systex | d6eb6e3b4695faef1770f5f92a20b53097ba1dd1e4f410b2c953a965a770705c

Analysis

max time kernel
124s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260713-1snthabv2v
SHA256 d6eb6e3b4695faef1770f5f92a20b53097ba1dd1e4f410b2c953a965a770705c
MD5 8a0b50566be3076b19e436b8990e7c2a
SHA1 08e0799ab7d5213598810c74bc38782aa85a33b7
SHA512 4494a273189eb10a5a3e5ad47810a5acbde434d77ba22d39cde813f4a43a510f3e76162dcfe69da85cd494ac25b6d06a5d5194d68ac6f139f1d9a1775182e148
SSDEEP 3072:oKFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBL/:oKFL1JeIJjiJcbI03GBc3ucY5DCSjX5
TLSH
T172847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2024	ojhbztrljebwtrlj.exe
3204	ojhbztrljebwtrlj.sys
2320	CreateProcess.exe
5020	wtoljdbzto.exe
6028	CreateProcess.exe
3500	CreateProcess.exe
2312	i_wtoljdbzto.exe
4236	dbztrljdbw.sys
2156	CreateProcess.exe
3508	oigaytqlig.exe
4752	CreateProcess.exe
3636	CreateProcess.exe
3420	i_oigaytqlig.exe
2864	vtqlidbvtq.sys
5244	CreateProcess.exe
6084	olgdywqoig.exe
2780	CreateProcess.exe
3440	CreateProcess.exe
1548	i_olgdywqoig.exe
2544	vsnlfdxvqn.sys
3520	CreateProcess.exe
5152	lidavsnlfd.exe
5812	CreateProcess.exe
3056	CreateProcess.exe
2716	i_lidavsnlfd.exe
6096	xsnkfdxvpn.sys
2516	CreateProcess.exe
2768	kicausnkfc.exe
1440	CreateProcess.exe
6024	CreateProcess.exe
800	i_kicausnkfc.exe
5892	xspnkfdxvp.sys
3620	CreateProcess.exe
3236	hfzxrpkhca.exe
620	CreateProcess.exe
3112	CreateProcess.exe
2192	i_hfzxrpkhca.exe
3388	urpkhczusp.sys
5828	CreateProcess.exe
3176	xrpmhfrpjh.exe
5612	CreateProcess.exe
1152	CreateProcess.exe
4136	i_xrpmhfrpjh.exe
5940	wuomgezwuo.sys
4812	CreateProcess.exe
3960	wuomgebzxr.exe
5240	CreateProcess.exe
1988	CreateProcess.exe
4748	i_wuomgebzxr.exe
4904	toljhbztrm.sys
4688	CreateProcess.exe
2544	rojhbywroj.exe
3152	CreateProcess.exe
2188	CreateProcess.exe
3392	i_rojhbywroj.exe
4848	ebwtolgeyw.sys
5636	CreateProcess.exe
2096	wqoigbytrl.exe
4644	CreateProcess.exe
4860	CreateProcess.exe
3952	i_wqoigbytrl.exe
2904	ywqoigeyvq.sys
764	CreateProcess.exe
2712	wtnljgdywq.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3040_2098220222\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtnljgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurmjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgebzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxusnkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurmjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtnljgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgebzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnlfdxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxusnkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnlfdxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljdbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljdbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpmkfcxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2396	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3152	ipconfig.exe
2416	ipconfig.exe
1704	ipconfig.exe
2364	ipconfig.exe
1224	ipconfig.exe
5564	ipconfig.exe
3416	ipconfig.exe
3356	ipconfig.exe
792	ipconfig.exe
4776	ipconfig.exe
2288	ipconfig.exe
3148	ipconfig.exe
1280	ipconfig.exe
4836	ipconfig.exe
5416	ipconfig.exe
252	ipconfig.exe
5172	ipconfig.exe
5524	ipconfig.exe
4204	ipconfig.exe
3492	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284533052315240"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{82B85BFE-F568-485E-8A15-2E25066C30CC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
2024	ojhbztrljebwtrlj.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2024	ojhbztrljebwtrlj.exe
2024	ojhbztrljebwtrlj.exe

