systex | 31f87daa7fed62c02e6999b22b6252cff6779103941e4cacfe56a829bb66cd61

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260718-dchafshv5t
SHA256 31f87daa7fed62c02e6999b22b6252cff6779103941e4cacfe56a829bb66cd61
MD5 96572a3a1b1e656a00d937399dbece2e
SHA1 652a786ef75a5fe050e69e9135c57377b716f490
SHA512 5bee0e38fa9a274b6ee8dc0da05a7c9a40d89f750b981cbd22dcfa951d1f62466baa26f2a573787f17b065ba0d9b2302aea35719a0720e6c873228d7cb947474
SSDEEP 3072:DFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3380	bzurmkebztrmjhez.exe
2340	bzurmkebztrmjhez.sys
1324	CreateProcess.exe
4216	jhezwrpjeb.exe
6104	CreateProcess.exe
4756	CreateProcess.exe
5040	i_jhezwrpjeb.exe
4224	trljhezwuo.sys
3904	CreateProcess.exe
3336	ljdbwtomgb.exe
4140	CreateProcess.exe
3516	CreateProcess.exe
5824	i_ljdbwtomgb.exe
4292	geywqomgdb.sys
5840	CreateProcess.exe
1104	dbywqomgey.exe
3440	CreateProcess.exe
1776	CreateProcess.exe
4380	i_dbywqomgey.exe
4608	aytqlidbvt.sys
3268	CreateProcess.exe
4264	vtnlfdywqo.exe
4572	CreateProcess.exe
620	CreateProcess.exe
2756	i_vtnlfdywqo.exe
5404	idayvqnlfd.sys
800	CreateProcess.exe
2824	igdyvqniga.exe
3280	CreateProcess.exe
2600	CreateProcess.exe
5340	i_igdyvqniga.exe
4700	nifdxvsnlf.sys
3012	CreateProcess.exe
4380	ifausnhfdx.exe
4740	CreateProcess.exe
5584	CreateProcess.exe
3092	i_ifausnhfdx.exe
2804	nkfcxvpnhf.sys
4836	CreateProcess.exe
4592	pkicaxspnk.exe
696	CreateProcess.exe
1348	CreateProcess.exe
6120	i_pkicaxspnk.exe
5816	spkhfzxusm.sys
5780	CreateProcess.exe
3156	usmkhczxup.exe
3496	CreateProcess.exe
2412	CreateProcess.exe
5228	i_usmkhczxup.exe
3096	bzurmjecwu.sys
2872	CreateProcess.exe
4200	wurmkecwur.exe
2816	CreateProcess.exe
1560	CreateProcess.exe
4812	i_wurmkecwur.exe
1736	ezwromhezw.sys
4356	CreateProcess.exe
1376	trojgebwtr.exe
3696	CreateProcess.exe
5404	CreateProcess.exe
2828	i_trojgebwtr.exe
5216	bywqomjebw.sys
1580	CreateProcess.exe
4204	bwtrljebwt.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_1303853756\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_1723707723\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_1723707723\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_875564378\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_875564378\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifausnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwrpjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifausnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicaxspnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecwuojhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicaxspnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmkecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxrpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbywqomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbywqomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecwuojhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwrpjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmkebztrmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmkecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxrpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebzwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebzwqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6040	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4852	ipconfig.exe
1496	ipconfig.exe
1592	ipconfig.exe
5040	ipconfig.exe
4068	ipconfig.exe
4404	ipconfig.exe
3108	ipconfig.exe
4292	ipconfig.exe
2240	ipconfig.exe
4700	ipconfig.exe
2196	ipconfig.exe
428	ipconfig.exe
5196	ipconfig.exe
4604	ipconfig.exe
1192	ipconfig.exe
5540	ipconfig.exe
3684	ipconfig.exe
4228	ipconfig.exe
5340	ipconfig.exe
2128	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288167098804807"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{579D51A3-C2D3-450D-8A42-AC8C1859F7F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe
3380	bzurmkebztrmjhez.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	i_jhezwrpjeb.exe
Token: SeDebugPrivilege	5824	i_ljdbwtomgb.exe
Token: SeDebugPrivilege	4380	i_dbywqomgey.exe
Token: SeDebugPrivilege	2756	i_vtnlfdywqo.exe
Token: SeDebugPrivilege	5340	i_igdyvqniga.exe
Token: SeDebugPrivilege	3092	i_ifausnhfdx.exe
Token: SeDebugPrivilege	6120	i_pkicaxspnk.exe
Token: SeDebugPrivilege	5228	i_usmkhczxup.exe
Token: SeDebugPrivilege	4812	i_wurmkecwur.exe
Token: SeDebugPrivilege	2828	i_trojgebwtr.exe
Token: SeDebugPrivilege	260	i_bwtrljebwt.exe
Token: SeDebugPrivilege	4392	i_gaytqlidbv.exe
Token: SeDebugPrivilege	3844	i_nigaysqkid.exe
Token: SeDebugPrivilege	5240	i_fdavsqkica.exe
Token: SeDebugPrivilege	428	i_vpnhfaxspn.exe
Token: SeDebugPrivilege	5340	i_vpnhfzxrpn.exe
Token: SeDebugPrivilege	2316	i_mhecwuojhe.exe
Token: SeDebugPrivilege	716	i_mjebwuomge.exe
Token: SeDebugPrivilege	2688	i_romgebzwqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 3380	4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4612 wrote to memory of 1068	4612	2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1068 wrote to memory of 3712	1068	iexplore.exe	91
PID 3712 wrote to memory of 1948	3712	msedge.exe	92
PID 3712 wrote to memory of 6040	3712	msedge.exe	93
PID 3712 wrote to memory of 5264	3712	msedge.exe	94
PID 3712 wrote to memory of 5264	3712	msedge.exe	94
PID 3712 wrote to memory of 2040	3712	msedge.exe	95
PID 3712 wrote to memory of 2040	3712	msedge.exe	95
PID 3712 wrote to memory of 2040	3712	msedge.exe	95
PID 3712 wrote to memory of 3912	3712	msedge.exe	97
PID 3712 wrote to memory of 3912	3712	msedge.exe	97
PID 3712 wrote to memory of 3912	3712	msedge.exe	97
PID 3712 wrote to memory of 4844	3712	msedge.exe	98
