezwrpjhb.exe	123
PID 2632 wrote to memory of 3812	2632	hcxupmhfzxrpjhcz.exe	126
PID 2632 wrote to memory of 2652	2632	hcxupmhfzxrpjhcz.exe	130
PID 3564 wrote to memory of 6040	3564	bztrpjgebz.exe	132
PID 2632 wrote to memory of 1860	2632	hcxupmhfzxrpjhcz.exe	135
PID 2632 wrote to memory of 2380	2632	hcxupmhfzxrpjhcz.exe	139
PID 4444 wrote to memory of 3080	4444	tolgeywqoj.exe	141
PID 2632 wrote to memory of 4976	2632	hcxupmhfzxrpjhcz.exe	144
PID 4632 wrote to memory of 4500	4632	msedge.exe	146
PID 4632 wrote to memory of 4488	4632	msedge.exe	147
PID 4632 wrote to memory of 4456	4632	msedge.exe	148
PID 2632 wrote to memory of 4272	2632	hcxupmhfzxrpjhcz.exe	151
PID 3700 wrote to memory of 4948	3700	yvtqligayv.exe	153
PID 2632 wrote to memory of 4984	2632	hcxupmhfzxrpjhcz.exe	156
PID 2632 wrote to memory of 5424	2632	hcxupmhfzxrpjhcz.exe	160
PID 3156 wrote to memory of 6020	3156	sqkicavsnl.exe	162
PID 2632 wrote to memory of 5976	2632	hcxupmhfzxrpjhcz.exe	165
PID 2632 wrote to memory of 5756	2632	hcxupmhfzxrpjhcz.exe	169
PID 824 wrote to memory of 708	824	kifaxvsnki.exe	171
PID 2632 wrote to memory of 4296	2632	hcxupmhfzxrpjhcz.exe	174
PID 2632 wrote to memory of 4896	2632	hcxupmhfzxrpjhcz.exe	178
PID 4384 wrote to memory of 1192	4384	qkicausmkf.exe	180
PID 2632 wrote to memory of 596	2632	hcxupmhfzxrpjhcz.exe	183
PID 4632 wrote to memory of 2388	4632	msedge.exe	185
PID 4632 wrote to memory of 2388	4632	msedge.exe	185
PID 2632 wrote to memory of 4700	2632	hcxupmhfzxrpjhcz.exe	191
PID 4180 wrote to memory of 2912	4180	czusmhfzxr.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_dd62c9b1a150f029f1602f7ede7219cc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Temp\hcxupmhfzxrpjhcz.exe
  C:\Temp\hcxupmhfzxrpjhcz.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczurpjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2348
  - - C:\Temp\khczurpjec.exe
      C:\Temp\khczurpjec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczurpjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4916
  - - C:\Temp\i_khczurpjec.exe
      C:\Temp\i_khczurpjec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\mhezwrpjhb.exe
      C:\Temp\mhezwrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3812
  - - C:\Temp\i_mhezwrpjhb.exe
      C:\Temp\i_mhezwrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrpjgebz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2652
  - - C:\Temp\bztrpjgebz.exe
      C:\Temp\bztrpjgebz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrpjgebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\i_bztrpjgebz.exe
      C:\Temp\i_bztrpjgebz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2380
  - - C:\Temp\tolgeywqoj.exe
      C:\Temp\tolgeywqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Temp\i_tolgeywqoj.exe
      C:\Temp\i_tolgeywqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtqligayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Temp\yvtqligayv.exe
      C:\Temp\yvtqligayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtqligayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4984
  - - C:\Temp\i_yvtqligayv.exe
      C:\Temp\i_yvtqligayv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5424
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5976
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\kifaxvsnki.exe
      C:\Temp\kifaxvsnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\i_kifaxvsnki.exe
      C:\Temp\i_kifaxvsnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\qkicausmkf.exe
      C:\Temp\qkicausmkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:596
  - - C:\Temp\i_qkicausmkf.exe
      C:\Temp\i_qkicausmkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czusmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4700
  - - C:\Temp\czusmhfzxr.exe
      C:\Temp\czusmhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czusmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3784
  - - C:\Temp\i_czusmhfzxr.exe
      C:\Temp\i_czusmhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1364
  - - C:\Temp\uomhezxrpj.exe
      C:\Temp\uomhezxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\i_uomhezxrpj.exe
      C:\Temp\i_uomhezxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgbzwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Temp\omgbzwrpjh.exe
      C:\Temp\omgbzwrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgbzwrpjh.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_omgbzwrpjh.exe
      C:\Temp\i_omgbzwrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljebwuomg.exe ups_run
    3⤵
    PID:1032
