systex | 89edba4c7bf2c7c705c30a6ef47cda30bc2b4f907e8558692bc8c5736ba594fd

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260720-bnyepsbs4r
SHA256 89edba4c7bf2c7c705c30a6ef47cda30bc2b4f907e8558692bc8c5736ba594fd
MD5 6fd992f4b3ec3cfbb516222b8695e898
SHA1 93ca22e4fc3f2de498f118d3c68dec1a51088b2e
SHA512 ee8c932f67c6e509d524299d2e5244d357fbf1b2fd1bd46886820e9183a49ba72d1ec0d5e4d4ca48925c9c4da8b74f34794ffab3d6038a3dd69551dd895f8303
SSDEEP 3072:duxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1436	snkfcxvpnhfzxspk.exe
4648	snkfcxvpnhfzxspk.sys
5676	CreateProcess.exe
6328	vsnkfdxvpn.exe
1760	CreateProcess.exe
4460	CreateProcess.exe
6020	i_vsnkfdxvpn.exe
1952	xvpnhfaxsp.sys
820	CreateProcess.exe
2768	pkhcaxrpnh.exe
2724	CreateProcess.exe
252	CreateProcess.exe
2164	i_pkhcaxrpnh.exe
6568	pjhczuspkh.sys
6292	CreateProcess.exe
3184	mkecxupmke.exe
4252	CreateProcess.exe
2772	CreateProcess.exe
5584	i_mkecxupmke.exe
3540	jecwurpjhe.sys
1868	CreateProcess.exe
6992	hecwuomgez.exe
5668	CreateProcess.exe
2296	CreateProcess.exe
1796	i_hecwuomgez.exe
4492	ojgeywrojh.sys
4260	CreateProcess.exe
2584	ojgeywromg.exe
5136	CreateProcess.exe
4308	CreateProcess.exe
6988	i_ojgeywromg.exe
2984	ljgbywuomg.sys
4324	CreateProcess.exe
912	dbvtqolgey.exe
2424	CreateProcess.exe
6576	CreateProcess.exe
2196	i_dbvtqolgey.exe
4156	trljdbvtol.sys
4620	CreateProcess.exe
2084	tolgdywqol.exe
2700	CreateProcess.exe
5800	CreateProcess.exe
5720	i_tolgdywqol.exe
2244	nlidbysqki.sys
3456	CreateProcess.exe
3224	nligayvtnl.exe
4848	CreateProcess.exe
7016	CreateProcess.exe
6568	i_nligayvtnl.exe
4268	vsqkicavpn.sys
2356	CreateProcess.exe
3076	sqkicavsqk.exe
2644	CreateProcess.exe
7108	CreateProcess.exe
6632	i_sqkicavsqk.exe
5516	nkicauspki.sys
6872	CreateProcess.exe
6092	hfcaxspkhc.exe
5956	CreateProcess.exe
6640	CreateProcess.exe
1956	i_hfcaxspkhc.exe
4764	pnhfzxspki.sys
7012	CreateProcess.exe
6508	nhfzxspkhc.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_501130509\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_501130509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_900829449\Part-DE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqolgdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgeywromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nligayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifdxvsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcaxrpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nligayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxusnkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgeywromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcaxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifdxvsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcaxrpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcaxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqolgdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxusnkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2936	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2272	ipconfig.exe
6524	ipconfig.exe
7104	ipconfig.exe
3284	ipconfig.exe
4352	ipconfig.exe
2548	ipconfig.exe
1120	ipconfig.exe
476	ipconfig.exe
1196	ipconfig.exe
3956	ipconfig.exe
3064	ipconfig.exe
3364	ipconfig.exe
2944	ipconfig.exe
3248	ipconfig.exe
1496	ipconfig.exe
5108	ipconfig.exe
1776	ipconfig.exe
1664	ipconfig.exe
1252	ipconfig.exe
4780	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289838950006571"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{3B50DFF7-6816-4CB1-B7FF-467C30741D95}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1436	snkfcxvpnhfzxspk.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1436	snkfcxvpnhfzxspk.exe
1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1436	snkfcxvpnhfzxspk.exe
1436	snkfcxvpnhfzxspk.exe
1436	snkfcxvpnhfzxspk.exe
1436	snkfcxvpnhfzxspk.exe
1436	snkfcxvpnhfzxspk.exe
1436	snkfcxvpnhfzxspk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	6020	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	2164	i_pkhcaxrpnh.exe
Token: SeDebugPrivilege	5584	i_mkecxupmke.exe
Token: SeDebugPrivilege	1796	i_hecwuomgez.exe
Token: SeDebugPrivilege	6988	i_ojgeywromg.exe
Token: SeDebugPrivilege	2196	i_dbvtqolgey.exe
Token: SeDebugPrivilege	5720	i_tolgdywqol.exe