PID 3712 wrote to memory of 4844	3712	msedge.exe	98
PID 3712 wrote to memory of 4844	3712	msedge.exe	98
PID 3712 wrote to memory of 2076	3712	msedge.exe	99
PID 3712 wrote to memory of 2368	3712	msedge.exe	100
PID 3712 wrote to memory of 2076	3712	msedge.exe	99
PID 3712 wrote to memory of 2076	3712	msedge.exe	99
PID 3712 wrote to memory of 2368	3712	msedge.exe	100
PID 3712 wrote to memory of 2368	3712	msedge.exe	100
PID 3712 wrote to memory of 5252	3712	msedge.exe	102
PID 3712 wrote to memory of 5252	3712	msedge.exe	102
PID 3712 wrote to memory of 5960	3712	msedge.exe	105
PID 3712 wrote to memory of 3692	3712	msedge.exe	106
PID 3712 wrote to memory of 5960	3712	msedge.exe	105
PID 3712 wrote to memory of 3692	3712	msedge.exe	106
PID 3712 wrote to memory of 2724	3712	msedge.exe	108
PID 3380 wrote to memory of 1324	3380	bzurmkebztrmjhez.exe	109
PID 3712 wrote to memory of 4628	3712	msedge.exe	111
PID 3712 wrote to memory of 4628	3712	msedge.exe	111
PID 4216 wrote to memory of 6104	4216	jhezwrpjeb.exe	113
PID 3712 wrote to memory of 5308	3712	msedge.exe	118
PID 3712 wrote to memory of 5308	3712	msedge.exe	118
PID 3380 wrote to memory of 4756	3380	bzurmkebztrmjhez.exe	119
PID 3380 wrote to memory of 3904	3380	bzurmkebztrmjhez.exe	123
PID 3336 wrote to memory of 4140	3336	ljdbwtomgb.exe	125
PID 3380 wrote to memory of 3516	3380	bzurmkebztrmjhez.exe	128
PID 3380 wrote to memory of 5840	3380	bzurmkebztrmjhez.exe	132
PID 1104 wrote to memory of 3440	1104	dbywqomgey.exe	134
PID 3380 wrote to memory of 1776	3380	bzurmkebztrmjhez.exe	137
PID 3380 wrote to memory of 3268	3380	bzurmkebztrmjhez.exe	142
PID 4264 wrote to memory of 4572	4264	vtnlfdywqo.exe	144
PID 3380 wrote to memory of 620	3380	bzurmkebztrmjhez.exe	147
PID 3712 wrote to memory of 2348	3712	msedge.exe	149
PID 3712 wrote to memory of 1652	3712	msedge.exe	150
PID 3712 wrote to memory of 6056	3712	msedge.exe	151
PID 3380 wrote to memory of 800	3380	bzurmkebztrmjhez.exe	154
PID 2824 wrote to memory of 3280	2824	igdyvqniga.exe	156
PID 3380 wrote to memory of 2600	3380	bzurmkebztrmjhez.exe	159
PID 3380 wrote to memory of 3012	3380	bzurmkebztrmjhez.exe	163
PID 4380 wrote to memory of 4740	4380	ifausnhfdx.exe	165
PID 3380 wrote to memory of 5584	3380	bzurmkebztrmjhez.exe	168
PID 3380 wrote to memory of 4836	3380	bzurmkebztrmjhez.exe	172
PID 4592 wrote to memory of 696	4592	pkicaxspnk.exe	174
PID 3380 wrote to memory of 1348	3380	bzurmkebztrmjhez.exe	177
PID 3380 wrote to memory of 5780	3380	bzurmkebztrmjhez.exe	181
PID 3156 wrote to memory of 3496	3156	usmkhczxup.exe	183
PID 3380 wrote to memory of 2412	3380	bzurmkebztrmjhez.exe	186
PID 3712 wrote to memory of 4276	3712	msedge.exe	188
PID 3712 wrote to memory of 4276	3712	msedge.exe	188
PID 3380 wrote to memory of 2872	3380	bzurmkebztrmjhez.exe	192
PID 4200 wrote to memory of 2816	4200	wurmkecwur.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_96572a3a1b1e656a00d937399dbece2e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Temp\bzurmkebztrmjhez.exe
  C:\Temp\bzurmkebztrmjhez.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwrpjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1324
  - - C:\Temp\jhezwrpjeb.exe
      C:\Temp\jhezwrpjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwrpjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4756
  - - C:\Temp\i_jhezwrpjeb.exe
      C:\Temp\i_jhezwrpjeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtomgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3904
  - - C:\Temp\ljdbwtomgb.exe
      C:\Temp\ljdbwtomgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3516
  - - C:\Temp\i_ljdbwtomgb.exe
      C:\Temp\i_ljdbwtomgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbywqomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5840
  - - C:\Temp\dbywqomgey.exe
      C:\Temp\dbywqomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbywqomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1776
  - - C:\Temp\i_dbywqomgey.exe
      C:\Temp\i_dbywqomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Temp\vtnlfdywqo.exe
      C:\Temp\vtnlfdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:620
  - - C:\Temp\i_vtnlfdywqo.exe
      C:\Temp\i_vtnlfdywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:800
  - - C:\Temp\igdyvqniga.exe
      C:\Temp\igdyvqniga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2600
  - - C:\Temp\i_igdyvqniga.exe
      C:\Temp\i_igdyvqniga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifausnhfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3012
  - - C:\Temp\ifausnhfdx.exe
      C:\Temp\ifausnhfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifausnhfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\i_ifausnhfdx.exe
      C:\Temp\i_ifausnhfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkicaxspnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\pkicaxspnk.exe
      C:\Temp\pkicaxspnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkicaxspnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1348
  - - C:\Temp\i_pkicaxspnk.exe
      C:\Temp\i_pkicaxspnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhczxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5780
  - - C:\Temp\usmkhczxup.exe
      C:\Temp\usmkhczxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhczxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2412
  - - C:\Temp\i_usmkhczxup.exe
      C:\Temp\i_usmkhczxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmkecwur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2872
  - - C:\Temp\wurmkecwur.exe