Suspicious behavior: LoadsDriver 16 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	i_wtoljdbzto.exe
Token: SeDebugPrivilege	3420	i_oigaytqlig.exe
Token: SeDebugPrivilege	1548	i_olgdywqoig.exe
Token: SeDebugPrivilege	2716	i_lidavsnlfd.exe
Token: SeDebugPrivilege	800	i_kicausnkfc.exe
Token: SeDebugPrivilege	2192	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	4136	i_xrpmhfrpjh.exe
Token: SeDebugPrivilege	4748	i_wuomgebzxr.exe
Token: SeDebugPrivilege	3392	i_rojhbywroj.exe
Token: SeDebugPrivilege	3952	i_wqoigbytrl.exe
Token: SeDebugPrivilege	5188	i_wtnljgdywq.exe
Token: SeDebugPrivilege	2192	i_davsnlfdxv.exe
Token: SeDebugPrivilege	3952	i_xvpnlfdxus.exe
Token: SeDebugPrivilege	628	i_axvpmkfcxv.exe
Token: SeDebugPrivilege	4356	i_zxusnkfcxu.exe
Token: SeDebugPrivilege	1704	i_eczurmjhec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2024	1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 1904 wrote to memory of 1388	1904	2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1388 wrote to memory of 3040	1388	iexplore.exe	89
PID 3040 wrote to memory of 5692	3040	msedge.exe	90
PID 3040 wrote to memory of 2532	3040	msedge.exe	92
PID 3040 wrote to memory of 2396	3040	msedge.exe	93
PID 3040 wrote to memory of 2532	3040	msedge.exe	92
PID 3040 wrote to memory of 2532	3040	msedge.exe	92
PID 3040 wrote to memory of 1784	3040	msedge.exe	94
PID 3040 wrote to memory of 1784	3040	msedge.exe	94
PID 3040 wrote to memory of 4700	3040	msedge.exe	95
PID 3040 wrote to memory of 1948	3040	msedge.exe	96
PID 3040 wrote to memory of 4700	3040	msedge.exe	95
PID 3040 wrote to memory of 4700	3040	msedge.exe	95
PID 3040 wrote to memory of 1948	3040	msedge.exe	96
PID 3040 wrote to memory of 1948	3040	msedge.exe	96
PID 3040 wrote to memory of 3356	3040	msedge.exe	97
PID 3040 wrote to memory of 3356	3040	msedge.exe	97
PID 3040 wrote to memory of 3356	3040	msedge.exe	97
PID 3040 wrote to memory of 1248	3040	msedge.exe	98
PID 3040 wrote to memory of 1248	3040	msedge.exe	98
PID 3040 wrote to memory of 1248	3040	msedge.exe	98
PID 3040 wrote to memory of 2884	3040	msedge.exe	100
PID 3040 wrote to memory of 2884	3040	msedge.exe	100
PID 2024 wrote to memory of 2320	2024	ojhbztrljebwtrlj.exe	103
PID 3040 wrote to memory of 3948	3040	msedge.exe	106
PID 3040 wrote to memory of 3008	3040	msedge.exe	107
PID 3040 wrote to memory of 3948	3040	msedge.exe	106
PID 3040 wrote to memory of 3008	3040	msedge.exe	107
PID 5020 wrote to memory of 6028	5020	wtoljdbzto.exe	108
PID 3040 wrote to memory of 596	3040	msedge.exe	112
PID 3040 wrote to memory of 4632	3040	msedge.exe	113
PID 3040 wrote to memory of 4632	3040	msedge.exe	113
PID 3040 wrote to memory of 5996	3040	msedge.exe	116
PID 3040 wrote to memory of 5996	3040	msedge.exe	116
PID 2024 wrote to memory of 3500	2024	ojhbztrljebwtrlj.exe	117
PID 2024 wrote to memory of 2156	2024	ojhbztrljebwtrlj.exe	121
PID 3508 wrote to memory of 4752	3508	oigaytqlig.exe	123
PID 2024 wrote to memory of 3636	2024	ojhbztrljebwtrlj.exe	126
PID 2024 wrote to memory of 5244	2024	ojhbztrljebwtrlj.exe	130
PID 6084 wrote to memory of 2780	6084	olgdywqoig.exe	132
PID 2024 wrote to memory of 3440	2024	ojhbztrljebwtrlj.exe	135
PID 3040 wrote to memory of 4144	3040	msedge.exe	137
PID 3040 wrote to memory of 4144	3040	msedge.exe	137
PID 3040 wrote to memory of 4144	3040	msedge.exe	137
PID 3040 wrote to memory of 1308	3040	msedge.exe	141
PID 3040 wrote to memory of 1308	3040	msedge.exe	141
PID 3040 wrote to memory of 1308	3040	msedge.exe	141
PID 2024 wrote to memory of 3520	2024	ojhbztrljebwtrlj.exe	142
PID 5152 wrote to memory of 5812	5152	lidavsnlfd.exe	144
PID 2024 wrote to memory of 3056	2024	ojhbztrljebwtrlj.exe	147
PID 3040 wrote to memory of 2868	3040	msedge.exe	149
PID 3040 wrote to memory of 3180	3040	msedge.exe	150
PID 3040 wrote to memory of 2380	3040	msedge.exe	151
PID 2024 wrote to memory of 2516	2024	ojhbztrljebwtrlj.exe	154
PID 2768 wrote to memory of 1440	2768	kicausnkfc.exe	156
PID 2024 wrote to memory of 6024	2024	ojhbztrljebwtrlj.exe	159
PID 2024 wrote to memory of 3620	2024	ojhbztrljebwtrlj.exe	163
PID 3236 wrote to memory of 620	3236	hfzxrpkhca.exe	165
PID 2024 wrote to memory of 3112	2024	ojhbztrljebwtrlj.exe	168
PID 2024 wrote to memory of 5828	2024	ojhbztrljebwtrlj.exe	172
PID 3176 wrote to memory of 5612	3176	xrpmhfrpjh.exe	174
PID 2024 wrote to memory of 1152	2024	ojhbztrljebwtrlj.exe	177
PID 2024 wrote to memory of 4812	2024	ojhbztrljebwtrlj.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_8a0b50566be3076b19e436b8990e7c2a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Temp\ojhbztrljebwtrlj.exe
  C:\Temp\ojhbztrljebwtrlj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoljdbzto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2320
  - - C:\Temp\wtoljdbzto.exe
      C:\Temp\wtoljdbzto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoljdbzto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3500
  - - C:\Temp\i_wtoljdbzto.exe
      C:\Temp\i_wtoljdbzto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaytqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\oigaytqlig.exe
      C:\Temp\oigaytqlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaytqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3636
  - - C:\Temp\i_oigaytqlig.exe
      C:\Temp\i_oigaytqlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5244
  - - C:\Temp\olgdywqoig.exe
      C:\Temp\olgdywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3440
  - - C:\Temp\i_olgdywqoig.exe
      C:\Temp\i_olgdywqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\lidavsnlfd.exe
      C:\Temp\lidavsnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3056
  - - C:\Temp\i_lidavsnlfd.exe
      C:\Temp\i_lidavsnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\kicausnkfc.exe
      C:\Temp\kicausnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\i_kicausnkfc.exe
      C:\Temp\i_kicausnkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3620
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3112
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhfrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\xrpmhfrpjh.exe
      C:\Temp\xrpmhfrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhfrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1152
  - - C:\Temp\i_xrpmhfrpjh.exe
