systex | af01e1e3650a110314e721fbc2d217bbec3762d190d3588ac428a8b61e2fe102

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260715-c7cssah16n
SHA256 af01e1e3650a110314e721fbc2d217bbec3762d190d3588ac428a8b61e2fe102
MD5 6d225b79b4d0329d56782d6ed68b81d1
SHA1 a24c2c17437ef557e4cc1ca63641a308157c5df9
SHA512 ce2727103109f777c0aa24494c77bf4a05f28c3e67bae121443302f639c346f9b49f5786467a2ba20bc9b9c58610839e38a08e860bb39a0fd0ff61bc741ecfd0
SSDEEP 3072:uViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1584	trljhbytqojgebwt.exe
3388	trljhbytqojgebwt.sys
4908	CreateProcess.exe
6028	dbwtrojgbw.exe
1312	CreateProcess.exe
6020	CreateProcess.exe
5112	i_dbwtrojgbw.exe
3860	rljdbvtolg.sys
4976	CreateProcess.exe
5848	yvtolgdytq.exe
2600	CreateProcess.exe
1532	CreateProcess.exe
5152	i_yvtolgdytq.exe
5068	vtnifdysqo.sys
5628	CreateProcess.exe
4136	oigaysqljd.exe
5252	CreateProcess.exe
1220	CreateProcess.exe
4512	i_oigaysqljd.exe
4792	fdavtnlfdx.sys
6136	CreateProcess.exe
708	yvpnifaysq.exe
2312	CreateProcess.exe
5764	CreateProcess.exe
4856	i_yvpnifaysq.exe
2700	nkfdavpkhf.sys
2416	CreateProcess.exe
1756	khfaxspkfc.exe
5564	CreateProcess.exe
2748	CreateProcess.exe
1424	i_khfaxspkfc.exe
2780	khfzxspkif.sys
3272	CreateProcess.exe
5872	czxrpnkecz.exe
2124	CreateProcess.exe
3236	CreateProcess.exe
2892	i_czxrpnkecz.exe
3692	khcausmkhc.sys
4268	CreateProcess.exe
1568	hecausmhfc.exe
5748	CreateProcess.exe
3228	CreateProcess.exe
3336	i_hecausmhfc.exe
5016	omhezwrpjh.sys
2788	CreateProcess.exe
3188	omgbzwrmke.exe
2700	CreateProcess.exe
5544	CreateProcess.exe
4860	i_omgbzwrmke.exe
4840	ojhbztrojg.sys
3356	CreateProcess.exe
3384	gebwuomjeb.exe
4512	CreateProcess.exe
4368	CreateProcess.exe
3720	i_gebwuomjeb.exe
856	mjhbztrlje.sys
4828	CreateProcess.exe
4796	bytqljdbvt.exe
5292	CreateProcess.exe
1212	CreateProcess.exe
2112	i_bytqljdbvt.exe
3140	ytqoigdywt.sys
1576	CreateProcess.exe
1708	vtqligayvt.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_1014139095\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_1014139095\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_51297093\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_2021347700\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_738789874\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_51297093\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_2021347700\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_2021347700\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5612_2021347700\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuromkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtrojgbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecausmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfaxspkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpnkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuromkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpnkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljhbytqojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfaxspkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtolgdytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbzwrmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbzwrmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecausmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtrojgbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtolgdytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1192	ipconfig.exe
424	ipconfig.exe
2888	ipconfig.exe
3964	ipconfig.exe
3712	ipconfig.exe
3656	ipconfig.exe
4860	ipconfig.exe
1204	ipconfig.exe
2016	ipconfig.exe
4384	ipconfig.exe
4192	ipconfig.exe
4748	ipconfig.exe
5952	ipconfig.exe
5068	ipconfig.exe
2520	ipconfig.exe
2132	ipconfig.exe
3384	ipconfig.exe
3288	ipconfig.exe
5088	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285569723355165"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{B8732A09-5E98-433F-8E8B-31940714913F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe
1584	trljhbytqojgebwt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	i_dbwtrojgbw.exe
Token: SeDebugPrivilege	5152	i_yvtolgdytq.exe
Token: SeDebugPrivilege	4512	i_oigaysqljd.exe
Token: SeDebugPrivilege	4856	i_yvpnifaysq.exe
Token: SeDebugPrivilege	1424	i_khfaxspkfc.exe
Token: SeDebugPrivilege	2892	i_czxrpnkecz.exe
Token: SeDebugPrivilege	3336	i_hecausmhfc.exe
Token: SeDebugPrivilege	4860	i_omgbzwrmke.exe
Token: SeDebugPrivilege	3720	i_gebwuomjeb.exe
Token: SeDebugPrivilege	2112	i_bytqljdbvt.exe
Token: SeDebugPrivilege	2308	i_vtqligayvt.exe
Token: SeDebugPrivilege	3144	i_qnigaysqki.exe
Token: SeDebugPrivilege	848	i_icavsnlfdx.exe
Token: SeDebugPrivilege	4844	i_causmkhcau.exe
Token: SeDebugPrivilege	2076	i_zxupnhfzxr.exe
Token: SeDebugPrivilege	3028	i_zuromkeczu.exe
Token: SeDebugPrivilege	5340	i_trljebwuom.exe
Token: SeDebugPrivilege	6048	i_qojgeywqoj.exe
Token: SeDebugPrivilege	2760	i_qljdbwtolg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1584	4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4184 wrote to memory of 5324	4184	2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5324 wrote to memory of 5612	5324	iexplore.exe	89
PID 5612 wrote to memory of 5804	5612	msedge.exe	90
PID 5612 wrote to memory of 1412	5612	msedge.exe	91
PID 5612 wrote to memory of 4660	5612	msedge.exe	92
PID 5612 wrote to memory of 1412	5612	msedge.exe	91
PID 5612 wrote to memory of 1412	5612	msedge.exe	91
PID 5612 wrote to memory of 2624	5612	msedge.exe	93
PID 5612 wrote to memory of 2624	5612	msedge.exe	93
PID 5612 wrote to memory of 1416	5612	msedge.exe	96
PID 5612 wrote to memory of 4456	5612	msedge.exe	95