Token: SeDebugPrivilege	6568	i_nligayvtnl.exe
Token: SeDebugPrivilege	6632	i_sqkicavsqk.exe
Token: SeDebugPrivilege	1956	i_hfcaxspkhc.exe
Token: SeDebugPrivilege	1496	i_nhfzxspkhc.exe
Token: SeDebugPrivilege	3428	i_mkeczurpjh.exe
Token: SeDebugPrivilege	5108	i_geywrojhbz.exe
Token: SeDebugPrivilege	3080	i_olgeywqolj.exe
Token: SeDebugPrivilege	6096	i_bvtqolgdby.exe
Token: SeDebugPrivilege	2696	i_gdyvqoigdy.exe
Token: SeDebugPrivilege	5080	i_davsnlfdxv.exe
Token: SeDebugPrivilege	3364	i_kifdxvsqki.exe
Token: SeDebugPrivilege	1748	i_kfcxusnkfz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1436	1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 1104 wrote to memory of 3436	1104	2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 3436 wrote to memory of 4600	3436	iexplore.exe	90
PID 4600 wrote to memory of 6712	4600	msedge.exe	91
PID 4600 wrote to memory of 3756	4600	msedge.exe	92
PID 4600 wrote to memory of 2936	4600	msedge.exe	93
PID 4600 wrote to memory of 3756	4600	msedge.exe	92
PID 4600 wrote to memory of 3756	4600	msedge.exe	92
PID 4600 wrote to memory of 6436	4600	msedge.exe	94
PID 4600 wrote to memory of 6436	4600	msedge.exe	94
PID 4600 wrote to memory of 6016	4600	msedge.exe	97
PID 4600 wrote to memory of 4520	4600	msedge.exe	96
PID 4600 wrote to memory of 6016	4600	msedge.exe	97
PID 4600 wrote to memory of 6016	4600	msedge.exe	97
PID 4600 wrote to memory of 4520	4600	msedge.exe	96
PID 4600 wrote to memory of 4520	4600	msedge.exe	96
PID 4600 wrote to memory of 3656	4600	msedge.exe	101
PID 4600 wrote to memory of 3420	4600	msedge.exe	100
PID 4600 wrote to memory of 3656	4600	msedge.exe	101
PID 4600 wrote to memory of 3420	4600	msedge.exe	100
PID 1436 wrote to memory of 5676	1436	snkfcxvpnhfzxspk.exe	102
PID 4600 wrote to memory of 6796	4600	msedge.exe	105
PID 6328 wrote to memory of 1760	6328	vsnkfdxvpn.exe	108
PID 1436 wrote to memory of 4460	1436	snkfcxvpnhfzxspk.exe	113
PID 1436 wrote to memory of 820	1436	snkfcxvpnhfzxspk.exe	117
PID 2768 wrote to memory of 2724	2768	pkhcaxrpnh.exe	119
PID 1436 wrote to memory of 252	1436	snkfcxvpnhfzxspk.exe	122
PID 1436 wrote to memory of 6292	1436	snkfcxvpnhfzxspk.exe	126
PID 3184 wrote to memory of 4252	3184	mkecxupmke.exe	128
PID 1436 wrote to memory of 2772	1436	snkfcxvpnhfzxspk.exe	131
PID 1436 wrote to memory of 1868	1436	snkfcxvpnhfzxspk.exe	135
PID 6992 wrote to memory of 5668	6992	hecwuomgez.exe	137
PID 1436 wrote to memory of 2296	1436	snkfcxvpnhfzxspk.exe	141
PID 4600 wrote to memory of 2756	4600	msedge.exe	143
PID 4600 wrote to memory of 5412	4600	msedge.exe	144
PID 4600 wrote to memory of 1824	4600	msedge.exe	145
PID 1436 wrote to memory of 4260	1436	snkfcxvpnhfzxspk.exe	148
PID 2584 wrote to memory of 5136	2584	ojgeywromg.exe	150
PID 4600 wrote to memory of 4732	4600	msedge.exe	153
PID 4600 wrote to memory of 4732	4600	msedge.exe	153
PID 1436 wrote to memory of 4308	1436	snkfcxvpnhfzxspk.exe	154
PID 1436 wrote to memory of 4324	1436	snkfcxvpnhfzxspk.exe	158
PID 912 wrote to memory of 2424	912	dbvtqolgey.exe	160
PID 1436 wrote to memory of 6576	1436	snkfcxvpnhfzxspk.exe	163
PID 1436 wrote to memory of 4620	1436	snkfcxvpnhfzxspk.exe	167
PID 2084 wrote to memory of 2700	2084	tolgdywqol.exe	169
PID 1436 wrote to memory of 5800	1436	snkfcxvpnhfzxspk.exe	172
PID 1436 wrote to memory of 3456	1436	snkfcxvpnhfzxspk.exe	176
PID 3224 wrote to memory of 4848	3224	nligayvtnl.exe	178
PID 1436 wrote to memory of 7016	1436	snkfcxvpnhfzxspk.exe	181
PID 4600 wrote to memory of 1724	4600	msedge.exe	183
PID 4600 wrote to memory of 1724	4600	msedge.exe	183
PID 1436 wrote to memory of 2356	1436	snkfcxvpnhfzxspk.exe	188
PID 3076 wrote to memory of 2644	3076	sqkicavsqk.exe	190
PID 1436 wrote to memory of 7108	1436	snkfcxvpnhfzxspk.exe	193
PID 1436 wrote to memory of 6872	1436	snkfcxvpnhfzxspk.exe	197
PID 6092 wrote to memory of 5956	6092	hfcaxspkhc.exe	199
PID 1436 wrote to memory of 6640	1436	snkfcxvpnhfzxspk.exe	202
PID 1436 wrote to memory of 7012	1436	snkfcxvpnhfzxspk.exe	206
PID 6508 wrote to memory of 2976	6508	nhfzxspkhc.exe	208
PID 1436 wrote to memory of 6384	1436	snkfcxvpnhfzxspk.exe	211
PID 4600 wrote to memory of 1144	4600	msedge.exe	213
PID 4600 wrote to memory of 1144	4600	msedge.exe	213
PID 1436 wrote to memory of 7036	1436	snkfcxvpnhfzxspk.exe	216