      C:\Temp\i_xrpmhfrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgebzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\wuomgebzxr.exe
      C:\Temp\wuomgebzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgebzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1988
  - - C:\Temp\i_wuomgebzxr.exe
      C:\Temp\i_wuomgebzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\rojhbywroj.exe
      C:\Temp\rojhbywroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2188
  - - C:\Temp\i_rojhbywroj.exe
      C:\Temp\i_rojhbywroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5636
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4860
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtnljgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:764
  - - C:\Temp\wtnljgdywq.exe
      C:\Temp\wtnljgdywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtnljgdywq.exe ups_ins
    3⤵
    PID:1092
  - - C:\Temp\i_wtnljgdywq.exe
      C:\Temp\i_wtnljgdywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    PID:548
  - - C:\Temp\davsnlfdxv.exe
      C:\Temp\davsnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    PID:2996
  - - C:\Temp\i_davsnlfdxv.exe
      C:\Temp\i_davsnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnlfdxus.exe ups_run
    3⤵
    PID:3180
  - - C:\Temp\xvpnlfdxus.exe
      C:\Temp\xvpnlfdxus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnlfdxus.exe ups_ins
    3⤵
    PID:4548
  - - C:\Temp\i_xvpnlfdxus.exe
      C:\Temp\i_xvpnlfdxus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpmkfcxv.exe ups_run
    3⤵
    PID:2864
  - - C:\Temp\axvpmkfcxv.exe
      C:\Temp\axvpmkfcxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpmkfcxv.exe ups_ins
    3⤵
    PID:2648
  - - C:\Temp\i_axvpmkfcxv.exe
      C:\Temp\i_axvpmkfcxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxusnkfcxu.exe ups_run
    3⤵
    PID:1748
  - - C:\Temp\zxusnkfcxu.exe
      C:\Temp\zxusnkfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxusnkfcxu.exe ups_ins
    3⤵
    PID:868
  - - C:\Temp\i_zxusnkfcxu.exe
      C:\Temp\i_zxusnkfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurmjhec.exe ups_run
    3⤵
    PID:2504
  - - C:\Temp\eczurmjhec.exe
      C:\Temp\eczurmjhec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurmjhec.exe ups_ins
    3⤵
    PID:3280
  - - C:\Temp\i_eczurmjhec.exe
      C:\Temp\i_eczurmjhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywrojhb.exe ups_run
    3⤵
    PID:3148
  - - C:\Temp\jgeywrojhb.exe
      C:\Temp\jgeywrojhb.exe ups_run
      4⤵
      PID:4828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywrojhb.exe ups_ins
    3⤵
    PID:5260
  - - C:\Temp\i_jgeywrojhb.exe
      C:\Temp\i_jgeywrojhb.exe ups_ins
      4⤵
      PID:3288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbztrljd.exe ups_run
    3⤵
    PID:5172
  - - C:\Temp\ljdbztrljd.exe
      C:\Temp\ljdbztrljd.exe ups_run
      4⤵
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbztrljd.exe ups_ins
    3⤵
    PID:5256
  - - C:\Temp\i_ljdbztrljd.exe
      C:\Temp\i_ljdbztrljd.exe ups_ins
      4⤵
      PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgaytql.exe ups_run
    3⤵
    PID:3540
  - - C:\Temp\trljgaytql.exe
      C:\Temp\trljgaytql.exe ups_run
      4⤵
      PID:3740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgaytql.exe ups_ins
    3⤵
    PID:3356
  - - C:\Temp\i_trljgaytql.exe
      C:\Temp\i_trljgaytql.exe ups_ins
      4⤵
      PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    PID:5888
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      PID:4844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4204
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff95dc0c188,0x7ff95dc0c194,0x7ff95dc0c1a0
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,11513646000630989161,1081018162862339606,262144 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,13706041180513109243,11574643911538388344,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
      4⤵
      System Time Discovery
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,12246348873911582371,11645406928714548773,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,5944473665734210120,12409220716360398374,2097152 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3062318418880024263,15508936693172253170,2097152 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5330539742332209470,5427151673077746366,2097152 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10782232456608155920,6663850475896795352,2097152 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,9655290600723006039,7983106797080273226,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,9413890501801837442,186832029175837756,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4939246691190968282,5225099049533452704,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10936252570569054786,15467748893758412547,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10936252570569054786,15467748893758412547,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12104395119219311648,3116247056413249376,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,9757506528083996845,1692813956623808102,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5012,i,7624857500154856213,12130842205814195391,2097152 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3620,i,15635621206817306692,12424527826749581822,2097152 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,15702670428814738653,4245623246416409838,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,6977923223991194748,13396367981798688744,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,10612447548252534043,16430631681138795256,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,9093448214716111825,13404032558059284166,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,12692685739503054361,13710229850979743876,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=924,i,17089078948670864082,529732878481518951,262144 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:10
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12410992824153714109,12162237440357085298,524288 --field-trial-handle=2284,i,1600537757118393592,2496209133976977607,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2844