  - - C:\Temp\oljebwuomg.exe
      C:\Temp\oljebwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljebwuomg.exe ups_ins
    3⤵
    PID:2976
  - - C:\Temp\i_oljebwuomg.exe
      C:\Temp\i_oljebwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run
    3⤵
    PID:3596
  - - C:\Temp\jdbvtnlgdy.exe
      C:\Temp\jdbvtnlgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins
    3⤵
    PID:5588
  - - C:\Temp\i_jdbvtnlgdy.exe
      C:\Temp\i_jdbvtnlgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlfdxvq.exe ups_run
    3⤵
    PID:4792
  - - C:\Temp\yvtnlfdxvq.exe
      C:\Temp\yvtnlfdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdxvq.exe ups_ins
    3⤵
    PID:4528
  - - C:\Temp\i_yvtnlfdxvq.exe
      C:\Temp\i_yvtnlfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run
    3⤵
    PID:3216
  - - C:\Temp\aysqkidavt.exe
      C:\Temp\aysqkidavt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    PID:4088
  - - C:\Temp\i_aysqkidavt.exe
      C:\Temp\i_aysqkidavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvpnhf.exe ups_run
    3⤵
    PID:4260
  - - C:\Temp\kifaxvpnhf.exe
      C:\Temp\kifaxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvpnhf.exe ups_ins
    3⤵
    PID:1428
  - - C:\Temp\i_kifaxvpnhf.exe
      C:\Temp\i_kifaxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnhfzxr.exe ups_run
    3⤵
    PID:5208
  - - C:\Temp\cxupnhfzxr.exe
      C:\Temp\cxupnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnhfzxr.exe ups_ins
    3⤵
    PID:204
  - - C:\Temp\i_cxupnhfzxr.exe
      C:\Temp\i_cxupnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkeczurp.exe ups_run
    3⤵
    PID:3336
  - - C:\Temp\urmkeczurp.exe
      C:\Temp\urmkeczurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkeczurp.exe ups_ins
    3⤵
    PID:6052
  - - C:\Temp\i_urmkeczurp.exe
      C:\Temp\i_urmkeczurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmjecw.exe ups_run
    3⤵
    PID:4312
  - - C:\Temp\hbzurmjecw.exe
      C:\Temp\hbzurmjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmjecw.exe ups_ins
    3⤵
    PID:6032
  - - C:\Temp\i_hbzurmjecw.exe
      C:\Temp\i_hbzurmjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5784
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffe17afc188,0x7ffe17afc194,0x7ffe17afc1a0
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,17431440274197674619,1320303646581336868,262144 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,1593926076159986036,15145012800605333209,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:11
      4⤵
      System Time Discovery
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,4222172603678816689,12282084266809845937,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,14500465176224591442,10426440843006716639,2097152 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11338802625832149514,1281784076779952021,2097152 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,5366569379969804769,7240938513140756619,2097152 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,10929189693587349937,4308705186824225769,2097152 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,13274050836725041036,12257555680140228557,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,3361738812920222484,14626365079839326684,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,3883059560910114237,1676032076024669454,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17131140362047689808,16045785632745276560,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17131140362047689808,16045785632745276560,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7155768130612674133,4712126210958827464,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11659645513416974323,21864329133990619,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,15203299902717507992,17074983953761757430,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,13861847696441359081,13111538818332142498,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,4698530095237389846,17341441347431105428,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11366185052082878254,11799435490658328527,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1544,i,16548679848317305722,8931121744029627126,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,12180108716162922631,10705560003633124352,262144 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:10
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,3320209115465499334,16147341894165241786,524288 --field-trial-handle=2948,i,15854478706471993020,15277272952525611111,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1020