PID 5612 wrote to memory of 1416	5612	msedge.exe	96
PID 5612 wrote to memory of 1416	5612	msedge.exe	96
PID 5612 wrote to memory of 4456	5612	msedge.exe	95
PID 5612 wrote to memory of 4456	5612	msedge.exe	95
PID 5612 wrote to memory of 3556	5612	msedge.exe	97
PID 5612 wrote to memory of 3556	5612	msedge.exe	97
PID 5612 wrote to memory of 3556	5612	msedge.exe	97
PID 5612 wrote to memory of 1248	5612	msedge.exe	98
PID 5612 wrote to memory of 1248	5612	msedge.exe	98
PID 5612 wrote to memory of 1248	5612	msedge.exe	98
PID 1584 wrote to memory of 4908	1584	trljhbytqojgebwt.exe	102
PID 5612 wrote to memory of 4140	5612	msedge.exe	104
PID 5612 wrote to memory of 5832	5612	msedge.exe	105
PID 5612 wrote to memory of 4140	5612	msedge.exe	104
PID 5612 wrote to memory of 5832	5612	msedge.exe	105
PID 6028 wrote to memory of 1312	6028	dbwtrojgbw.exe	107
PID 5612 wrote to memory of 5752	5612	msedge.exe	111
PID 1584 wrote to memory of 6020	1584	trljhbytqojgebwt.exe	114
PID 1584 wrote to memory of 4976	1584	trljhbytqojgebwt.exe	118
PID 5848 wrote to memory of 2600	5848	yvtolgdytq.exe	120
PID 1584 wrote to memory of 1532	1584	trljhbytqojgebwt.exe	123
PID 1584 wrote to memory of 5628	1584	trljhbytqojgebwt.exe	127
PID 4136 wrote to memory of 5252	4136	oigaysqljd.exe	129
PID 1584 wrote to memory of 1220	1584	trljhbytqojgebwt.exe	132
PID 5612 wrote to memory of 6064	5612	msedge.exe	134
PID 5612 wrote to memory of 6064	5612	msedge.exe	134
PID 5612 wrote to memory of 260	5612	msedge.exe	135
PID 5612 wrote to memory of 260	5612	msedge.exe	135
PID 5612 wrote to memory of 460	5612	msedge.exe	136
PID 5612 wrote to memory of 460	5612	msedge.exe	136
PID 1584 wrote to memory of 6136	1584	trljhbytqojgebwt.exe	140
PID 708 wrote to memory of 2312	708	yvpnifaysq.exe	142
PID 1584 wrote to memory of 5764	1584	trljhbytqojgebwt.exe	145
PID 5612 wrote to memory of 2328	5612	msedge.exe	147
PID 5612 wrote to memory of 3960	5612	msedge.exe	148
PID 5612 wrote to memory of 4532	5612	msedge.exe	149
PID 1584 wrote to memory of 2416	1584	trljhbytqojgebwt.exe	152
PID 1756 wrote to memory of 5564	1756	khfaxspkfc.exe	154
PID 1584 wrote to memory of 2748	1584	trljhbytqojgebwt.exe	157
PID 1584 wrote to memory of 3272	1584	trljhbytqojgebwt.exe	161
PID 5872 wrote to memory of 2124	5872	czxrpnkecz.exe	163
PID 1584 wrote to memory of 3236	1584	trljhbytqojgebwt.exe	166
PID 1584 wrote to memory of 4268	1584	trljhbytqojgebwt.exe	170
PID 1568 wrote to memory of 5748	1568	hecausmhfc.exe	172
PID 1584 wrote to memory of 3228	1584	trljhbytqojgebwt.exe	175
PID 1584 wrote to memory of 2788	1584	trljhbytqojgebwt.exe	179
PID 3188 wrote to memory of 2700	3188	omgbzwrmke.exe	181
PID 1584 wrote to memory of 5544	1584	trljhbytqojgebwt.exe	184
PID 5612 wrote to memory of 4356	5612	msedge.exe	186
PID 5612 wrote to memory of 4356	5612	msedge.exe	186
PID 1584 wrote to memory of 3356	1584	trljhbytqojgebwt.exe	192
PID 3384 wrote to memory of 4512	3384	gebwuomjeb.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_6d225b79b4d0329d56782d6ed68b81d1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Temp\trljhbytqojgebwt.exe
  C:\Temp\trljhbytqojgebwt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtrojgbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4908
  - - C:\Temp\dbwtrojgbw.exe
      C:\Temp\dbwtrojgbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtrojgbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6020
  - - C:\Temp\i_dbwtrojgbw.exe
      C:\Temp\i_dbwtrojgbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtolgdytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Temp\yvtolgdytq.exe
      C:\Temp\yvtolgdytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtolgdytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1532
  - - C:\Temp\i_yvtolgdytq.exe
      C:\Temp\i_yvtolgdytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaysqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\oigaysqljd.exe
      C:\Temp\oigaysqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaysqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Temp\i_oigaysqljd.exe
      C:\Temp\i_oigaysqljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Temp\yvpnifaysq.exe
      C:\Temp\yvpnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5764
  - - C:\Temp\i_yvpnifaysq.exe
      C:\Temp\i_yvpnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfaxspkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2416
  - - C:\Temp\khfaxspkfc.exe
      C:\Temp\khfaxspkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfaxspkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2748
  - - C:\Temp\i_khfaxspkfc.exe
      C:\Temp\i_khfaxspkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpnkecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3272
  - - C:\Temp\czxrpnkecz.exe
      C:\Temp\czxrpnkecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpnkecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3236
  - - C:\Temp\i_czxrpnkecz.exe
      C:\Temp\i_czxrpnkecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecausmhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4268
  - - C:\Temp\hecausmhfc.exe
      C:\Temp\hecausmhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecausmhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3228
  - - C:\Temp\i_hecausmhfc.exe
      C:\Temp\i_hecausmhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgbzwrmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2788
  - - C:\Temp\omgbzwrmke.exe
      C:\Temp\omgbzwrmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgbzwrmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5544