      C:\Temp\wurmkecwur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmkecwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1560
  - - C:\Temp\i_wurmkecwur.exe
      C:\Temp\i_wurmkecwur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trojgebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\trojgebwtr.exe
      C:\Temp\trojgebwtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trojgebwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\i_trojgebwtr.exe
      C:\Temp\i_trojgebwtr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1580
  - - C:\Temp\bwtrljebwt.exe
      C:\Temp\bwtrljebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrljebwt.exe ups_ins
    3⤵
    PID:4424
  - - C:\Temp\i_bwtrljebwt.exe
      C:\Temp\i_bwtrljebwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqlidbv.exe ups_run
    3⤵
    PID:2680
  - - C:\Temp\gaytqlidbv.exe
      C:\Temp\gaytqlidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqlidbv.exe ups_ins
    3⤵
    PID:1784
  - - C:\Temp\i_gaytqlidbv.exe
      C:\Temp\i_gaytqlidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run
    3⤵
    PID:5020
  - - C:\Temp\nigaysqkid.exe
      C:\Temp\nigaysqkid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    PID:4852
  - - C:\Temp\i_nigaysqkid.exe
      C:\Temp\i_nigaysqkid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsqkica.exe ups_run
    3⤵
    PID:2188
  - - C:\Temp\fdavsqkica.exe
      C:\Temp\fdavsqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsqkica.exe ups_ins
    3⤵
    PID:1244
  - - C:\Temp\i_fdavsqkica.exe
      C:\Temp\i_fdavsqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxspn.exe ups_run
    3⤵
    PID:6060
  - - C:\Temp\vpnhfaxspn.exe
      C:\Temp\vpnhfaxspn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxspn.exe ups_ins
    3⤵
    PID:5876
  - - C:\Temp\i_vpnhfaxspn.exe
      C:\Temp\i_vpnhfaxspn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxrpn.exe ups_run
    3⤵
    PID:4900
  - - C:\Temp\vpnhfzxrpn.exe
      C:\Temp\vpnhfzxrpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxrpn.exe ups_ins
    3⤵
    PID:4480
  - - C:\Temp\i_vpnhfzxrpn.exe
      C:\Temp\i_vpnhfzxrpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecwuojhe.exe ups_run
    3⤵
    PID:1172
  - - C:\Temp\mhecwuojhe.exe
      C:\Temp\mhecwuojhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecwuojhe.exe ups_ins
    3⤵
    PID:1056
  - - C:\Temp\i_mhecwuojhe.exe
      C:\Temp\i_mhecwuojhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwuomge.exe ups_run
    3⤵
    PID:2328
  - - C:\Temp\mjebwuomge.exe
      C:\Temp\mjebwuomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    PID:468
  - - C:\Temp\i_mjebwuomge.exe
      C:\Temp\i_mjebwuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebzwqo.exe ups_run
    3⤵
    PID:2132
  - - C:\Temp\romgebzwqo.exe
      C:\Temp\romgebzwqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebzwqo.exe ups_ins
    3⤵
    PID:4336
  - - C:\Temp\i_romgebzwqo.exe
      C:\Temp\i_romgebzwqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgdywqoi.exe ups_run
    3⤵
    PID:1444
  - - C:\Temp\tolgdywqoi.exe
      C:\Temp\tolgdywqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffab109c188,0x7ffab109c194,0x7ffab109c1a0
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3841905310102474771,2571385996530341151,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
      4⤵
      System Time Discovery
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,17568825096493391909,12269577622661732810,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,14652860515302907011,1533998678882889699,262144 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,1787913616467003037,1950552355293655428,2097152 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,3399869425982933390,10585150849926520964,2097152 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,15273939880548865813,9464957148210706076,2097152 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,11240785949313238149,7695491679672504992,2097152 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,14577446707304892344,8166814784681309566,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,17963625514977125902,16889100297001559917,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,5067576459059035482,4394239493885008691,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,10726081160599475112,1983842245194761285,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,10726081160599475112,1983842245194761285,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16254356379848845068,15363280519619671267,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,13168375715330031403,1817102056434433608,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,5255741756558261213,5301803046117027569,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,4718651184114148197,5857199507551209159,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,15717004800316005649,13705317873574122521,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,7552938252640627251,5512305665621520109,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,12516110007298317209,10855399169888311983,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,7340115791444621925,1674123964657803021,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,7369247958863766852,6914800097967814370,262144 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,11947079083979774109,3200111628304392469,524288 --field-trial-handle=2568,i,9785878997484238827,2568396990092033243,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4188