C:\Temp\hcxupmhfzxrpjhcz.sys
C:\Temp\hcxupmhfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4444

C:\Temp\ezxrpjhezx.sys
C:\Temp\ezxrpjhezx.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
- Executes dropped EXE
PID:4596

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:5068

C:\Temp\dbytqolgdb.sys
C:\Temp\dbytqolgdb.sys
1⤵
- Executes dropped EXE
PID:2424

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:4836

C:\Temp\sqkicaysqk.sys
C:\Temp\sqkicaysqk.sys
1⤵
- Executes dropped EXE
PID:5068

C:\Temp\pnhfaxspki.sys
C:\Temp\pnhfaxspki.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\kecausmkec.sys
C:\Temp\kecausmkec.sys
1⤵
- Executes dropped EXE
PID:4664

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:3596

C:\Temp\rmkecwtrpm.sys
C:\Temp\rmkecwtrpm.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Temp\ljgbywromg.sys
C:\Temp\ljgbywromg.sys
1⤵
PID:792

C:\Temp\rljdbwtolg.sys
C:\Temp\rljdbwtolg.sys
1⤵
PID:2940

C:\Temp\idbvtnljdb.sys
C:\Temp\idbvtnljdb.sys
1⤵
PID:4140

C:\Temp\fdyvqnlfdy.sys
C:\Temp\fdyvqnlfdy.sys
1⤵
PID:1956

C:\Temp\nlfdausnki.sys
C:\Temp\nlfdausnki.sys
1⤵
PID:5560

C:\Temp\kfcxupnhfz.sys
C:\Temp\kfcxupnhfz.sys
1⤵
PID:3404

C:\Temp\hfzxrpnhfz.sys
C:\Temp\hfzxrpnhfz.sys
1⤵
PID:5544

C:\Temp\eczurmkecw.sys
C:\Temp\eczurmkecw.sys
1⤵
PID:5532

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrpjgebz.exe

Path C:\Temp\bztrpjgebz.exe
Size 376KB
SHA256 e3b7df64b9e6a628d389739da20f6e3fe7f90e34c3416dbfd6388627b5518b57
MD5 20b2cb033077a8ec5096e429f0d39c78
SHA1 a9c492cb24bff2d664bb0f2d3e3de98865b9250a
SHA512 18e12fd0aa151dfb0f635c46cbb01a64036e86a7d896d72c3828f5ea4001719d51f6caf4451becf4fddfa41fa2cf0d749257c00bdfd9a66cc7d90d0465ab35a0
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqolgdb.sys

Path C:\Temp\dbytqolgdb.sys
Size 293KB
SHA256 df7346cb41a2b653bdeb15e0482d69cbd2b22d3495acc3fe727a127583dfe922
MD5 86efd217f23030af76862eb44d972cf1
SHA1 0e43c63d75d8066069684ce90f999eef280a7470
SHA512 b51e087825eb20cf55f485212581e6c00b20535d0c3ae01f10c03975427a8ca66e56db6e8544125cf020f21666f3f27b232bc4eed3b31b4923d7f18b0886fe1a
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhezx.sys

Path C:\Temp\ezxrpjhezx.sys
Size 293KB
SHA256 d96edfebf8dccc93e76d1aeecdcf327326b95521f2a2b89ee0afb15bb19e9362
MD5 a067b7fb3875ee917e25353b0838f83d
SHA1 33124f04aab4a811cfd99453b4975b7adf06a47a
SHA512 73d45fc1102b64118d609d1e36e38e20a45d4c95de23ba4adbab4672b0dd9caa11de64a70489873d5d2ad5369f0eb369142af55e3379d86b25bc42fe2860210c
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcxupmhfzxrpjhcz.exe

Path C:\Temp\hcxupmhfzxrpjhcz.exe
Size 376KB
SHA256 66b1429b7fb134830910e544b194150f5a2e0a3eedab64b70ba92b2186c707de
MD5 52804f7885aaa474f9216e15752b21d2
SHA1 9819c661207a706d7328c83a0df12a378f2f7ca4
SHA512 9ce776229bb30ff04e505c8e04d08babe82ca9078a1a86847fef35f99a54a725ccef1c5cd97ea64723ce7b3bfe517c7cfcc4a44abbe200280de0182428988e32
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcxupmhfzxrpjhcz.sys

Path C:\Temp\hcxupmhfzxrpjhcz.sys
Size 293KB
SHA256 f83816c1d257c1538a8fc3fdfa6cc50d9e0b69f33f58b2ca27c138be78afe690
MD5 58ce517c770b6e7b244465a2dab73549
SHA1 750d9cd908ea5c0c7e604907967aeda949264dfa
SHA512 7c13119e7538eff28e02815e898c0a4f34c0d02359b32b414ab76ddb136b27077b5afe337567f838b2d1ea30ec41e116dcfa6dc8eaceda3f04bdbb5ccd867eb7
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T132545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrpjgebz.exe

Path C:\Temp\i_bztrpjgebz.exe
Size 376KB
SHA256 5b0b845689d4e57d37e1d5e5247e6f262bd36a0b9c49053255d70ba798241344
MD5 a95194278a5042d713f46a076df085f0
SHA1 54a00ddb496ceef36532545268dd9ee94d323b7e
SHA512 0c7fc0663ab8a9e3863759dc0188528406915106cc24fc07c17a5768b84a42e6121539dd9400ed3e0bd88dab708a0d13b32761aa1958ad6dd731e8d952da7574
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khczurpjec.exe

Path C:\Temp\i_khczurpjec.exe
Size 376KB
SHA256 2229fe2cb43b0579e174d8e8cf4c7b72ddbe24e358d6f9128bf155452fb212f4
MD5 750fdacd9562f5feebea41d5684965d2
SHA1 61bd14cb0d94681fcb0c4ba174027cd6b6025f6d
SHA512 304c9b91de5d68cf7017a19cfc185ab5a998ace1d8ba3f3dbfbc98e3649ce81d6d9bdf1e7c18c0554ff9c5327f3ea15aa668e85d44010e5bbbb784cdf5391df2
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezwrpjhb.exe

Path C:\Temp\i_mhezwrpjhb.exe
Size 376KB
SHA256 15e7272af994023237ffdba85b9343ae54a21a2b953194c7eb5f542796873e9c
MD5 17c83436d56c7fb39d09ac44b6b415e3
SHA1 1f55f5dc0139e395cb8a2414e6f7606c54fcd0e5
SHA512 dd1ea342452427e0188daea5ab1c2998be8db7fb9c49241b41cf0e0d83875678bf41e80eb3b993767dca208ca678db7f7dbc39a56dbf85e30b5955913e490e8f
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywqoj.exe

Path C:\Temp\i_tolgeywqoj.exe
Size 376KB
SHA256 86bfde9db57aff63441a60d9b138788f8d6579cd8f57022e72a7b58dc527ae1b
MD5 6cbb4a91046d89faf81f2c3de8d6f7b6
SHA1 30f19b40a98d923bd9db59db35d15419a6abab52
SHA512 1e4ed86c22d22e0be31013aa233b59f26c0f839bf029cae371c69e77355ca7fa39b9120b55cb5f45122411f38a082ff1de3c95d779775559d09906c756c3de27
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T189847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtqligayv.exe

Path C:\Temp\i_yvtqligayv.exe
Size 376KB
SHA256 0b85771414f460c83886d30e7d821137c087738c17a3412721e4f59f0795ad53
MD5 63efd40b6aa0249740d82f4a0c307929
SHA1 2c52625abcbf1896cbd2b1d26f9fd4ef5752e518
SHA512 d8a3fc9063f4ebaaa49cd78dae45f8ed14def3797eb32973146f7906841a575647c6fe023b4d06cd6e954509cc4fd276bebcc3a56dc9ee10389bcb9ad027f6c0
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczurpjec.exe