C:\Temp\ojhbztrljebwtrlj.sys
C:\Temp\ojhbztrljebwtrlj.sys
1⤵
- Executes dropped EXE
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4364

C:\Temp\dbztrljdbw.sys
C:\Temp\dbztrljdbw.sys
1⤵
- Executes dropped EXE
PID:4236

C:\Temp\vtqlidbvtq.sys
C:\Temp\vtqlidbvtq.sys
1⤵
- Executes dropped EXE
PID:2864

C:\Temp\vsnlfdxvqn.sys
C:\Temp\vsnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:2544

C:\Temp\xsnkfdxvpn.sys
C:\Temp\xsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:6096

C:\Temp\xspnkfdxvp.sys
C:\Temp\xspnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\urpkhczusp.sys
C:\Temp\urpkhczusp.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\wuomgezwuo.sys
C:\Temp\wuomgezwuo.sys
1⤵
- Executes dropped EXE
PID:5940

C:\Temp\toljhbztrm.sys
C:\Temp\toljhbztrm.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\ebwtolgeyw.sys
C:\Temp\ebwtolgeyw.sys
1⤵
- Executes dropped EXE
PID:4848

C:\Temp\ywqoigeyvq.sys
C:\Temp\ywqoigeyvq.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Temp\idaysqniga.sys
C:\Temp\idaysqniga.sys
1⤵
PID:5768

C:\Temp\axvpnifays.sys
C:\Temp\axvpnifays.sys
1⤵
PID:5308

C:\Temp\fcavsmkica.sys
C:\Temp\fcavsmkica.sys
1⤵
PID:2916

C:\Temp\czusmkecxu.sys
C:\Temp\czusmkecxu.sys
1⤵
PID:2764

C:\Temp\zxrpmkebzx.sys
C:\Temp\zxrpmkebzx.sys
1⤵
PID:4524

C:\Temp\omgecwuomg.sys
C:\Temp\omgecwuomg.sys
1⤵
PID:2312

C:\Temp\trojhbztrl.sys
C:\Temp\trojhbztrl.sys
1⤵
PID:5340

C:\Temp\wqoljdbztq.sys
C:\Temp\wqoljdbztq.sys
1⤵
PID:4380

C:\Temp\gaywqoigay.sys
C:\Temp\gaywqoigay.sys
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbztrljdbw.sys

Path C:\Temp\dbztrljdbw.sys
Size 293KB
SHA256 4927da516af91169065888b8a2172d28a5bced6870151704aa486171920669f8
MD5 5e25a1a5c18d7bc1d95767bee77ee3bd
SHA1 590f0c28455f951ccdd1445ad1af9db7796c469a
SHA512 ea5df02c0314c1a7f18bc1184ded642c2bf380be01ef949c78467b40d57aaa21ffd29fcf6bb239c94f30126fae029263e6ef45fbd7c011087993cdf0e9e03af4
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhca.exe

Path C:\Temp\hfzxrpkhca.exe
Size 376KB
SHA256 c531602778904ed5cda796e5f5ad4c8e3026cd1701016a34731db0ac8af8bb59
MD5 89974b1d98a3fd5cbb1448059eaba4bc
SHA1 71585d3cf4292b453f26f31f0699998f2ead75e7
SHA512 1638e8587ffdfdec89f6c85e54275395773b5f8441e0d3975c4244303b57b9c37e990d5e378ecd2ad3bd29668fe2fec544d213f5d312e501e4e900b5ebb53298
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausnkfc.exe