C:\Temp\bzurmkebztrmjhez.sys
C:\Temp\bzurmkebztrmjhez.sys
1⤵
- Executes dropped EXE
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

C:\Temp\trljhezwuo.sys
C:\Temp\trljhezwuo.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\geywqomgdb.sys
C:\Temp\geywqomgdb.sys
1⤵
- Executes dropped EXE
PID:4292

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\idayvqnlfd.sys
C:\Temp\idayvqnlfd.sys
1⤵
- Executes dropped EXE
PID:5404

C:\Temp\nifdxvsnlf.sys
C:\Temp\nifdxvsnlf.sys
1⤵
- Executes dropped EXE
PID:4700

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\spkhfzxusm.sys
C:\Temp\spkhfzxusm.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\bzurmjecwu.sys
C:\Temp\bzurmjecwu.sys
1⤵
- Executes dropped EXE
PID:3096

C:\Temp\ezwromhezw.sys
C:\Temp\ezwromhezw.sys
1⤵
- Executes dropped EXE
PID:1736

C:\Temp\bywqomjebw.sys
C:\Temp\bywqomjebw.sys
1⤵
- Executes dropped EXE
PID:5216

C:\Temp\igdyvtrljd.sys
C:\Temp\igdyvtrljd.sys
1⤵
PID:6076

C:\Temp\qnifdbvqni.sys
C:\Temp\qnifdbvqni.sys
1⤵
PID:1248

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
PID:2112

C:\Temp\spnicayspk.sys
C:\Temp\spnicayspk.sys
1⤵
PID:5076

C:\Temp\xvpnhfzxrp.sys
C:\Temp\xvpnhfzxrp.sys
1⤵
PID:5852

C:\Temp\pmhecwusmj.sys
C:\Temp\pmhecwusmj.sys
1⤵
PID:4936

C:\Temp\xrpmhezxrp.sys
C:\Temp\xrpmhezxrp.sys
1⤵
PID:4180

C:\Temp\omgebztrpj.sys
C:\Temp\omgebztrpj.sys
1⤵
PID:4392

C:\Temp\bvtrljdbvt.sys
C:\Temp\bvtrljdbvt.sys
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqlidbvt.sys

Path C:\Temp\aytqlidbvt.sys
Size 293KB
SHA256 7ff4c326dd186b3273585f8aa47fe8ecd0534b6fe857e8e7a3328e6e7e960492
MD5 3c5800d465b5b86ce10905d645dea4a4
SHA1 877d253ee11631a4fd0db8f20b1d4ffc63ac2ac9
SHA512 2e88c8f5c8e5c3fe697001e9ad53df8a4c8d61be03c5f4df5eb034134a1166b43cb9b99020c9402e5e2dbffca031d4df396c0cc93801b9a5c72067c33a6e5145
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurmkebztrmjhez.exe