Path C:\Temp\khczurpjec.exe
Size 376KB
SHA256 fc0e41b412fe58e7bd87cba7b815291f05073540c4d05d0a80350a3139efd322
MD5 c382a3c01745db905cfaf7eccc2e7e0f
SHA1 1daeca165c934a48f0533c5909acda5736ba8538
SHA512 a38c2e922f51a7ac93c9c39e22b7d9ad9fe340ca789b121581cfb51dd535a40fdfc45326d3a36c1fbdde4de95751c762a23ea7283a35ef13d704da9dbf8c9a28
SSDEEP 3072:yPFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLL:yPFL1JeIJjiJcbI03GBc3ucY5DCSjXF
TLSH
T181847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqoiga.sys

Path C:\Temp\lfdyvqoiga.sys
Size 293KB
SHA256 fcd3d24cb7ddee56710432d5253ce1e7ce01e6f435034cbaef25032fbd642a06
MD5 a09b307ed8936b01a9468f397884e42b
SHA1 baa3dd0c45d3da6fc03084fb0716fc2a94cfbdde
SHA512 315788987df4d54a78f969e90b1985b8657670d2a31c6319bb69c4257d02643ce14ffceeac672052ce8eeb555ace52f43e73972c6ba14239722b537c3b057a46
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezwrpjhb.exe

Path C:\Temp\mhezwrpjhb.exe
Size 376KB
SHA256 9b8b5e2ce3da0377a51e24de15c91cf31edec439aaaef691da2591607fc8c902
MD5 e296bf62b57ce9e015c9c3e8c0f931b1
SHA1 fb081efe940187698f5ce9de5c9d46790ca0e8b1
SHA512 ce21ea6f99c7e665e6b36a5f24f2cf513fb2867d808366004bfd068da4e6c757a80e182c293280414875f3ffd23f6ecaa87d44fa9cf394d57c363d29afd6aa5b
SSDEEP 3072:5FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwuomge.sys

Path C:\Temp\mjebwuomge.sys
Size 293KB
SHA256 dd93a56cc93a2ca7dfb36e551ff806dccca42df43ae11ec1cb209d57d2dd334c
MD5 e876f7f8656fd7b67918fa8959b7a109
SHA1 b360cf57f91aef27cb9b8198ee12d5b5d98420e5
SHA512 d56bb88f85fbc194b45c034d849fca62f6deea674c007cdbe153fa9cf427f92c5e99195f3ce77008c98ff7726c03c7c8011f629a5917ae682fe938c20c7cd746
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T14C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.exe

Path C:\Temp\sqkicavsnl.exe
Size 376KB
SHA256 7673cf63942323bfe59288d684d1e651d160749e19de462be274d94ad500bf91
MD5 d371c4d66bd09fb58d680bf960665910
SHA1 d5824cab9797a0077706daa9990036bc073091ab
SHA512 38cc9fc65052e28164d438f30d5fc03227c2069d8efac3aa7b293229289c85e869927184ed8c9fea8816cef3830b75d11306223545bcdbaf9e82447815dc9f51
SSDEEP 3072:cFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoj.exe

Path C:\Temp\tolgeywqoj.exe
Size 376KB
SHA256 1a683a7f908fd0b6b677b7258ac35d99a9c2ca077fc6611831f9fd1c7569d126
MD5 1959b7a066b9fa62ddccb9e152e323d4
SHA1 d7e9c29c4ecbd41de766fe95272f2f1ad3c35daa
SHA512 d91592aec2d37cb63b11b4842e758b26091d70dda4b7365c977f43ce9ad899e98c828f7b282772a059b53c078087366afc342b6eb8d29df7e4b91da450174bdf
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.sys