  - - C:\Temp\i_omgbzwrmke.exe
      C:\Temp\i_omgbzwrmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwuomjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3356
  - - C:\Temp\gebwuomjeb.exe
      C:\Temp\gebwuomjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwuomjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4368
  - - C:\Temp\i_gebwuomjeb.exe
      C:\Temp\i_gebwuomjeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4828
  - - C:\Temp\bytqljdbvt.exe
      C:\Temp\bytqljdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1212
  - - C:\Temp\i_bytqljdbvt.exe
      C:\Temp\i_bytqljdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqligayvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1576
  - - C:\Temp\vtqligayvt.exe
      C:\Temp\vtqligayvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqligayvt.exe ups_ins
    3⤵
    PID:4792
  - - C:\Temp\i_vtqligayvt.exe
      C:\Temp\i_vtqligayvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    PID:2504
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    PID:5300
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    PID:244
  - - C:\Temp\icavsnlfdx.exe
      C:\Temp\icavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    PID:2328
  - - C:\Temp\i_icavsnlfdx.exe
      C:\Temp\i_icavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkhcau.exe ups_run
    3⤵
    PID:4128
  - - C:\Temp\causmkhcau.exe
      C:\Temp\causmkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkhcau.exe ups_ins
    3⤵
    PID:5600
  - - C:\Temp\i_causmkhcau.exe
      C:\Temp\i_causmkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupnhfzxr.exe ups_run
    3⤵
    PID:3684
  - - C:\Temp\zxupnhfzxr.exe
      C:\Temp\zxupnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzxr.exe ups_ins
    3⤵
    PID:4992
  - - C:\Temp\i_zxupnhfzxr.exe
      C:\Temp\i_zxupnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zuromkeczu.exe ups_run
    3⤵
    PID:2232
  - - C:\Temp\zuromkeczu.exe
      C:\Temp\zuromkeczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zuromkeczu.exe ups_ins
    3⤵
    PID:4936
  - - C:\Temp\i_zuromkeczu.exe
      C:\Temp\i_zuromkeczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\trljebwuom.exe
      C:\Temp\trljebwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwuom.exe ups_ins
    3⤵
    PID:3488
  - - C:\Temp\i_trljebwuom.exe
      C:\Temp\i_trljebwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgeywqoj.exe ups_run
    3⤵
    PID:5656
  - - C:\Temp\qojgeywqoj.exe
      C:\Temp\qojgeywqoj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgeywqoj.exe ups_ins
    3⤵
    PID:1760
  - - C:\Temp\i_qojgeywqoj.exe
      C:\Temp\i_qojgeywqoj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbwtolg.exe ups_run
    3⤵
    PID:2100
  - - C:\Temp\qljdbwtolg.exe
      C:\Temp\qljdbwtolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbwtolg.exe ups_ins
    3⤵
    PID:4696
  - - C:\Temp\i_qljdbwtolg.exe
      C:\Temp\i_qljdbwtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff95dc0c188,0x7ff95dc0c194,0x7ff95dc0c1a0
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,1132797709354700342,4757087196495693509,262144 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,1203949845278624513,14653787848998751535,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,7860103164929947881,7063287966145310614,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,1687638117815515592,15195447683137526892,2097152 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,9162958887697971078,13573828534020336864,2097152 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,11314261250369161469,8682382675302160139,2097152 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,127086136457053521,4722166052386560117,2097152 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:9
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,8975671486731210606,7593381064320601157,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,7677737445099449647,9852895193823559819,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4211522731546643368,7174585256246655306,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4211522731546643368,7174585256246655306,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,16307634478204815463,13607573772757244101,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,1809742969718734893,1824575686902843322,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,974105977108686463,12458528648294871299,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4711191440332995776,834724254467493503,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9352640380212108725,11735590236453164479,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,8424579153855144268,6893118767699651329,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,7977017672693448643,17812564621258461393,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,2061877554373998998,424137617541568419,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,9965111711151153258,7413338769536670027,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,18446700616420390625,647791964944968585,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6772,i,12447117694795821561,3065616621232045157,262144 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:10
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,15364489559047682269,9278552338978761717,524288 --field-trial-handle=2296,i,8379324307991349558,7026019629204243852,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
      4⤵
      PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