C:\Users\Admin\AppData\Local\Temp\2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_6fd992f4b3ec3cfbb516222b8695e898_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Temp\snkfcxvpnhfzxspk.exe
  C:\Temp\snkfcxvpnhfzxspk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5676
  - - C:\Temp\vsnkfdxvpn.exe
      C:\Temp\vsnkfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\i_vsnkfdxvpn.exe
      C:\Temp\i_vsnkfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcaxrpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:820
  - - C:\Temp\pkhcaxrpnh.exe
      C:\Temp\pkhcaxrpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcaxrpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\i_pkhcaxrpnh.exe
      C:\Temp\i_pkhcaxrpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6292
  - - C:\Temp\mkecxupmke.exe
      C:\Temp\mkecxupmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2772
  - - C:\Temp\i_mkecxupmke.exe
      C:\Temp\i_mkecxupmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Temp\hecwuomgez.exe
      C:\Temp\hecwuomgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2296
  - - C:\Temp\i_hecwuomgez.exe
      C:\Temp\i_hecwuomgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgeywromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\ojgeywromg.exe
      C:\Temp\ojgeywromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgeywromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\i_ojgeywromg.exe
      C:\Temp\i_ojgeywromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\dbvtqolgey.exe
      C:\Temp\dbvtqolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6576
  - - C:\Temp\i_dbvtqolgey.exe
      C:\Temp\i_dbvtqolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgdywqol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\tolgdywqol.exe
      C:\Temp\tolgdywqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgdywqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5800
  - - C:\Temp\i_tolgdywqol.exe
      C:\Temp\i_tolgdywqol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nligayvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Temp\nligayvtnl.exe
      C:\Temp\nligayvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nligayvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7016
  - - C:\Temp\i_nligayvtnl.exe
      C:\Temp\i_nligayvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2356
  - - C:\Temp\sqkicavsqk.exe
      C:\Temp\sqkicavsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7108
  - - C:\Temp\i_sqkicavsqk.exe
      C:\Temp\i_sqkicavsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcaxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6872
  - - C:\Temp\hfcaxspkhc.exe
      C:\Temp\hfcaxspkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcaxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6640
  - - C:\Temp\i_hfcaxspkhc.exe
      C:\Temp\i_hfcaxspkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7012
  - - C:\Temp\nhfzxspkhc.exe
      C:\Temp\nhfzxspkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkhc.exe ups_ins
    3⤵
    PID:6384
  - - C:\Temp\i_nhfzxspkhc.exe
      C:\Temp\i_nhfzxspkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurpjh.exe ups_run
    3⤵
    PID:7036
  - - C:\Temp\mkeczurpjh.exe
      C:\Temp\mkeczurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurpjh.exe ups_ins
    3⤵
    PID:7040
  - - C:\Temp\i_mkeczurpjh.exe
      C:\Temp\i_mkeczurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run
    3⤵
    PID:5520
  - - C:\Temp\geywrojhbz.exe
      C:\Temp\geywrojhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    PID:3404
  - - C:\Temp\i_geywrojhbz.exe
      C:\Temp\i_geywrojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeywqolj.exe ups_run
    3⤵
    PID:1224
  - - C:\Temp\olgeywqolj.exe
      C:\Temp\olgeywqolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeywqolj.exe ups_ins
    3⤵
    PID:240
  - - C:\Temp\i_olgeywqolj.exe
      C:\Temp\i_olgeywqolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtqolgdby.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\bvtqolgdby.exe
      C:\Temp\bvtqolgdby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtqolgdby.exe ups_ins
    3⤵
    PID:5860
  - - C:\Temp\i_bvtqolgdby.exe
      C:\Temp\i_bvtqolgdby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigdy.exe ups_run
    3⤵
    PID:5908
  - - C:\Temp\gdyvqoigdy.exe
      C:\Temp\gdyvqoigdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigdy.exe ups_ins
    3⤵
    PID:1128
  - - C:\Temp\i_gdyvqoigdy.exe
      C:\Temp\i_gdyvqoigdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    PID:3260
  - - C:\Temp\davsnlfdxv.exe
      C:\Temp\davsnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    PID:5176
  - - C:\Temp\i_davsnlfdxv.exe
      C:\Temp\i_davsnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifdxvsqki.exe ups_run
    3⤵
    PID:1144
  - - C:\Temp\kifdxvsqki.exe
      C:\Temp\kifdxvsqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifdxvsqki.exe ups_ins
    3⤵
    PID:896
  - - C:\Temp\i_kifdxvsqki.exe
      C:\Temp\i_kifdxvsqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxusnkfz.exe ups_run
    3⤵
    PID:2760
  - - C:\Temp\kfcxusnkfz.exe
      C:\Temp\kfcxusnkfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxusnkfz.exe ups_ins
    3⤵
    PID:2820
  - - C:\Temp\i_kfcxusnkfz.exe
      C:\Temp\i_kfcxusnkfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczurmkec.exe ups_run
    3⤵
    PID:7032
  - - C:\Temp\khczurmkec.exe
      C:\Temp\khczurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3064
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb88b1c188,0x7ffb88b1c194,0x7ffb88b1c1a0
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9169800798105699785,18434337725979218615,262144 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,13095416324797195669,18425685399709455134,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
      4⤵
      System Time Discovery
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,15385443299868104391,8984840625504925096,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,12992032407479661282,9772856786016255125,2097152 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,7659520934863362183,16718897119408529405,2097152 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,17705751916435456041,1074541064334506398,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,17430479416027125496,8967690744341118811,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,3972179544279956381,318369587836435999,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,3972179544279956381,318369587836435999,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11729581438490109065,11070670242676447844,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,290658260976140343,860569189184621343,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6705920531858607196,15216698423320921617,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,9225094762240440148,7563619370005858974,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,2830006621164810985,12008154392915198480,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8599614964888561310,17880899407083078616,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,9197519944371598076,65203127676885804,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5740,i,8237922008256761575,2336492386064711181,262144 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:10
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,5875911833871467067,15130572492188552590,524288 --field-trial-handle=2236,i,8370255295548057612,15524417318573068142,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:14
      4⤵
      PID:476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4508