Path C:\Temp\trljdbwtom.sys
Size 293KB
SHA256 fbbd2c5c893f74d9b5d440b15af8af80f513b23d2686745f0b070f40568c5ddf
MD5 a79430194c98a5062fba451b490954bc
SHA1 f4cfe5a62ef3b00b0755ba48efc0b88a0d0c527a
SHA512 26a763127f7a0d42dcb2293c4679e92962c2eb6bdfae0f75acbfb8bb92865e865da0f83f899109b8391d736e0c31bf7f1c46a4abc357c853eac09c550cdb39e6
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T192545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtqligayv.exe

Path C:\Temp\yvtqligayv.exe
Size 376KB
SHA256 37a311a4ac75adca263a41bd7d51e4406b804f02aecd6432cfc6f82faa976580
MD5 340cf77076116c6f18b6c6fa57420df4
SHA1 4bda2d3103b5a0b7af17ad83105f69c9f5ef4927
SHA512 9d95b7a8bf228f24c5f446018e462a2273c442d49d7ca756c1ae748c5b5c067086fc9a005e34dfec900133c5df1deefaa18bcb1cffafa187f6a0010d232b26d2
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25b5cc9fe4544093f02e2cafd292e291526318945cd9298537e21dde015e4042
MD5 6099f3a284ff243c2759a197db1bfae6
SHA1 4d1f4e147bce79560c1c9de6fd4031677d4dafac
SHA512 f13da2530d12bc4e290f11971c798d25eb44cc1e1441964fb921a7d074fc66e2af4d1d879d00ce665b1a41199407d1e83a1744a4c6153423b929d2ce4f1bb550
TLSH
T131612C54032E5DEBDF2585B3F5A147B4B6F08CB49D43EE40999A2E348812F1C72DAC67
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595df5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595df5.TMP
Size 3KB
SHA256 6a6636adacb8b7341d0ac696b0a05f8e9258d6fa4e855606054df641a1cc281a
MD5 ad40ae7a1fd5733bd68fdd24eb11df93
SHA1 534102c402639324a2d52bbbb170768f0dd0d7c5
SHA512 e5e1b637f1e099f7079d8cd1e01a292a35f4de2a5d2f498c484752f505b66d528bbfeaed61010be96d400a1b49bc55699fb3ab467849b9f258fbac6ddb78b616
TLSH
T183612C54032E5DEADF2585B3F5A047B4A6F08CB49D43EE40999A2E348812F1C72DAC67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3ca358fe33e1ad3942790aef5d3d6a45182b7aeff929ec8cbfc4571db33509fb
MD5 249a0bb543087ef45572a6608f946137
SHA1 20c3e0a8f1a4f7ed414366a2bf795bb286e5f1c6
SHA512 78e956231cebb573a3a7b491d3374c84d2501e186ab601d929ce4f40b0854518d82b17ce36d8de8fcc47a166db738df37865f4930af80bde57a67e9e08fe9d06
TLSH
T11951DEF383E8866EC91145F0AA187E2BCE1C0915432C3D5AC9E4EE5BA3E2471E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9d0397d8e4d913f0bafac2fd4945975e4b04054141003f0ee61e4d1efc4d7839
MD5 a600fd5f9058eab87ff4ee4a2361039f
SHA1 04ff8ffd422e8d9ca22854cbee752b5a35dbb862
SHA512 1e6192f23069bd8068903d4f658ae6006935189477768256af072e7197c7819bf5e05944618145714d5d9ce6eece087ca2b9f266154a8dfdfcfe2325a88b2396
SSDEEP 192:sxRpRzyM/jK1Ml8wC9q/fosiz25KZ7zoA8pi/g6+WNIYD9r6SOGQDIgtJ:sxRpf8c/fosIkcai/5IpSC3
TLSH
T15D52D8166A245D3BDCDBD20DFA517F93D6F85573A2901E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e060fa6304532ee2ac2b266d3ae2da5f5ed0578b11a6a20e9486d649d426c4c
MD5 f4d8326b2adc8c1600cc1ccd238863ed
SHA1 2b2e0681f3b3df3fefb756d4fba9360b3ecbba31
SHA512 4e8f696473c640eba87bbfd1c70f025d0d4d171f288f82e9eb459efea1352d796b5532f8d9118455280234e31af0c24089b57144cc91668659c5d339c79f1c76