C:\Temp\trljhbytqojgebwt.sys
C:\Temp\trljhbytqojgebwt.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3304

C:\Temp\rljdbvtolg.sys
C:\Temp\rljdbvtolg.sys
1⤵
- Executes dropped EXE
PID:3860

C:\Temp\vtnifdysqo.sys
C:\Temp\vtnifdysqo.sys
1⤵
- Executes dropped EXE
PID:5068

C:\Temp\fdavtnlfdx.sys
C:\Temp\fdavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:4792

C:\Temp\nkfdavpkhf.sys
C:\Temp\nkfdavpkhf.sys
1⤵
- Executes dropped EXE
PID:2700

C:\Temp\khfzxspkif.sys
C:\Temp\khfzxspkif.sys
1⤵
- Executes dropped EXE
PID:2780

C:\Temp\khcausmkhc.sys
C:\Temp\khcausmkhc.sys
1⤵
- Executes dropped EXE
PID:3692

C:\Temp\omhezwrpjh.sys
C:\Temp\omhezwrpjh.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\ojhbztrojg.sys
C:\Temp\ojhbztrojg.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\mjhbztrlje.sys
C:\Temp\mjhbztrlje.sys
1⤵
- Executes dropped EXE
PID:856

C:\Temp\ytqoigdywt.sys
C:\Temp\ytqoigdywt.sys
1⤵
- Executes dropped EXE
PID:3140

C:\Temp\yvqnlidavt.sys
C:\Temp\yvqnlidavt.sys
1⤵
PID:4540

C:\Temp\qkicaxsqki.sys
C:\Temp\qkicaxsqki.sys
1⤵
PID:4496

C:\Temp\icaxvsnkfc.sys
C:\Temp\icaxvsnkfc.sys
1⤵
PID:6044

C:\Temp\icausmkfcx.sys
C:\Temp\icausmkfcx.sys
1⤵
PID:1788

C:\Temp\wusmkhezxr.sys
C:\Temp\wusmkhezxr.sys
1⤵
PID:1180

C:\Temp\zwromgbztr.sys
C:\Temp\zwromgbztr.sys
1⤵
PID:4836

C:\Temp\ztromjdbzw.sys
C:\Temp\ztromjdbzw.sys
1⤵
PID:1744

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
PID:3056

C:\Temp\igaysqlidb.sys
C:\Temp\igaysqlidb.sys
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

czxrpnkecz.exe

Path C:\Temp\czxrpnkecz.exe
Size 376KB
SHA256 8b1bfeae17eed7732bc2d7fd1757ae7604a532558422740f2ab389d3f17dee06
MD5 7842a94a9bc64297aa14fd6ea434c746
SHA1 de519e17048621c15a706f48fed653ead39949fd
SHA512 3faba74ca7c33b954e20c1a5a2a6883f281fad46e46e7b1fce638070821dc2444cd46dc29dcaf9f82bac3b8d5a1e4568ab2d3dc5b1e2549a3ea36af7eee40b7b
SSDEEP 3072:LViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtrojgbw.exe

Path C:\Temp\dbwtrojgbw.exe
Size 376KB
SHA256 e8b4c144a5b6987a4d80b2c8e0cf7b2b061c052e6427a8ba5a3a79dc6812cf46
MD5 798715ced5557a0db857c3da570661e1
SHA1 7316d947061127fb2597069f351c1e12877384a3
SHA512 e26f2fed679d4bb51ea682f644eee49f931236e00fa7657b99e496bde668b760b61902cf120c86c2d5317c77a6df7d08a699f9023c4ae50c4f3201d062ee3bec
SSDEEP 3072:9ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BE847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdavtnlfdx.sys