Path C:\Temp\i_kicausnkfc.exe
Size 376KB
SHA256 f17f3bfb693514cf9c03ec556085c1af24b22bb6c8a56d371a1b9a60e5e54a8c
MD5 fe132c069da23cc4461d316b733255fb
SHA1 47c6155c150ac6b320f2a753a64d826a48f9b92b
SHA512 0e9b32e88b9d32f417e9eaf730dc05ef260797035e4ef65677b53a7471b5c7ba700c8368341996d47a2f0d209d24bd8edf1497c5bd727a0e6c57f0d46d4cc396
SSDEEP 3072:SFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidavsnlfd.exe

Path C:\Temp\i_lidavsnlfd.exe
Size 376KB
SHA256 1c31cbc701d464d53fd5824cdd57a45b700d4b025c04eab4c493836a281dc664
MD5 80fa188ed6a8f3b197cc5e2d00099898
SHA1 c441753e925b08564b472b0175c763b2fd490120
SHA512 c00c243b0d62a4ef8877042a32e4361b12ba929042ec19cff102a49dc803e774d12478462fb9036770a130a757ef55102afb061611bebef583d7d738d7923efb
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaytqlig.exe

Path C:\Temp\i_oigaytqlig.exe
Size 376KB
SHA256 fd89f80026e2d6ed2ed190339015b5bc15a0b1b942154b8038ad0989aee1646f
MD5 9d6504549af227dbac1375500bc2e327
SHA1 11d6847f32f59319944517ea7a942f523bd20e8b
SHA512 bcad79342de6b761e9dbcad5791f5837235a537c4c8530638b2cb4a5b2460a734049839a8be923496a79d9cc39c7ccf71b9429cbcdb245d5af61895aa10ad0d1
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgdywqoig.exe

Path C:\Temp\i_olgdywqoig.exe
Size 376KB
SHA256 ed39604277b66d85adc02c1de7b9da2f16c68f88b9fea495a9adb93df012e52f
MD5 ae884c6d8fdf53cbc7eb32ad4c902f9e
SHA1 4b82cdd1ca31a2091f46bb584184746edd155e3f
SHA512 5318912d007ff279788f236a8899e1068e04cc3971a99fae931146ca7cb6c5d53703e289e525a53c43f5c584d396363332668295d60a81570e0627b9fc301e2a
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T149847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtoljdbzto.exe

Path C:\Temp\i_wtoljdbzto.exe
Size 376KB
SHA256 7cdb89d7959abfb6ce1149edf23d8b618e6dc8b2a05831707205502de605be9c
MD5 3ca1de7c291cbdcc0c89c9d911786a9e
SHA1 e8eff9ab980c26b927d84223282171e7742d9d9d
SHA512 d6eb82eb08074d6df99cc0191c4598c3e37adb7800cbca3c70bfe182a35d32c0f6cface820691f9cdff12cdea9f413d7f3fd765d2461a6d980a11eed00295428
SSDEEP 3072:8FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfc.exe

Path C:\Temp\kicausnkfc.exe
Size 376KB
SHA256 38d1b295e546f22871ef866f102001fd3abc0477aca6ecc6e689df4fa120f813
MD5 b6d58a4a5c9b8f0cb633108671e31904
SHA1 8ca6a43a8b7af65796ba01b603ca027d3b561c9f
SHA512 20f0406015422536865c80d55b636bf5228115171a88b91fdbdadb117b1dd817518d33369dac25547c672d4542be66a779675ce45426671be7e095433ad2f4ef
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavsnlfd.exe

Path C:\Temp\lidavsnlfd.exe
Size 376KB
SHA256 48799f4157d055b52115fb24f58e769c7e252ad31a1f1ec5478248d934214d5e
MD5 99d2b110490d395e70a5213a58b2b613
SHA1 9c0d3c2776060a10efa310602eab618ad19b6dc4
SHA512 19648b787c374cfa67a18f4ee99b78bd0bc8bb1cf574b8dde107f2013fcb8e0125cc6023661ff6abab55ccb727ce780124e655a9196a60305a7aa666b27ec290
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T187847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqlig.exe

Path C:\Temp\oigaytqlig.exe
Size 376KB
SHA256 9f1b06c3fd3b3c74687d00d71dbfa88ab555d53edb03dd2c2f3cffc620d8ecc6
MD5 c199a3c3f2f869643e42967f18716dbb
SHA1 e7c2132e1ffa0535e79f209d33bda5bd21883f0f
SHA512 7f5afd4ca554e39a76f2ed771e63f32d9a3d0783624e57acbb00c1cfb17f58372961162fd8724af4bab511cdd5ac9d959f165923d34b1fdaca03ac8fe3da8249
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrljebwtrlj.exe

Path C:\Temp\ojhbztrljebwtrlj.exe
Size 376KB
SHA256 b405b5736dbd61d413d6c5f02633e16a5441b1865f9ce5bad17ff3a4b30ec13e
MD5 ab1ffe3eb17e3058d112dcb2c1427e29
SHA1 2a9c48ecc62e261bbafcb8ecaf5c420535883353
SHA512 04a88cfbb211c3c1f4d434fca3ed9221bd550c7fe9e09ecc416bbb8999046dd06f40741b46494d72258c63bc262f35dc620556f3b99f554f5bfc60b196b1d8b4
SSDEEP 3072:iKFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBL1:iKFL1JeIJjiJcbI03GBc3ucY5DCSjXT
TLSH
T10B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrljebwtrlj.sys