C:\Temp\snkfcxvpnhfzxspk.sys
C:\Temp\snkfcxvpnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:804

C:\Temp\xvpnhfaxsp.sys
C:\Temp\xvpnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\pjhczuspkh.sys
C:\Temp\pjhczuspkh.sys
1⤵
- Executes dropped EXE
PID:6568

C:\Temp\jecwurpjhe.sys
C:\Temp\jecwurpjhe.sys
1⤵
- Executes dropped EXE
PID:3540

C:\Temp\ojgeywrojh.sys
C:\Temp\ojgeywrojh.sys
1⤵
- Executes dropped EXE
PID:4492

C:\Temp\ljgbywuomg.sys
C:\Temp\ljgbywuomg.sys
1⤵
- Executes dropped EXE
PID:2984

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\nlidbysqki.sys
C:\Temp\nlidbysqki.sys
1⤵
- Executes dropped EXE
PID:2244

C:\Temp\vsqkicavpn.sys
C:\Temp\vsqkicavpn.sys
1⤵
- Executes dropped EXE
PID:4268

C:\Temp\nkicauspki.sys
C:\Temp\nkicauspki.sys
1⤵
- Executes dropped EXE
PID:5516

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:4764

C:\Temp\mhezxurmjh.sys
C:\Temp\mhezxurmjh.sys
1⤵
PID:5444

C:\Temp\hbzwromjhb.sys
C:\Temp\hbzwromjhb.sys
1⤵
PID:1740

C:\Temp\ztrojhbwtr.sys
C:\Temp\ztrojhbwtr.sys
1⤵
PID:4572

C:\Temp\ywqojgeywq.sys
C:\Temp\ywqojgeywq.sys
1⤵
PID:6568

C:\Temp\dbyvqnlgdy.sys
C:\Temp\dbyvqnlgdy.sys
1⤵
PID:6364

C:\Temp\kidavtqlid.sys
C:\Temp\kidavtqlid.sys
1⤵
PID:6524

C:\Temp\ifdauspnlf.sys
C:\Temp\ifdauspnlf.sys
1⤵
PID:4856

C:\Temp\kfcausnkfd.sys
C:\Temp\kfcausnkfd.sys
1⤵
PID:3248

C:\Temp\hecaurpmke.sys
C:\Temp\hecaurpmke.sys
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtqolgey.exe