Path C:\Temp\bzurmkebztrmjhez.exe
Size 376KB
SHA256 9856e9462d50e38348c537cbbad1e94a92d732b3bd9fb7465949acc83e9ca03e
MD5 e8067beef05e5ce855073ebce4c9533d
SHA1 e18b35306e1a374bd116cd0ae85061c0cbad1d60
SHA512 473c8c98afa18702a46d90a8779cd59515c8d99eabfe632011775d52d0d49d6742d8210ab94fb67422a5f947aaa82b38e1d559aa7e1bfc72bd79bc1f7c336657
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurmkebztrmjhez.sys

Path C:\Temp\bzurmkebztrmjhez.sys
Size 293KB
SHA256 8fecbc80e5fbd65e8269531c25e4585ef9402324b3434b18cc3f93a7fe880cf2
MD5 d72ff69597017a3d0ec51b88e0e62230
SHA1 c09990143e8617a9566309d2954bb5348665cb2c
SHA512 28ba18ce831aadfe88b26c990791376b6f45403f1cd44f5a80edba4c191b9cf5dbafba748af3f9a01526fe67f8bba669458865e5b376e8e6f82a97933e9b2c6b
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbywqomgey.exe

Path C:\Temp\dbywqomgey.exe
Size 376KB
SHA256 0f3ebf95fbcad79678ec3819d3b540452a2afa9944579bf99eb6f22ec0a0ab97
MD5 003d8f092821026ed733ed387a86f1c1
SHA1 488e79ea82d2f8a580a7fa9a6e005a00b09407e3
SHA512 4c81c219f7f14cd4b7f9aa6bf82a39f3fcc7d3c5fe3dc16e6083174a7f70746eca8a5b175a91b974d2458ea7042b64259be284877a5694d6a9cb916bff8013cf
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E5847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqomgdb.sys

Path C:\Temp\geywqomgdb.sys
Size 293KB
SHA256 b52bdefd3afb4bac43a28ded19fcf7a84c50815b61dedb661770610c5ae8a1f5
MD5 573741e71d76c07c7e54f2b579429d1c
SHA1 c32cc78ef844208148d41f86f937a76c0e2699d8
SHA512 441ccc85de588cdc04d17af5a6a9601dfd01ea74e4bebd6a6328bd4bff9ed5855224b21d62e4ba8cca5092b701aba2e8dbef04e81b900a3aa4e151d606d5d61f
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbywqomgey.exe

Path C:\Temp\i_dbywqomgey.exe
Size 376KB
SHA256 8dc67e09f81d4dab38ba14f10703d3068437da7e62947aeb31963d9325dd7a74
MD5 f871141b69a85caf581a9632be4c8e36
SHA1 672ab00c7c5e7480d6d9a1be24403747c8cf0be0
SHA512 8594da43d191427062ff8091e75ab99ce526af77c8983dff50bc203bbbf6fa123678c714140466753fbe1376d176318af853b464d678b8d2735afbc2e19017ab
SSDEEP 3072:8FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D5847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdyvqniga.exe

Path C:\Temp\i_igdyvqniga.exe
Size 376KB
SHA256 4aa2a951c0ee567c1111e5ede72a123ec1ee5f001bda49c77b99b4815e6b9ca0
MD5 8850d2efbb241f6d6786110bba3991e7
SHA1 0b43f21b9cfd3a6b86be647d062e645c7f432f57
SHA512 683c3a2a152560d9bfe3b5cf2defd5e0198e19d1758fe22d1bb8266169d0d0d46a3a353fbbef977fe2c1c47a44cc4c3fa4e3bb16e9b2538082ffbb5dbfd0139f
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhezwrpjeb.exe

Path C:\Temp\i_jhezwrpjeb.exe
Size 376KB
SHA256 544a30c3ab1add8b5ca44592addc91964c5acaceaaf03ddb5903b91a36dbc8b7
MD5 8286b3527f92da3b43572f0e40130f4c
SHA1 ac789fedafa63a368ed0619d6c64f9ff9c022479
SHA512 8ab26a4381c2096a5342d5463d1dc919882fd6947573012ae5334c292a4fa762f9622955d958c1fb723dd027046064335fee8aeb6bd56e226ab760c85a987973
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbwtomgb.exe

Path C:\Temp\i_ljdbwtomgb.exe
Size 376KB
SHA256 8ec15bf1f5b81442eb7def9b74cbf08111ee2f35cc01af2122c82730b75d063b
MD5 d4b9dc1c2be9ca64dbf7bc275bc6798e
SHA1 9f873f98bf813721c4ff59577821feffb9b0ba1f
SHA512 f336dc7d398205ae3256056b0ba535189988a5a25f7dde20de1910cc9c92e8cd3524f147eb7f61cce964a6478b9c330df5131923d3f6cb657620ac6f245a53b4
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T146847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdywqo.exe

Path C:\Temp\i_vtnlfdywqo.exe
Size 376KB
SHA256 d619b74140a9d8ffc64866639335e304dcb170ac670b865f76925f404ba4f872
MD5 2a0765fdbb2632ef26c540c537ed5c18
SHA1 19e82b6722c744df2d9c0575d6ddab8c4f0aecb8
SHA512 69ab38581b98d601f7b3f314c9c05577038748eb45d0accdc23e17be2881956a302a28aa36c131228f3d50f06b754ebc39394849740c13c140cff3dea80725e2
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idayvqnlfd.sys