Path C:\Temp\fdavtnlfdx.sys
Size 293KB
SHA256 02fd61f3bd44ca96ad65cfa285e6cb7d6ac01277682adae6411e679747dbd447
MD5 fc2c02c65967c1ad0c5f34b44be10264
SHA1 ee6e11a801cc25ad713b6c795798d5849a34b0c4
SHA512 97d6079066d076020e37b2cde6ca6d49ec7c483716f73729b9b87fc1378d9b536fcf9b6752ad63ed2309234469737931012aa6111177ede21f2c1560dd0215a7
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwtrojgbw.exe

Path C:\Temp\i_dbwtrojgbw.exe
Size 376KB
SHA256 25b85f57c4bbacc1f1e3e2cb9a610b35bb810a31d8429d199d8467318d7b3615
MD5 b298f98ead2955d17fa7f03508708acc
SHA1 ef5702a7cf6ebb51aab95b1168894cffc56a549f
SHA512 ab5670ac42509e3c7186038cef878a21ffb31bdbea00c131ac439c1262b80499d8be405c7b26cd3f1ee575dba6914336a74c0b9d7d3bc4ed3f4cfafe91837929
SSDEEP 3072:xViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T136847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khfaxspkfc.exe

Path C:\Temp\i_khfaxspkfc.exe
Size 376KB
SHA256 3fab76adf67655e6055e9506958543a1f748e7d66e41f20c67f666f608e5da2f
MD5 f861f9264af37b37e530ec5bbc6600f5
SHA1 24aa9db12f96a204cc874919b20a8e86656feab0
SHA512 a20f2cffc47e1fe1e3669dd30411bb5913c71352f12702ebe5447870177f348e5680774d9763636600d25b9643b2d317b9db226daca213f71845627e9027ec0b
SSDEEP 3072:vViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaysqljd.exe

Path C:\Temp\i_oigaysqljd.exe
Size 376KB
SHA256 5ae75ba3181b57d02eaeea509f6dd2b076aab52dfdba0089d558d27979fb6c73
MD5 4873c0058fb65f897ed786ab2bbd77da
SHA1 8083aab7b578fe91ffb1d3200fc8d9374d9ea4fb
SHA512 20808e7d4de227a3ae7dafbc12e9540599fad6ae68d1f6ec572dcbc3cdc29a9755cb82de3f3d045c2fb38b3127b6768905b0909868b10051e5514ccd2e306a1b
SSDEEP 3072:pViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvpnifaysq.exe

Path C:\Temp\i_yvpnifaysq.exe
Size 376KB
SHA256 afbdf1394e0459a08fb888bda2cec153cb47f1316d11dc44fef7ad291bd3c5e6
MD5 da7ac6207f57cf92e1022cfe72f38d27
SHA1 b8f8cdbe3af0f0177349d0a1e9fe660437d3ca87
SHA512 17ab602ce14d881223c10161fcc1d8d6947c97c9978065708e82b6e18079013718e0d35a721920fb4b202db899c12b11836b3ea3fc4e3b7c4f4d37c78cebb573
SSDEEP 3072:NViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtolgdytq.exe

Path C:\Temp\i_yvtolgdytq.exe
Size 376KB
SHA256 4c44698bc8faaf6be24cd28a95eda759b730f09d61d01ad6ea21a4de1e40bb60
MD5 fdf603a3a647a05182383dcafd80df98
SHA1 fa9b04b3ccb0cdf5593e2d8cfe25205a774094d2
SHA512 87e8b166909fc8678f0eddc228f161cb6fa6486cc103e708752f3109e7f169c83de91370235cb0e9d71bca2a8b599ed20d630d84fdd9cc821fc2493f679c1c77
SSDEEP 3072:gViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfaxspkfc.exe

Path C:\Temp\khfaxspkfc.exe
Size 376KB
SHA256 23d2be1289685eebcd9d291fe7100808283564083435225beac31b51b73af151
MD5 8db892f6d25c39ca24dde70adae8754c
SHA1 0250f8be75f6ddb8aef3235a5ce398f60a74edfc
SHA512 bdabf138d51778449ab9ab9c3ad439ddba55c9ce8942476c765ceab7d19bf0bac867e52330b78a43be29b3669e2bdebbc10114cc7195e81c016ac85639a3a3d2
SSDEEP 3072:OViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfzxspkif.sys

Path C:\Temp\khfzxspkif.sys
Size 293KB
SHA256 ab05fb54e8cd6330227aeaf2cf7b083aa517598baa90cf3519ff5f48a5ad009f
MD5 93bc5d82e343f3684616e8cc51050f27
SHA1 3a477811f973ebc1c9972fb9ceb51913be946216
SHA512 62c3c38c651e789a5813fe8d8222200a786c4110623eeb0c02f16b11b02739df376912eeb4d75e3978e0dbbb271a41f7bb75bebaf0af5215166a666bd998fb9f
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T151545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdavpkhf.sys