Path C:\Temp\dbvtqolgey.exe
Size 365KB
SHA256 2215609cd62dae3d84963882a7cac95127d096abf2ce15a3815757b3d34ee557
MD5 33a17362feb4d36fd2214f00429834cc
SHA1 384a07bb8a9c7fc40f16a06ab019366d612b8029
SHA512 45bed6993319d6c7c68149695d9c0c4083f8c0790504d991462684e7a736e814c0d8096e17ce5cafd2090800ec3bddd872067f3038b89a2940bcaf9c30eff075
SSDEEP 3072:5uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwuomgez.exe

Path C:\Temp\hecwuomgez.exe
Size 365KB
SHA256 2be288dccc684ca116404d3f99650b6b3643859c5a09947151418912abb1a376
MD5 fbc739a7ce4b61a1434701e87e654921
SHA1 aa011ddbef160a664b197184ef594664d9722636
SHA512 68b317fedc270288cb609c0edfd1ae5b55f57fcccae29d0c4eab9c21cd4c87b31b4a6fbe60f824cb25718ce74b433e27f8b55c1e7d41b8aa7454c727cdf826cd
SSDEEP 3072:JuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtqolgey.exe

Path C:\Temp\i_dbvtqolgey.exe
Size 365KB
SHA256 1923d0e74ff6296df511afc77e25a0979d27bc6c6a3d10807a8a63fe341dbc65
MD5 bf15191da3000c04c13fc76ab573ed37
SHA1 596eec324f1263a479e36e5469409147c430f01f
SHA512 950e9a6d931786804ab4c5df5c5c49a0ab8a6b47b690830b86f1d189efddb921ba64cac524759e44f3cdfd179a6b0a52cf45f2e3823c859348c9f1935d209dd3
SSDEEP 3072:JuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecwuomgez.exe

Path C:\Temp\i_hecwuomgez.exe
Size 365KB
SHA256 161a5c1c84892731088ec498d4e93026733f3c99e126a0ccb9b3b6557faada29
MD5 054c5599a03f2d8b30ff6c99e4ad5c4f
SHA1 96edfc1a867650d59b4c4300702fc1b22509ab2f
SHA512 c560e0601fc5de014e028834644099c9dd4f429dfa03db5e99211e3f90077f89eec03c45022c08377d967328769eb624de75e444ea3789eeef3fc1cc37828d78
SSDEEP 3072:suxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxupmke.exe

Path C:\Temp\i_mkecxupmke.exe
Size 365KB
SHA256 fe55e6c952ce215e170223ecdf2b6a9d86fd8b14fc01c59f249d0301a643b719
MD5 89708926f6d9a680dc165b8a59bd46aa
SHA1 e3b8fe8c35d9d5d03fa855f946f72b2ae3aeab23
SHA512 6cdb141158092bf98c1daa7f2d31e235900b2a6044ce52d2d047cc318995e3d885c274be7d3ffaa9d0846192293fc2a205f98a08e540cb9713580e133759fd21
SSDEEP 3072:luxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgeywromg.exe

Path C:\Temp\i_ojgeywromg.exe
Size 365KB
SHA256 0a74e22f560827c08e252e25d36ae87fa45c366c8ccd226c95813119e9b16a91
MD5 61c3831387ee8c07b1e8ff25b83d2718
SHA1 e41dd850cc998eaefaa41bae2899f72f1ac2b250
SHA512 9a6103fccd31cbb4de10348f503b1c1ed1480048396faa8002dfc579b0edcbd77672b3ab4485c33bd331695b4cd3aecd7f0887bd25f4efa70f201ac8516aeba0
SSDEEP 3072:CuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcaxrpnh.exe

Path C:\Temp\i_pkhcaxrpnh.exe
Size 365KB
SHA256 b7ca3880a49bdd771b209312149c21f9804d78a7d43cab55222b2a11bfc46606
MD5 bc14a74e280034d09ffbab16b95d6214
SHA1 d8e7ef26cdf3a214728ceafeb65b414934a05fdc
SHA512 69d32e610e87d703a7addd55267c40594d1433cc5f2d85d45b81cb97c19d3660d7f4e78afbd9a978f17ec8f4c3a710e8b04cabb89f57b5b32aaa3ad1f9aa80d0
SSDEEP 3072:xuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T137847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvpn.exe

Path C:\Temp\i_vsnkfdxvpn.exe
Size 365KB
SHA256 dd0bcfa4a7511881f477cce22fed2f5be3ef88268daa363c1b8e1d1eadfd73f6
MD5 4c023619e2868ebccef445b6717062b9
SHA1 ceb8a7c59382cbe3f4ec85756bc6ec99624a9d10
SHA512 4673bb5e06db62e3bad34b182e4a9b72b401716514233fd820396a9188252b423345b46ec9752001304ddb3001ecb9f5c1a5ed71c4d9cf628bd18c02657f3108
SSDEEP 3072:FuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwurpjhe.sys