Path C:\Temp\ojhbztrljebwtrlj.sys
Size 293KB
SHA256 fdd6a09a6a9ad6bbdc1637e1bff987d0c2e4e4a964a697fe90f2fa61fd770599
MD5 f21eacf78a1e55e04549be49e7c52b59
SHA1 b4b13e80fe8dcb1f09e1af50d33ffc880f33abce
SHA512 fcc93f5703b374470959f5281c46cc5f9307c00ace1c8043a1913c0fd7e1210c94df74df109c9ac8141fc1b68ab7be963f674f455dbe60b79272bb79040552a3
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T153545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.exe

Path C:\Temp\olgdywqoig.exe
Size 376KB
SHA256 5e40bfcc38dc7486d8750dec89b7fa9d820b54380310316e51213860d71ee0ee
MD5 e3c3f30600abd7a8535decce91812983
SHA1 223727bca043b7bc22cce3c973c8195ae0029750
SHA512 41512ca164aa55f6dd6fe2a1fd207665fee0b0e0ca4debc842517b1f482bd53507f67d80ef6eaca2ca1ec4a2452713e58f7c9fe5484b52f08630060e78a0b559
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.sys

Path C:\Temp\vsnlfdxvqn.sys
Size 293KB
SHA256 4bcbbff1dd11db1ad94d09f5da04e0df0ba1a4bc7eb4424083d43f68bdec0a2c
MD5 bd15ebb72e49d85520e4df410147adaa
SHA1 d34487de445267ac8fceb4517397c68daba8af67
SHA512 ef0637d383c86be49719e72bca4219970fea11fc2480c81dc9f31ea48fe9e6aac2a632a51e9144f4ea7a5b3354dedbb9364fca5598a3af92250df3d37cf3d8c0
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqlidbvtq.sys

Path C:\Temp\vtqlidbvtq.sys
Size 293KB
SHA256 bbd7a0e8f40238e070803f591bcd53594d17edaae17a99fd529c0f2afe1bebc0
MD5 ee634e3c680d22d557c4c8072c59a468
SHA1 eec9a2eff82ee3cde42b837f714091d48d925df8
SHA512 5af257b3b998b6f334802b7bca2f3e7afa7ad0da6bfeffb3f9316d52b034ccf29715d2d687bda2a18f897946c9a4dfd69349bdcb9456a4232f4b02bafb5f0f7c
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljdbzto.exe

Path C:\Temp\wtoljdbzto.exe
Size 376KB
SHA256 0f6b44c44f7f7acd7faf063effbcdfb548ab66984ef659dd490ebe4e2ec5fc18
MD5 d63ff1f3b4aff82a169c3465a733c40c
SHA1 9f3bf017eb66ba5907607e5a2a5005cb328ffbf9
SHA512 faaf41c04b8c539c2f0d75c3b6629aab54e66a2fcb343a88cc1f9e074e2877930596c348ac5736e81db43edd6ec222318215a3b2bea4d5d6e3bbd6b0f490dbdd
SSDEEP 3072:NFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsnkfdxvpn.sys

Path C:\Temp\xsnkfdxvpn.sys
Size 293KB
SHA256 7293ccf96d718491cac222e9198dd4feebd60fd560acd44ca438d306322ddc73
MD5 930b8d7f6cd726a417175390859289ea
SHA1 d3da823c0221167bbbea69dd54d99bdc1968a501
SHA512 0d9f1c55926559a962eeadaec2be749b16b3ef4e854f875a28fa3f06c7cac8f662873fd8ec8f32b876bf946f962bdcd5b7d08f4eb80966b5ae7c80ec7d6f3f68
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T138545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspnkfdxvp.sys