Path C:\Temp\nkfdavpkhf.sys
Size 293KB
SHA256 93f923bb028202e21211e36aaf55a6cc54f4d56f72adbe5db04830bc1e61f3bf
MD5 8c7ba3d1ed9a8adfe8b9c8bb9d536f5b
SHA1 2b54c08a74436a00f66951924889b4ed2c8640e2
SHA512 8151f97390d198e6dfc52a9f9fbbd1613c81c41ce9a20e36a243fd4d3d927e863cdfe39b70ba2f4ea516e605fd22760c42d013463ec2b317c02808bedb0ad188
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqljd.exe

Path C:\Temp\oigaysqljd.exe
Size 376KB
SHA256 15c898b68bca24d221a586478483f15ace7bdf224884b02c63e99fdb31f4a5a2
MD5 fa3209c97d39eed2a1867cd14538e119
SHA1 a36f9fe653f90981ebaaf68597b481ff53c26f9d
SHA512 45dac187451075198ae716f1d1502df14b7dc18bb549b4a1e6636148649662de80a61e08982f8cafd3efea00ff45e917bd752b5d8fe64a911bd70ed95ffc0a25
SSDEEP 3072:lViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T189847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtolg.sys

Path C:\Temp\rljdbvtolg.sys
Size 293KB
SHA256 b51be721f058e9a963247c96b3e7fb89d4f1087b32924f889d71ecc0407254f9
MD5 e1fd7da76676772ea866f12ebc666536
SHA1 2d27710b366ea8cbf4cdf43bd265ef1e15cf44d4
SHA512 6f435067a15b93cf4c0ab06f1c691727c17e44e07bb624601263d5c84f02812c7a1f25952d4d5a30eb8cff460cd563e6bb1de11d6e3c0852b35adb5a64f43e28
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljhbytqojgebwt.exe

Path C:\Temp\trljhbytqojgebwt.exe
Size 376KB
SHA256 1fd41e462ff583088b1de93c5f82333ff41b9a9b4cdb148483d1d2102fec6e46
MD5 386e774631954ab6857dbbde4aca451d
SHA1 e0d30bd38057b89ba07512c2ea56e0994e1b6797
SHA512 06160fc829113c43033c150833755816f70fe3e031f88f50493ec9557cf3636f778b24d2f016e579a671d9d0ac1c742f6b473bafa55cbb9844624a09bc772468
SSDEEP 3072:JViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljhbytqojgebwt.sys

Path C:\Temp\trljhbytqojgebwt.sys
Size 293KB
SHA256 bbacdea82b1c952c71f3fc7f1827e5e2cc645266b987105dddaad9f292783eed
MD5 596ddd3d3e168a2bec8cdc14734f909d
SHA1 2e41bc2048fc4abcfc0cda8bc8826753241bd544
SHA512 64a732070ea7e2452484b9d973f081f60829d0e08769a7e34947a69781dc1c615a3df7ebf1ebab9de85902d21a30d7cea19132be93a351b96c3fe07584768c7e
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnifdysqo.sys

Path C:\Temp\vtnifdysqo.sys
Size 293KB
SHA256 9a96c96d3a172ec35e9c766b900dc404e832881ccea689ef7ab8fe112abb6dee
MD5 8d6c025f29566c87d16733494978383f
SHA1 96d3c5d8fc4ac1dfea84b410e12449751f59aa1e
SHA512 8102a39e4048aeaad59112ff26e0abec4f831baceb1e85fa49dba0a820b12f96fa12f317c578cba84f747d8283d82fa4e2a545928ce10ff9dae99194ae9d8c08
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvpnifaysq.exe

Path C:\Temp\yvpnifaysq.exe
Size 376KB
SHA256 a7b564af417678cb54d30d9a9b280c080d36c35f9b83221001aab50c1f1881b5
MD5 63d5f05a3393113386a113e5ad4999ca
SHA1 53ebf308c0b1d95e0a20732894520944321cf842
SHA512 5408e7d759955634c88b36d62f384cedf0e68a654a21510e800fcd84b914a4a8376e58b8b6a7e5db75349b55124a7e1db148bfab1a89f5afc40301d7350cff0f
SSDEEP 3072:aViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtolgdytq.exe