SSDEEP 192:sxRKRzyM/jK1Ml8wC9q/fos8z25KZHzoA8p9+I/g6+WNCHM/YD966SOGQDIgDQJ:sxRK58c/fosOkcugI/5d/kSCQ
TLSH
T18D62E9066A245D7B9CDBD209FA517F93D6F85473A2901E44ABFC8A0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 91d58c00530c14ff1a1cdda9a8161a4af856631d20d8ecb8b16ee6063467ff57
MD5 d6bffba4c599c0bb5c9482eae02e464b
SHA1 ead541ecadbb63349211125dc904b0e778ac07ce
SHA512 6c1877bb16b4a30c90544ce5c612024cbddccdde9207fac512e084a71bad1306554842971b9005e0559d3533d37548f59e91db7ce229262eaac95a3c51c57fa7
SSDEEP 192:sxRKRzyM/jK1Ml8UQiC9q/fos8z25KZHzoA8pr+I/g6+WNCHM/YD9w6SOGQDIgD0:sxRK5qVc/fosOkcuaI/5d/0SCQ
TLSH
T1CA62E916AA245D7BDCDBD209FA517F93D6F85473A2941E44ABFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ebf954be8ad87662f440452418b6f2f3de7ca2d71df129502e6f504c83a54604
MD5 0cc858c78b42e77e82ecce1af1bbeb21
SHA1 f67ef08c8eb6d262083f95c612dd30a3453dfafd
SHA512 b963f36ef3df082df129f1cabcd3e0d644d1cfa091744e5f58291c24d867c1478ff87b63c8d16871e0860ad252e8347d423daca5733c7c27874cd1bd1c5c5b99
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzVAc1sfro/lvcJ:aW5WFdE710Wg/XfCfu1jacVAysM/lg
TLSH
T1C2E2EC3B280CCB7E4F444A9CED297D9BADA801CF969CCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f999.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f999.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d7ac097c6c8f5e892a53a85a4831ca2f376a139438df2dcb245c118674e344d1
MD5 eff3e547e6468914fbc13d3fa0c2210d
SHA1 1b5a0fb3f6c67b10b0999c96e386cebe73b4ae8a
SHA512 8cc8306c4d0bfde270866ff17a2e125df5ddb6394b647f67ce786289700cb1c51a7895a52f494cfea360822636e76ff41c6d6a96c3e96bdcd8e8a7c1f3ae0b17
SSDEEP 384:nHtNn/s3n9SX38Nd4XqYcjWZlf8hyEGbXt9LF5y2rEoajo4cdR8eHhVODjYPNDUK:Hj+9s3CIi0ntzrEnjN3Gac1FcLE
TLSH
T1CEE29E752D658E738CDAE6C9B6473B93BEE0026385C51E94D6DDAB0C05C37AC170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8afd45298f221e16af73f5c1aa780659154f0a1825b632af63a1368ad937ce03
MD5 46ce5a8a8e604783db04c993e1e4b684
SHA1 bd06bdbebc86c52d4f64bdc44fa16dc8139996be
SHA512 b2502f67e732f6106132e33037663998a833c2b848bb0687a8dcb038e88139e7b8575aec968f2709b78d6373fdce46eaa6861bdd7eec978b563779213759e5fe
SSDEEP 384:nViFKtNn/s3n9SX38Nn8TUNTUlIl4XqWKj4Hfc5yEGbXt9LFI62rEoajo4cdR8eD:cFKj+9s3wwgTXsntArEnjN3Gac1FcLE
TLSH
T1F41317F658D78A73D8DE9787673E6E429ABCC153B5841994B7C85D0CCC822BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 69d8ddae36ffdaac02650d38c9dbdc58c2cd0a09a232d58fc7062998a2d3a475
MD5 b2861d03655dba5ff617997f9b2339a9
SHA1 ac514844f6a69e3dc07b2a9d929dcb20513d86eb
SHA512 71cc6ced7cac760bb7de469839995ac66f761e9b9627e0d50b22ad8348da51582faa5f8a77d1b69737bc8e2388dcbbeea254368aba4771219acb507444981bcb
SSDEEP 384:nDsrv+89zHqlDNP9oid638NdDXqYcjWZlf8hyEGbXt9LFgy2rEoajo4cdR8eHhVW:4rv+4UNbd63PIi0ntgrEnjN3Gac1FcLh
TLSH