Path C:\Temp\jecwurpjhe.sys
Size 293KB
SHA256 3420a5dc6f59a7633b91669094cc1c5c9a54ae1a749e9d47c4df67440a75d6ec
MD5 3922972cc3299ecdbe8ae465dacca221
SHA1 16d82e8de199b41fbda6fd959111e08dbeba1f55
SHA512 c3a9c5191be385dbc97c779556e655e299ef2f8eaa6d5bcb7a7bcc10cc9e90aa7871054bfc4aa694e4f34cc0684c854779bbe5fa5829dc982f82c8be1152f1b2
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbywuomg.sys

Path C:\Temp\ljgbywuomg.sys
Size 293KB
SHA256 6ef7b6ff68e5d4a1fdda9b8fe3b4d7add86f04c42bdfccfe40f8f4413686c449
MD5 682c672c53103c41f32a75cead38e856
SHA1 7846982bab76b26c21e4ef7a385a01950e80b872
SHA512 19eb77fb0431829001ea12b8192d63e285022de1ac4414e21cac3342813d10db2c60e17ee76e996ebc3b848a15a06628a80e201dd493bc52f8a7134b08877a60
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T14A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupmke.exe

Path C:\Temp\mkecxupmke.exe
Size 365KB
SHA256 7413ed3565ae7d4c02a889356205ac7296385123d1a6f19ebfcf03b59fe6a17d
MD5 a09c0ed090ac1c251b040f11ea855752
SHA1 9e5250960661728557c7f3aac65ecc00aae92011
SHA512 59a77bf40c639c54c2ba0bc3ac26ba78d1a06582ed88967c9254f0fbf8059649fe487816bc0c1b29136e75da252d3e26b2b19ae097777891b6ce948811e15986
SSDEEP 3072:zuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgeywrojh.sys

Path C:\Temp\ojgeywrojh.sys
Size 293KB
SHA256 573c00ba72cfa008c63f286d2b1d33a61db68cc38cbc6e0d6b445ad7949509f2
MD5 a2d3cff839a3b66976104d81df841695
SHA1 0b4eb6c593306a07e35a1da874b65ed512f89f3d
SHA512 d383e6ad36c52275f68e66d36715845504713fe8c9249e05210ef61e760b2254a5f06efb85c006fec77332702c860594baf93227ed8007b44286b561d36ab66f
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgeywromg.exe

Path C:\Temp\ojgeywromg.exe
Size 365KB
SHA256 c04d9f71c9f05cf9fa0a9cbb267f901051985b88c784448b9c2115e269a9a076
MD5 4bf6206b912d0f7ffec4bb011e1fe3bb
SHA1 522d6d3761d5658388de86f8df8e93a7cc0b4815
SHA512 48dc3ad28acc19bd9962c3cfb6a2451cc18a3c61fe55cb7fe1c310aa947dcc0a6bdfc46f30a1ea4084c00c496737c4389e6cdfa042d4de0cf889923dff27c0c3
SSDEEP 3072:muxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczuspkh.sys

Path C:\Temp\pjhczuspkh.sys
Size 293KB
SHA256 6c1ba4bc8f025702db1b6c6288c104f2867b8204cb60494014fbb502ea5a6da8
MD5 f672918c7ab8eafc30634994411a3c81
SHA1 896601b780399eb0405f021355e63719826999c7
SHA512 02579c41210093b7a90b747351d3af48eff757ad955a683121eab923e3a5d2d9e45986752b6ce0da9ff98feee0294e00aa38a4eba75c92528e84c7952b591fd5
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcaxrpnh.exe

Path C:\Temp\pkhcaxrpnh.exe
Size 365KB
SHA256 5a4b7c9f987c2aafa40095671047db18d59d492fe8051e2b1bb9511a1849a14e
MD5 db1a2d66751a1f558ff2077f44dec90d
SHA1 33827c18bda6132925dc8bc949193ff87d485942
SHA512 06fa91c2252c416b3659d4cf1de736fab48349054c398acb5c06920b45a8e671922eddc9c107e3d33ae8d83a32caaae6d94d9d68d1fee7ee06449747dea14be2
SSDEEP 3072:euxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxvpnhfzxspk.exe

Path C:\Temp\snkfcxvpnhfzxspk.exe
Size 365KB
SHA256 d1c2b12645d23cab6837dc7a002ac7970a119816a29557ea5bae9dcc4d4ca9cf
MD5 be488b4041996e4425b5b477bb6bf3bc
SHA1 cd70b2703264d07b7345f690b108a15b028adb91
SHA512 a7224c43c71be023ce785a0b21d9eb247346539bc83aaca4978a6754646dfbf26e2bb4656c60cbd948d8bfd0e104d99a3ed826b7374fa944e3d8c0d234432eee
SSDEEP 3072:9uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxvpnhfzxspk.sys