Path C:\Temp\yvtolgdytq.exe
Size 376KB
SHA256 9f83ef8efe63888a0f75ba716d06532efe0f503a69ec020d00274e847467ca10
MD5 ec0d4da57ae534c2669d0ee0583308eb
SHA1 24c390ac6cd0edf19ce3e0ac77292cd428c61f6c
SHA512 bea2ca1c700e138c8bc079d42f74860de78c6ff4fa461fc6dc0fe0d988f186c5552ffdd7c6b463b1c31d2cd9d8aaef2e96ca4b6d9232272ec194a97a27e543c0
SSDEEP 3072:8ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BA847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 08fe858b1ae1cd2fee25abcb511e5fe75db35446ab63c1a8840204a74b3ee464
MD5 861491d54ca12d8087f1a714d418936a
SHA1 9596826eadc6f510de06f075c954cec027decd44
SHA512 94e602cbefc0186fa4c5e7d4b58187f0ba62d88e1d2d4fdd1125fd6e877278d61161f4999fadd5c94ea85338ee060af6f00340994adbf5ace275c8112d49fa52
TLSH
T11A5129500B2FF9C9EBBFD8B174E0C0E83A7DCAA9E147AE4351B891345A0E30C1BC0129
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 348cc247ef9735956f484a034a167dd1f62b4d79d6c28ab53180ca72dbef69f3
MD5 e3d53342c660193eb4e63f7bc53281e1
SHA1 193250f97f40c86d20e8225cb347b70a6532dced
SHA512 983b46a9bf721b14ac6663f716118d24f2b210d1a6632991d50365f0c139b138d8aea3d69b253a5174c9dc28543446882c70d317bf70776f69808a77177138dd
TLSH
T18D41ADF383E48A6EC91155F0AB187E2BCE1D0955432C3D5AC9E4AE1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 58e5dec2d15f1a08bcf7ec3b54c23c6aa10d077b02a56f14b8912cce500e94cb
MD5 9e1adc5202d597b5ad0d807a9c1daef8
SHA1 f9b4b359afa7d86f7d1b24504291a4934ba18e65
SHA512 d5c9ce208a25db51e2557194cbcd43cb9804b56143d76367de76efe433573f648d046d72cc6f1e1411392fb9225cc783440d9874c3674014002415f7324f68bd
SSDEEP 192:sxRYRgCc/flsM/JNzoA8pi/g6+WNIYZ7BKsfG7xIgtJ:sxRYdc/flsMBAi/5I+o3
TLSH
T1DD32A5166D28993B9CCBD20DFB657F53E6F95032A1D41E48AAFC8B1C05EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 69f903655ebd618084ff85a4f635ba569d8d72f4435dbb444c92570085ee14a1
MD5 3c412a3d9c703959d72fdd05f9909168
SHA1 8f105357be0272cde05074b85e261d7b8f84a747
SHA512 3e12209459a8a22706d45e8ec46d4e8c8d00673b5b25fa2479f881022f3671d3bb6037be7503f42d577f0decccc18c500bcd7a8538eef0f4752bb37e88e1f465
SSDEEP 192:sxRvRoyM/jK1Ml8wCc/flsY+UrZ8ZbLONzoA8p92/g6+WNCLHg/YZ70msfG7xIgV:sxRv+8c/flsBUF8ZmAk/5V/JoV
TLSH
T15C62DA15AA24997BDCDBD209FA557F93E6F81472D2901E44AAFCCB0C01E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f9a154e213ea88b7831f41beb9f934569f2fac0d3c2cfa5c80001585ad5511c3
MD5 26996912023403751a146317d7d73485
SHA1 ee80b3d1679bdd05396cec6bf1a82aeedb147fb8
SHA512 e36925ce6280b868854dc112d1347feb2e4b59b62b9bb9de4e93bc0748a4d7faed54c67321c630bf87387355a2569e4b954d6064530129057f76eec76cec3410
SSDEEP 192:sxRzRgCc/flsYp/xNzoA8p92/g6+WNCLHg/YZ70KsfG7xIgDFJ:sxRzdc/flsO5Ak/5V/Fo7
TLSH
T1B132A6166D28993B9CCBD20DBB65BF53E6F85032A1D51E48ABFC8B0C05E76CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bbd061433fbe57ff7bce8d65ebf9fa1b681f425a02f21e66fd8dfb4d2414c293
MD5 c7a418dacc9afa5e4eea65560b8908e1
SHA1 ec34b01ab58342c94c473301b9ff1b782d143915
SHA512 db88e5832f58bdc5dc98f1e5266f6e04fad213139f5e4a495084a7e6638bca581188aa071d59cb1a5acaf751988c02b0a7873544478c5b0f1d5c04d0b8191ea6
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkgtSV2lroHh0wV:kfISGqE7CvWgd5fWbu1ja7gtU2eHh0wV
TLSH
T1D8E2DC3B680CCB7F4F804ADCEC297E9AADA801CF96D8C95447FA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d16a85dc1ae317f3b3c53a6671e8c1ae20827059d8e1ddd74fd1b00c4f290748
MD5 58bb8284f1eebc9f6022d29371fcaa74
SHA1 e03c67bcdb3adbc286846be8abdc91fce9ee5b85
SHA512 a47a8ebf777862b1aa8d703bdff6da941c622dc48ea2ac83ffa94eb129a384144d69c807ce5bffe344bfa4d4d35ff5b5fb4555374b4f0f45e16981185e2c729d
SSDEEP 768:ky2SgS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVASV4lrol+z:ky2SgqE7evWgd5f/bu1jaBU4eYz
TLSH
T1E7C2CA7B640CCB7F4F804ADDA8197F9A6DA802CB96D8CD8047FA951C03C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b9d4f892cb4174d7181e111135d758ecbdb55b53307f775c464f7ea7565a5bcf
MD5 8ad719b893d8a7fd16a668a1c1e85f4a
SHA1 802885e6209e12ed6d197cc820e2c5468cf505de
SHA512 d8475e45c2cbc3ad1bd1a82c99d13b2ada386a3c23a35853e89a5562b5b5b65410d0cef461492874c75ed24a979b2722f57d69b75b5194a42e954b5bda8f1902
SSDEEP 48:K8SI/Kzq43ypCI/KPK87NIRKGkUT5y1l+hFH/J:K8SUKzqKqCQKPKANSKGkG5Cl+hFH/J