Path C:\Temp\idayvqnlfd.sys
Size 293KB
SHA256 0737bb707f81602856dd265f4a84633f0211128b6d77820a351ba9e84cce272f
MD5 75929aac1ff81a9ed45d42551d8131f1
SHA1 6f93bf3e5371cc4f6e94f672c74455ea80f57302
SHA512 a5118230c5f00ba0b175340f7b753525542c960497e9b939bc61bf7e3549d2cc29df8e95b35d9a8bc77236046f4558d3bb9dc949be7308489ad90ed2d4b773ef
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T133545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifausnhfdx.exe

Path C:\Temp\ifausnhfdx.exe
Size 376KB
SHA256 741a6141653017d247a4b0f458b88b9a67be2387d35a56077460ea91d0a4d860
MD5 621d28ffad656939389e866544f67da4
SHA1 e0f0e4c0f8a34171302d7c741fb4e5e69512a4b5
SHA512 98c7e089b5d9b1d57f4d9d517ff9e85e292b03a2e799019515bb9445f01315283f77e905030c6730a036896db6fea6a28eb171834272b8f1eec38edeb4c7d1f6
SSDEEP 3072:9FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvqniga.exe

Path C:\Temp\igdyvqniga.exe
Size 376KB
SHA256 d73a034865a09e3588fe86f73a1b436da8570e0106ca3e1464c556a302b6068c
MD5 97f57a27ff5cc253e09266f0adcdaef0
SHA1 ae4c0e3403ce528c27e2920b67ab7a9d6aa4c456
SHA512 e0c14f4a8c9a1b42878d8a7aa3ce8034810f5cda07f23814ad3f4851a02029695dfa783c003ec07e7007ffc875e8f0c4c5f69f69934f8f447b3995d13b638809
SSDEEP 3072:GFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwrpjeb.exe

Path C:\Temp\jhezwrpjeb.exe
Size 376KB
SHA256 83c2bab0758fecf49a423c1a50c730ab457eb7655065aa5e47f533a0787c430b
MD5 2a5c734eeb72e895dbb403deb8700092
SHA1 cde3a14e111ba565d0ac234d24634f9df117e2de
SHA512 0ee5028b8e0aee50d666f828a0187ed79d5fceb2bcdd174155437730e87dc7744b013d75e19a26a3440b39a31fd00e0309b5a396728c2001740751770ae0ddcc
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomgb.exe

Path C:\Temp\ljdbwtomgb.exe
Size 376KB
SHA256 2a6f906362340e1afcb0d0f8f0663af4dbb71029994a8aab3037f3536ec06db1
MD5 36ed311b9791fafdc9f77aecf8127e6b
SHA1 199214fcc6503fc506f264ddd0a5b4cf126f89ef
SHA512 7518baeed05e5eaa9cfe8be73b99d4d939ddce7e1aedc4daa3c641a2047782ffd096d30d123a1cc6233bfe2f92ef910ae6750a5c5e45b4912087f1f5d96cd6be
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvsnlf.sys

Path C:\Temp\nifdxvsnlf.sys
Size 293KB
SHA256 9ac6e1c62324378cda49f223aa68cec0c2969719a2667ed2af769fa18bf259e5
MD5 00a018adb2360a36be8f966054c4149a
SHA1 e0d228063810da01051b14a26ef61e56cbdd50d9
SHA512 ba2618275c11468e3eac514549319c692c5c5fa9806250a0507e9e9a3edcf8a6a9d74c7ffc5e5fd49c464ea1861ebd08065b401cc9bddc51e74163295a3f2860
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T166545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljhezwuo.sys

Path C:\Temp\trljhezwuo.sys
Size 293KB
SHA256 8d99bc07da3db5dd91a3af0445290a792ab4a4b5729f051081690a6ae4e46ef2
MD5 35d85afe00765aebbd4ed44233197436
SHA1 3ba36ebaf9d1d14c841c1f7e5ce912d82980a885
SHA512 927864383335a2a84858693b3fb738e1a2201e9ec248428fa8b856aeea52aff08fcd7be743351c67a9198dfd915ddfeeec1b71fb5e48b196a23c91957ee40009
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdywqo.exe