Path C:\Temp\snkfcxvpnhfzxspk.sys
Size 293KB
SHA256 3015b87c6e31bcdae9e9ac2a5cb86e9283b976025a48bb172f886d7cecf09c1e
MD5 750497cdf76b9483c2917719d1d07ce5
SHA1 82d3275e3d6bd6d89d37b2b8f1be257e51644d4f
SHA512 de13ce3f30e78725081b2a413639084eafbc0de5774b0ba75ece267ccc3f961bb0fa827f5932d5b46747f3c317bb5f606c6d56017ae4a0f7146d3b7d698e9a9d
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 293KB
SHA256 ffc1923c3ceab4aca0dcc8d44f56ddba62ac0af0db815c520dc4f4e2496e6b5f
MD5 aac88c4861c236d258f258f099cd6bd4
SHA1 1c9064043deda676232043ab89173f43eff318b5
SHA512 5ddfd15695965370b8af6174760ecb61529ae08122df9d457cd3a5badc81fb08b32d210e5a6063349ad5e9fc9e990d0499d8a017bd046cd77ed0e4126abf1c06
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.exe

Path C:\Temp\vsnkfdxvpn.exe
Size 365KB
SHA256 1e8c3f26b16cedb623f8026046cc7bd5bf19f05c9bd665c0f7bc9a855542614b
MD5 f79d60712de88ccd8d5e20a906cba004
SHA1 b0d1f97346851dc004d6399a010ad417b0986f53
SHA512 000c214e2248baf59a892e39c2289867888a31c5c4dee30e36b39c24936906b563cab16693868432f02af4ea139175ce5099d9b430ae385d37f46e27343086ab
SSDEEP 3072:WuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfaxsp.sys

Path C:\Temp\xvpnhfaxsp.sys
Size 293KB
SHA256 9dab0645b17b1771a71e11faa580028246eb371a37d78e682a699570ff8bad9a
MD5 a2a3ad71906ec5c5b670b6146d3da435
SHA1 b7401383e2bf985757b1e08cc15bbd6509e50f78
SHA512 760a9cfb7685ea0a9a52e860fd53eca7416dd117edb53e4f9c9b1be5250aebf89bae0b38fd26e835cbaf9ddf7645821833315dd9e68d0cda96ea303d113eb68a
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T132545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