Path C:\Temp\xspnkfdxvp.sys
Size 293KB
SHA256 cac8121c5cf00a64b7dd98b4ad3f6d830f55037398834b4d094db96ac7af6de5
MD5 c6b7281bd60aabd9df5bafef27f0fab6
SHA1 8b4812fb902c292290752d73c123746a0b4d44b9
SHA512 a2d8ea7c6cb94d37a28c9c894b4182e552e6921951de3921f5ceb320c33e451ce77f3fb20dac6c7134166db4e9e468e069c979c43e5bd48a8309696d3e35999b
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1877fe41c5999aae4190bfdb9023cea58b31d5d1dc876d622f796a66f69ff281
MD5 73e6f24bb219a358784f3c001d168a68
SHA1 fe50a869fe85e46511821241cdd3a9f6c981e3f4
SHA512 6c6c9dfb7404c44959a8c601510bb85527be98c75d02555b4776b18794cca7ea5b6c6a8a54cc4d1f0700ae8889a414edf4d988d6650a359e05967060eff84abb
TLSH
T13E512A500B2FF9C9EBBFD87174E0C0E83A7DCAA9D147AE4351B891345A0E30C1BC0129
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 979392a5f6dfcd5115cac5c10ec31811b50e030b04db6ce161901ea63d7e1663
MD5 5e39f824db55834b7dfbf289cef71566
SHA1 68a377775a47bc0d42a526fe0c4928ae893cb18b
SHA512 d59fa672c6b7e43860f6b5dcf37e2889768469ecd706c3fbe9d06c942d0e856ac5d07ec69811f11b28ab15f5455088dede258c635b4e88b66090114885779f10
TLSH
T192418CF3C3E4856ECA1196F0AA187E1BCE2D0925432C3D5AC9E4AE1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4b7f23627eb7439335659029aa016cf8f4fadc5a478b42bc28cb2bce5c2e2b42
MD5 fcc199cdc98605db449038b1538a6b4c
SHA1 571ef36a9701306ad12ab38593abc50bdd3ca858
SHA512 95e3e128a8e90c78a75aa72388cc4cc3a53de4965e2bcffea7b08991f80998ea28bdb792ee20c5117255d51fa80e1328fe9e46f0c82dcdcac3d086b7d93f09ca
SSDEEP 192:sxRORMyM/jK1Ml8wCX/fUsYf2Z21AezoA8pi/g6+WNIYZ7BKsLGlIgtJ:sxROe8X/fUsYfA2KDi/5I+Y3
TLSH
T1E052D915AA24993BDCDBD30DFA517F93D6F81573E2901E44AAFC8A1C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d199f983f4ce51f98d895bae3cfe551fcb066082c3e82880ca16888980571b87
MD5 88917375cd17d625bf2d25016a70fec4
SHA1 4a743ceaf4c96f04ea0f6f2c0ed7174713cb8f8b
SHA512 76763e4d687a762ecf7a3a96566fe02dffddf520bd43d87b472ba1106d61acedfb53ac0432d53909307226ee13d49eebe378ad0ca9390ba08da5cbdb6cdd1a4a
SSDEEP 192:sxRZRMyM/jK1Ml8wCX/fUs5X2Z214ezoA8p9b/g6+WNCnH/YZ7QusLGlIgDsJ:sxRZm8X/fUs5XA2uDJ/5W/pYc
TLSH
T1A362D915AA24597BDCDBD20DFA517F93D2F81572E6904E48AAFC8B0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2cde377a6f26c60be6a91f2cd07a3186563f42b2a8c48dad131f64729c93a989
MD5 37994f316e4f644683aa91413a60824b
SHA1 83ea22cfb8dbe8d29e08287c795e6829b9486193
SHA512 63e18de44a37fb7dbf9e58b0a997cf51f4627bc52d7586eae61d47e9db27828c14a8e4a467ea0564bd6d76f1c56d19c0df351f87d45682f33587a00135046c87
SSDEEP 192:sxRZRMyM/jK1Ml8wCX/fUs5f2Z21AezoA8pi/g6+WNIYZ7BKsLGlIgDKJ:sxRZe8X/fUs5fA2KDi/5I+YC
TLSH
T1B152D816AA24593BDCDBD30DFA417F93D6F81573E2905E44AAFC8A0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ebfd56cf4c0ce203e3383c7a1bbbe21f39a324e02748abceace7a53d9b93ce8f
MD5 a346f2fef448f372462574edeef496f8
SHA1 bc1e948c3a927ef2749d7831da198d483efffc7e
SHA512 2a0269241266c142fb5e22aff69b4376d65d5216ccc6c0a54e2c1c99688f5c1f406e720e9ccc60e5cbd60d1f0c3202fb9ab775575ebe1315c8aa1d848644fe29
SSDEEP 192:sxRZRMyM/jK1Ml8UQsCX/fUs5X2Z214ezoA8prb/g6+WNCnH/YZ7QusLGlIgDsJ:sxRZmqLX/fUs5XA2uDn/5W/pYc
TLSH
T11362D916AA24597BDCDBD20DF6517F93D2F85572E6904E48AAFC8B0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 32b01c8950fb81199c1ded6fe1a0925d9469bca4bf0cdfa461e4bfbdacefc44c
MD5 18369ad80c62f8b3d5b2a8e7514cecc9
SHA1 4f111253bb2cc6a114b9a7ec420a8caf159c60f8
SHA512 2218640deee690ad4b343e9b775c5205a798214fcebfb9a51e5f898310a5a310af91bb20907849cf542aca101ef13e597ec58523da514c0a8726012bed1f71dd
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2vtSV2jroHh0wS:kfISGqE7CvWgd5fWbu1jaNvtU2QHh0wS
TLSH
T1C1E2DC3B640CCB7F4F804ADCEC297E9AADE801CF96D8C99447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 68a3cf6f0ced22eb80e9cd85e18226c608860ad6a144db0c7253cf85542913fb
MD5 d2d89f56d179b584119e30e4733833d0
SHA1 db017dfd29e1e7f4709f6e8819df1cee22708e12
SHA512 09fc0961fee4a0514ebb0926f30b258eb91a4c6cb30d0c0e637d5eebb6c766096cd36341389041a5b475879210f58f86e8982a8ebb8366b3b32784d53a89b027
SSDEEP 48:K8SI/Kzq43ypCI/KPK8XkI7KBq07y7VgZFTH:K8SUKzqKqCQKPKskwKBqSeVgZFTH
TLSH