Path C:\Temp\vtnlfdywqo.exe
Size 376KB
SHA256 0943fb0ede035afe001b6bed3903a2e7d31fe50ede1c5824a3496995993b215d
MD5 1ba45fdb86782b53cb1447b1bb2c5fe7
SHA1 5bebc2d9a8417595ec8683d4ce3020073cc04394
SHA512 7e31c4b2b67f87d4ef57b82e722cc142bfdff4221dd00aec0ec6dbc09285d7dda1fd82e0d2e8ba3a8ecfa016dd6141ca36942e1ca4dadbcdba47621505edf7e6
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dee215f361fc02264b1c255b80d676dad4967437e1a0fe8a3ca1e8367cfc5c02
MD5 a98acdfcc96397c37c4d830bc939fa30
SHA1 046447faa2731feca66923b73b95909aec5dc83e
SHA512 60b71a3f6575489bfbc4f0838696095d9543e1afe0c2384a256314f9496dbefadda4569cf753a1d9bcd6cbcd76e835f954d2d0e5cb1aed64d66c1160588cdb7d
TLSH
T1AE41A894C37168DBFBB0B9B123D2D59932F8A6584247EE51CC511D7AC907FB658C006B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a72c6d677b289febcc21da5a3111483b28d0a8f101f5643b5e225a51ccd67bcc
MD5 ebeadefb9e8bb21860eb7afcc4e679ca
SHA1 566ae1a7d5939aed85f04b0e728b830459472eb6
SHA512 37afa85fa4d352cdcdb8bfd37bab0649bcecbc20a5cf8459a8dd2b14d20976372d490042bcee61989ceb24706650d4e7157b98e63d7321cf8bff970dfef21763
TLSH
T1C541BEF3C3E8866EC90156F0AA187E1BCE1D0915432C3D5AC9E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d52b836eca3f49f359b24be8aa8caeb06a40c7cc948553aca27c2a740b3cce0d
MD5 f5f8d18869e51b028bc4bfdb24165ce9
SHA1 f48f5f480ab37b824680e6a47f9edd85bb929410
SHA512 0f6f4d53f8182b5922698b5870425943273e09c5f6e202b03fc4f372f3d210290e530b8e23dff1f9a762150ed13f6af762b1320bff96b855f21e418204105c80
SSDEEP 192:sxRrRnCn/fEsByL/CZVzoA8p9p/g6+WNCdR/YD9n6SpGt/IgtJ:sxRrwn/fEsBs/E4r/5G/DSC3
TLSH
T19132D7566928A93B9CC7D219BB25BF93D6F91032A1D11E58F7FC861C04EA6DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bc8cae41b14dc1384b810eb832a1bf7bc34f44453b32b6e815fb05cb1b10d2e4
MD5 a33f0c952ab952cc78fa516c46ef3fdf
SHA1 425d531eb27e8404aa0164b9937c5a6e8f831f5e
SHA512 2721d4629d3c47f81c288b434f0d32fc74b8e5f62df5d6f2e898a41f61949a8c588a918b73d5e91b362d96c1e9af24282baca7dcb2e2af56b7a21247d4463c18
SSDEEP 192:sxR8RnCn/fEs0yL/CZVzoA8p9p/g6+WNCdR/YD9n6SpGt/IgDuaJ:sxR8wn/fEs0s/E4r/5G/DSCaW
TLSH
T13342E8566928A93B9CC7D219BB25BF93D2F91032A1D11E58F7FC871C00EB6CD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0c987172dcaef1925c6d1a2d95388cb609a22c8c0c3b636b0ff917cf8e2e371e
MD5 50f02df4d9a09d2e386bae13aeaeb11d
SHA1 3ac716d74ac9170f8257322e22e04d2cafec2e3b
SHA512 4db2a7ab78e8d4bbe249918d9a87b4a9a564670ace66cb66a7ffb877558f821fcd86f759b9dc77c87459d3b96342157dc3171bf061602328c8260b741e91f750
SSDEEP 192:sxR8RnCn/fEs0yLyCZVzoA8p9p/g6+WNCdR/YD9W6SpGt/IgDu8J:sxR8wn/fEs0syE4r/5G/0SCag
TLSH
T12B42D8566928AD3B9CC7D219BB65BF93E2F9103261D11E58B7FC871C01EB6DD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 abf1ae2e52f3afc298983eb548aae8222ae6fedb79d18447013edabfddf6082c
MD5 30108e1b650fb06ffa041e0ca85d003f
SHA1 cb00309825b8723f97407d9e2a3d7f73e63b732a
SHA512 9acddee854ff685c32cbf229147a72e47c1fcb4bd35cf543db21bded18611f1e8700a26cedee76c3dfe4b22e2b4319be6c90ba7c8f8be50bf2e80d27c1479dbc
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSoYc162ropiua6:azfW/dE7J0Wg/XfHfu1jaNoYy6NpiC
TLSH
T110D2EA7B240CCF7F4F804A9DAD197EDB6DA802CB9698CD5047FE841C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1b0d522ca247743066cd5ef10604fdb0515c9566c154ac5cc64cea23539665e1
MD5 cb41a774b2cbda683eb87f88c9303201
SHA1 f72e51e3e22a3b953c9e60b59f3c9760b7085931
SHA512 a7b01f075559ff559f6ff473ba0c0da9fd251accd6aa3e4c06c7571edda32cffed7cd1db009e52390dad6d3c9e18f2e5826567a2f60bac41fbfcd93ecd89e34e
SSDEEP 96:KR+zC+4AwmWgFNg+mK4jg8mc2edse3HB+PrZ7/LWPM6gTLK4ygdLcBpk3ycwKBai:C+zC+4AwRgFe+ujg8V2edse3HB+PrZ7L
TLSH
T1F4B1411131361201387E7A5880E4AD1BD7C174A77118A42B7FEC41AA8F67E57AEFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a225e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a225e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5caa3de1d8553807a936c6dd915449f26f2cd1ba10017038bc4a3946d0a2a3c