T1B803BF3179788E738CEBE685B5877A53BEF0125385C50BA4D6C96B0C05876ED270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9be383f604153b6e94c1661cb802552a0a7b9519b896685b354f0ec598a9a56f
MD5 aea984abd11e5426062c27c4d563a928
SHA1 cb30d18bb3e8e9656160fb48e25e24999d98739b
SHA512 858c419e34b04470552c0e5247d5264112b82f0b0ae31ae4c4ca4504ce2fcbff9d18a1b0f27c6c1564a5f35d26a8b4faa07ed1cf4539eaaa10fe7343ff7876af
SSDEEP 768:rrv+4UNbdS3Mmi0ntdrEnjN3Gac1ZyeVH1SCz:rbsbg3rPQnjMaVEH1V
TLSH
T1EF03CF3669A88E739CE7E38575837A037EF4525386C40BA4C6DD2B0D06DB9EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 510e5a2d79cc26363fbe124fc7b7967d62969a9b463d093eae8e4187dbfb6d2f
MD5 85d3f66ed65290d88dac07c626a85b77
SHA1 7552c7702962526b3fe0263e25d14871d038ad87
SHA512 b72449762b96f14bd67f2e9cf1e4e5105022701a7b352a19a08227cd3dddeb37047e8ccaf5aa1734e72453f44cf147a17b56ee38abf76a2e7dcb8ae3c3e3ca0b
SSDEEP 384:nViFbtNn/s3n9SX38Nn8TUNTUlIl4XqYKj4Hfc5yEGbXt9LFuy2rEoajo4cdR8eD:cFbj+9s3wwgRXsntWrEnjN3Gac1FcLE
TLSH
T10F1316F658D38A73D8DE9787673E6E429ABCC153B5841994B7C85D0CCC822BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cc2edc828f7d81519aaabddd2edc6e5df83c0280673e9aca75bc04b0db9a3fe8
MD5 144ab2ac99fd812aea981cdba32d6fd1
SHA1 fcfb5b0c8c497e0ee5afbbbc8afef5739bafe23d
SHA512 2e0ebb7605cc604dd77ee126b558f1be8efe8bee61655fa7b8e7c1dda574ada8803b3406309a1ccae90563c0943f39bdc04530432b4ea51677e01cddd9dd7ea6
SSDEEP 384:ntsrv+89zHqlDNP9oid638NdfXqYcjWZlf8hyEGbXt9LF5y2rEoajo4cdR8eHhVW:6rv+4UNbd63LIi0ntzrEnjN3Gac1FcLh
TLSH
T12C03BF3279688E738CEBE285B5477B53BEF0125385C50BA4D6D96B0C05876ED270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

a6da07a9-b604-4244-b518-7ce9d629dbc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a6da07a9-b604-4244-b518-7ce9d629dbc7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4632_1260469742\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 711b78e6f8c5d35c59042f208b48b6670a04613beaf9898ad7fd719205e70a96
MD5 0ad8e850acea38e2d4a695600ed234f7
SHA1 70c014b29d7169efa81ec1d498c4ca006d81041d
SHA512 04cffe7d2c331e8f4760532cab781b71e0fe7ecae17cc9b95c0c45b887c77f4eefa7075c6d52a568e5a576e1f4e280db4e618587cdf24d281ada665f88ea181c
TLSH
T11D71008356A9C5B3C19A5BF002C35648F5BB2278072320214B565546AA30B7E58B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1956-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2424-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2940-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3596-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4140-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4596-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4596-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4836-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5084-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5532-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5560-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download