T14F911447707E169139BF2849A561C51AC7C2B4E3326DA42B3BF840724B6EF420DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8934bdd-a77b-4ecc-9fce-ec60ae80ef9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8934bdd-a77b-4ecc-9fce-ec60ae80ef9c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c93ebb91-bfba-4f5a-a879-65612da43a08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c93ebb91-bfba-4f5a-a879-65612da43a08.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 8c1bc5abad23a4b5c1f524f49e73669f959136f62e6b601c1285efcc1d673343
MD5 f0e3104ae274d12597891a28d52d5a8f
SHA1 ff1dcf71a0d688a33ac4295b10d8cdfadf009c60
SHA512 9467558aea77071d62ed71c8919d1e6798cd6122587389a9ec7b552b53a03e991109f761d2e233ed29599dc3165b3f5b678d1f5f16c13ce60ae0c7940a07b4bd
SSDEEP 768:Lj+953DMSIq9LRLAyAam6aQMGdjWca4Ghf9TGi:e953QtcmaME6pTZ
TLSH
T16FD29E315869DC639CA79699F31B27C7BEF012B388C81E84D9D96F0D06D728D2707D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d217494990b3af7fa9e01e4199471d025480049c1a5a521a0d453d38c297b072
MD5 3ddadb356c37244d36da8ed4331cd4c1
SHA1 7967170ea8c32eabaf41f3a26c58a42288c4718a
SHA512 921768aac6a1c7fc67151cd428a21d8be2c640b83c5b087987b716d1496e7edd4b91467618c4c0c3fbb39eb91c3e4012474e6d3872e1970773fab518a3d7700a
SSDEEP 768:ZF1j+9z3HwgbMMEPLRL4Aam6aQMGdjWca4Ghf9TGi:o9z3+gmaME6pTZ
TLSH
T15F0307F198D78937DCAE4787A33D2E86A9BCD163B8885984FBC45D0CCD921BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 83a088f122b5d33cee7318d7f7c9a166ba73219919a26ec28b885884b8e6c1d4
MD5 23f2643f35941117de7c97fb530bb6a7
SHA1 a449fea1daf39cb8b8d17b812707c3f0000544ba
SHA512 816e61a3a3b9056926777e80e25627a2484e1c6b1c7c64d97c65c7d97c189bfb69a0a02a48305f40629ad305569ddf234ff072d09cb3c10e15b1423f02e88759
SSDEEP 768:/rv+4UNbdq3qXq9LtAAam6aQMGdjWca4GhfBdPeU/:/bsbc3LKmaME6pFH
TLSH
T148F2AE31A86C9573DDB79A99F21B6787BEF021A388D40E84D9D92B0D439708E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b63f706b9cca5ec97763595ca0fdfc59e4d6f6903f08853b9760c5846f078aa7
MD5 6c34844c56c0cb006e336e5f20952d46
SHA1 fe715cff07012bc5453ae42016150becc4e34d46
SHA512 02abd1e792f83fe69705fe8d33396db9aa232c61cf2ff1f44f6fa46c2eb5b492aa7ab6ba36d1731cb4a44ee36807c33a737191d485d0b43a7556da724b88bb37
SSDEEP 768:urv+4UNbdr3YMrIq9LRLAyAam6aQMGdjWca4Ghf9TXV:ubsbN3jicmaME6pTF
TLSH
T1D203AF31A87CD9739CA7A695F21B3683BEB022B388C40E84D9D95B0D46971CE370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9dd878293996a845dcd4f079464fd2729bdef4acc752b112674e9e5b3330fb37
MD5 ea6457f0129404abeebb15e4f92e5c33
SHA1 e780a24032d36baa392f25557220526e900c9ac7
SHA512 1b57a81b47339389f1fd2e0980b7cc01a9753224fc4ed6ee525a7c106c250742bb1418862b964c1a02e079f213c900ee6023eed055e9ca623841e1082e8b017f
SSDEEP 768:Tj+953YMSIq9LRLAyAam6aQMGdjWca4Ghf9TGi:2953jtcmaME6pTZ
TLSH
T188D29F315869DC639CA79699F32B27C7BEF012B388C81E84D9D96F0D06D728D2707D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

961ca6d4-3139-45b1-8a88-c791c3493d22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\961ca6d4-3139-45b1-8a88-c791c3493d22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3040_1759699817\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 902d4032d61d34e2ea81f788fd143c66d35ea9be389e85355494d45f7e567f92
MD5 458ca9d600edbd258c37a922f3c64f78
SHA1 e4d66b011b1642b5a0706dd3002cb61ef3a9ddfe
SHA512 211347a81082a1c5984700b7e41c8f74df15009ed50e9783deb90c5f84ad1230b19a3bf5e4fc567a729726b3e873b1784ec7cfb6d13f271bfdb8c21c7507029c
TLSH
T14F71238357B8D6F3C1DE9FF502835644F6FB26784B6370200B615546AB30B7A54B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2312-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2864-248-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2904-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3204-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3388-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3388-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4236-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4380-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4524-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4848-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4848-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5308-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5340-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5768-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5892-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5956-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6096-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download