TLSH
T12E911352717A169039BF2809D4A5C617CAC1B4F37268A82B3BE940724F7EF414EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75794aca-2d39-4986-adc4-8438408baf89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75794aca-2d39-4986-adc4-8438408baf89.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 51e2f49a6e18bd20c3daf823d1bbce059a22b8c1c042787f7c8bed86c7627f71
MD5 a002a2ecc2b2a27c73692c01572099a7
SHA1 9a8bd6edd0e69f60b7b7139ff6e6d1fac0442dd5
SHA512 dfc433fd2350d31dc39c38d3b522d3a963a29b2d5fdae2f222f1822e2dd2ac4c82793c7900df0176d132eb0a83bcbf0e7ba762d1c9c3a92898bcdd6f016f9d5f
SSDEEP 768:mj+9X3b8q9LRLiNAam6aQMGdjWca4Ghf969B:19X3A3maME6p6j
TLSH
T174D28E315869DC279CE69695F72B37C7BEF011B388C81E88D9D96F0D029728E270791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fdacf42bcb16517107788a5ae56c85e09b4ce5009695e2e8962f4a43f80726df
MD5 96613e16077c7a8d74db52dd04873616
SHA1 5022c8c17e854eb6c80e4a45d33665b6bb918a2e
SHA512 4df5691d87861014a466d8dfea30be79b60655c22ea5cfbbd2d21227a0e783a6e61f39f368586e93798736d6afc1643c4e70df27260e76846ea9e8618dd9875a
SSDEEP 768:/rv+4UNbdq3MXq9LtAAam6aQMGdjWca4GhfBZPeU/:/bsbc35KmaME6pBH
TLSH
T168F2AE31A86C9573DDB79A99F21B6787BEF421A384D40A84D9D92B0D43970CE3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 0fff9c97cb2c9956f0758801657c3c0a8a341b03995323acd80adcce6c586aa4
MD5 0eddfba59010626ba46b376981694d61
SHA1 3758a5b019a92d5c4ccacef83c5fdc4b15b9c6f3
SHA512 c46dde1ec977bdc196d8dcec5ea5c717fe55a8261aed31a86b534e1229e43427b282357085fd23f70e3180c093f29b1b89eb4e9395ae313862944a998bc6c8da
SSDEEP 768:Orv+4UNbdR3x8q9LRLiNAam6aQMGdjWca4Ghf96PxUQ:Obsbz3G3maME6p6x
TLSH
T1F6F2AE31686CD9739CF7A294F31B7687BEB421A388C84E84D9D95B0D02971CE270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b18e30de6c68eea5155c3b19edd5dc491eb842aa9bd8cf88e9c995f149329037
MD5 fdf3884fca6ad7578fab9b92e8b4bbea
SHA1 c8c219b482143e328ac57da8c98269dfb1155bb6
SHA512 58642f4d04ad6df399dcb69081fd010dcb13858f72e73e2468c78d1f1a9ffea2f86086ff05dc26afa680912284d5da43b0ea8493580e18081443aa0a372cddb1
SSDEEP 768:ZF1j+9C3RwgGwPLRL6Aam6aQMGdjWca4Ghf969B:o9C3AmaME6p6j
TLSH
T1E903F6F188D7C937D8AE4787A33D2E86A9BCD163B4885984FBC45D0CCD821BFD606816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 cbeb4bc6a8fe06ebf618aa456b9e2dad9f9585e60d490ae5cd623375bc8df9b8
MD5 a584ab75e3aa52c1eb68dc1ea3c5299e
SHA1 9c6115da2b56414ad191808812c3282ed54f5a25
SHA512 aeb59ec323e2f3f0a66fa935208783d234e4806e5f421b96410aa29593de06182c4c828a676b76865f51d2d5595f9c733f6f33d4500eeec4a855c82c07fc2d9f
TLSH
T13F516C0730A4199F29841C2029C609D7E97201FBEB85B3DAD4FA3C4EC2A0B918C4B235
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5612_28448084\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 636b7163cecf513428ec9f79d4fe8b242f7b8ee31de3bc6e6e66abeaabb199b7
MD5 65ff2a3e0285e6db996a5008a939f814
SHA1 0b61459d2f57b0a3cdfc6e327612c0aa64d9e4db
SHA512 7803df3eb9e98def9464c97ef7f861337009626770e9a2b7098c6019dfcb6a01e57039445838d3f8c48331ff5d628bf5381e2ead0833b85bff9f4d64733eaac8
TLSH
T18C71E38357B9C5B3C6DA9BF502835644F5FB227C4B6370200B955586AB30A7A64B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1180-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1744-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1788-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2700-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2780-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3056-511-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3140-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3388-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3860-148-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3888-515-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4496-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4792-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4836-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4836-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5016-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6044-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download