MD5 92af05722dfb03afd68919cb2be3eb30
SHA1 6626df8de608829445c383e24853126c1ff2a814
SHA512 88210934c76be5443a9f74783b95ab6035e0d4f919c6eda8d52f1ebc3b50783fe7def8b2fc4bbfcbb51451e51eda03d1c7e8997aa57b5d4d7f356a374577bb5e
SSDEEP 768:rrv+4UNbdS3kOmi0nLrEnjN3Gac1ZSeVH1SCz:rbsbg3ktLQnjMaVEH1V
TLSH
T19A03CF3269A89EB39CEBE38571837A037FF4525385940BA4C6CD6B0D06DB5DC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ec8f5bf1a59b23febccc3aa99e82e88d52f180bd2edd71d8a419f0a46e087ab3
MD5 53c11319a417006054752b615d207580
SHA1 e3173a94c8c9dcf133c42a934c9da60a9e81bc16
SHA512 bc2e53a532a8f96959613de2eb8614166e18065948f0e43f24106da5ec06fbf9c4799c956a853b6c02b0344b551b9e9b1c450a84b50fcdd230f90bc2ac19e5d3
SSDEEP 768:uF1j+9k39wggzqyFSnHrEnjN3Gac1FRb9ML:L9k3UMHQnjMaGb+L
TLSH
T10E134AF258D78973C89E9787737E2E41AEBCD2A3B4850954B7C85A0CCD835BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 84d8502455be69b1283b8976d41ecdcc2588213ea5f55c8a779ee78178b766e3
MD5 9a92802533a94e0b3bfd6cbaeb7e67ad
SHA1 cf2fbe1f4c71e75bab1bdd2ef229748141010b1c
SHA512 d703fc650caad7a3720c44db261e2798fb3881e3917183b3a2fa3db8edeff1026b1751a9aa7bd0bae4808f06d5f3e34324c151dd97a9a4069021c742a9d2a73a
SSDEEP 384:n4tNn/s3n9SF38NKKr+Gfz8WZlf8hyEG7OMFry2rEoajo4cdR8eHhVODjYPNDUMe:4j+9238z1i0nJrEnjN3Gac1FRb9ML
TLSH
T179F2B07168A5CEB34CDAD39571433B92BEE017A385C50EA8DADDAB0D06C76EC1707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 58838d974c74ab1c402a16428dde06ac08029a355187848e062b2f39ac6b5d92
MD5 41a5fd8d7eb27d1715488d7aff037fcf
SHA1 4ea3ec3f6390dedd338aa72be843d45a95cf6ab3
SHA512 e7e534f87a69de2854eee07b23f05a12a8b1defdd8b0898e4bddc5fb90e46479e3f647783f87232e38056d49a299fad76c10c841bc963cfee71a14a603af0329
SSDEEP 384:nftNn/s3n9SF38NKhr+Gfz8WZlf8hyEG7OMFry2rEoajo4cdR8eHhVODjYPNDUMe:fj+923Nz1i0nJrEnjN3Gac1FRb9ML
TLSH
T170F2B07568A5CEB34CDAD39571433B92BEE017A385C40EA8DADDAB0D06C36EC1707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 82451699f2b068b89c933c8dc2040c90c57146ea03e83901a4e0d0227bd2862a
MD5 99a1fb542760e0be4c6d2823960abb1c
SHA1 2d0032e0bda960a7dd87932521362834529fe402
SHA512 42189f453c129a29c40d21ac8e643444fb9c1d5d1461ede56569f5ce7dc7ef3fa69df1012a20100ee6edab6b7ef3b44525b231eb691096fb7fa131d12f3c44ec
SSDEEP 768:Crv+4UNbdE32X1i0nJrEnjN3Gac1FRb9MB:Cbsby32bJQnjMaGb+B
TLSH
T1EB13C0317868CEB38CEBD255B1477A53BEF416A385C50BA4DAC9AB0D06C74EC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3712_682983752\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ab9f832199e01e18437d6061d33e048e97382c0a29b714fa46a753515c79c9d8
MD5 42c1c9645f2e3f617f0d6b6a2706c0aa
SHA1 916eb6c95c2c07acf26c59e3d2e45665cedfc905
SHA512 2738899614b4c91967feb3c373f40d46dc1fe5985fff70d5f3e9c67c93a14507a8dc05a27bfd6dc6bc024898e8334a200856fc0b37c51af52c44dbf17fc3174e
TLSH
T11E71008356B9C9F2C1DF5FF502835644F2BB22384723706007959546AB34A7E58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1248-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1736-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2112-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-57-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2484-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3096-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4180-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-228-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4292-227-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-253-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4700-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4936-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5076-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5216-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download