36479cc2-8b01-45df-89a9-b781bba13461.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36479cc2-8b01-45df-89a9-b781bba13461.tmp
Size 15KB
SHA256 866931b868b1071ea35871fa69e94863599ccc740c7f201cfe372f6d028d1978
MD5 f4603e1e4e44b263279512a9646100e1
SHA1 980054b1ab88d5553a828dae2392f8b9b7c60b1f
SHA512 285124257bea08e6bd1e6411163a9b6a7397ad05433535b8dd4273134fd36f0246e7902ca00ab4720f72a9e241515e9dfb0477e05a1f36e2a4fe39da24f142c3
SSDEEP 384:sxRjB80/fvsZxlN/RIvEz/5F/W9gsGQVjQ:sne0/faXWA/55W9gsGQS
TLSH
T1A272D9166A248E7B8CDBD219FA957F93D6F8157391905E44ABFC8B0C00E66ED2113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ed9213056ae74bab1723509a60f5bff2d26eb586bac34d2fd71f1ce6e2853860
MD5 a743c3d6de41ca00ccb2cafd2fb5884f
SHA1 f457b825e75a96a9d306a3be49238c0b20ec0e44
SHA512 7edb56dd603f7d38bf5dc4235910af5ad8db833164905db50591542be6a6f2b5ddc6d59e79a0b535a1ab59473a1802e677bd8870886ae79d59bdbf14a68a774d
TLSH
T1B7D0C2A8A8ECA94ED6E409BE97A5F0100F6402820416DA120160F9C136A52E41BAA020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dcc45a51cd5a79b534397c98020b36eb0c8f7e4b426137fa8eed4572ce3d09d3
MD5 ddc96bd66457dbc11f96b8595e0c2b9a
SHA1 0d7b8b62d9d4e82534fd7634fe204283854d3a58
SHA512 e41f3d687b23c81767213d1a4345371c66a151205625c816fdaf11290d1cc02d9a7081358499407243b5a1ef41bcdb61df90d957b4847fa455c2e15ad326a0d4
TLSH
T194F0CDA6D921AC3719FC1B1970584B47E755135B3B41D88B3B3D825C4FB563B8A46C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e629b2d0a6ee787e1f33f94a6e58dffd6a7dcb87772ad77a5403f17ef89e6e2a
MD5 6b7aeb33feddd076ec10f243e82d847d
SHA1 a9554d9b47581cbcd9b53322f756c96bdbead3a0
SHA512 d16a7b45bd0187512a4949661b2233208e1d67296a588bd019f12859bdd95e3a21648e91b4e956cda090127d76cc06297255a9102ea987a2ed251dbfbacef5be
TLSH
T17C41BEF783E4856EC91196F0AB18BE2BCE1D0915832C3D5AC9E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a4a98989d0a599a6b0310e82d051f6755cf36a67d798db4ed9f310a47e3a7e0c
MD5 ba28e22d78ab10f2af04c24a0e17faf9
SHA1 211b95d9f40eae549a6335d124faad74e12e03d8
SHA512 a57f7ef05cd09540f6330123a47c8cea1fd5db46feec00ccd41af3ca52f4047a53def481502daac6f3bddc5f1fe5a247114c3c06442814b6722aef5f1b840041
SSDEEP 384:sxRjBqH0/fvsIxIN/RIvEz/5F/W9EsGQV07:snIH0/f/SWA/55W9EsGQQ
TLSH
T1F072E9166A248E7B9CDBD209FA957F93D6F9157391905E44AAFCCB0C00E66EC2113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
MD5 124e92aa1658506c1cb8f41edd19bffc
SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
TLSH
T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 172971c1bd62808500941cc7c11007f67c28027a5927ca2ab046ae7c3e74a176
MD5 233c8aef655d98c88ef81ecf09fa957d
SHA1 13b53866d107fbac78bb60368a3ab3adf3180720
SHA512 23f27f3e7f1d298ce6e836b837a50532bf6945569e88729d70ac5fdf685040cbc0205daa6f6c670f376db222f526dfb8922e4bfb2782518d0f52d9283217d11c
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h7y:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRF
TLSH
T1DAB24A51713F4280387EB91C91B8981ED6C2B4A37419E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8c233de175491a04fa03af0c2a745e53a0bd95b3db3facc5cfb2c2cea4054365
MD5 0f40c29d89fbfdf5f5aa04b5cfb1a170
SHA1 d39f87f9de6c9f87da56a7608da5458135b110ab
SHA512 aa708b7a28869fd30ce9a488b2b597353d011f1963a8690fa75f9c388c7c580414e29fe936442a268582e6eeaf9b697b51b8475f568c3a2b71f9255603f976b4
SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRiPvuTuRREqfbYG8oqHL0OObjI9G6w7aijh83:IF1j+9SXcwgUu4UG8Dr029MaWa
TLSH
T11DC25A36DC55CEB7ECE64F98B70A7A56EEE0126385D85AC4DAD81E4C00C71ED4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0bfa2bb26eb5a02ba2591cb7ff1dbb4a3a779f2f85fba6b667b3cbdc80dc38e6
MD5 42f1ebf76793b6899402b86c4d208fb3
SHA1 d368366495b67fd2e48a9d00480c25b42c0072bd
SHA512 aedae0310adb62757a0ef101391275ec7ed3ec2aaef489891a5d5509aee90642e042a9ead5e0f33564f8b6857fc9323969b7810d165b66b984f9682506b5092e
SSDEEP 384:npiF1tNn/s3n9ST8NLi8TUNTUlIRXPvuTeBMEqfbYG8oqGqrDUZOObjI9G6w74Tw:AF1j+9yQiwgxucDG8DGUQZ29M9
TLSH
T132D24B32D855CEB7ECEA4F99B74A7A96DEE011B3849C8AC8D6D95E4C00C71DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 47b7cee8bb0522dde1e3a448010aa9379e36f28f3933abd662c55b92b623a523
MD5 750e424ecc645e1f0ecb4a396c439127
SHA1 8ae5c3f1e1faf6f9d40817c9e27a0b6705fe5877
SHA512 2bf7a10c2bef6cc296fbba9765f063f1a130e8c6fc77f30f9176fb3f04ef334ca2abbe65a37ec2eb1b52bdd15b01f78630dae2b1246e8816ddd10f0c8603e95e
SSDEEP 384:nsiF1tNn/s3n9ST8NLi8TUNTUlIRiPvuTrBMEqfbYG8oqGqrDUZQQo48LEEIzFX:XF1j+9yQiwgEu5DG8DGUQZP
TLSH
T1B6B23B32D855CEB7ACEA4FD9B70A7696DEE011A384CD9AC4D6D85D4C00C72DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba7976a7-e8a0-421b-9746-2d455df6c444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba7976a7-e8a0-421b-9746-2d455df6c444.tmp
Size 33KB
SHA256 926a1f432f85bc87f4052d593bda854678bfb0783432f09f7957469485ad3378
MD5 48d83773544d28e4e188369b5e91e59d
SHA1 8089c5a490e57d602980f233ac06bd4457a99a14
SHA512 83665e773d759189d9acc0f69c3365fff73072a5fb8374b80d51895de4ea39ca971b131bcf1fdd1f0702fea5ca8a043d150574fd6e544b5a2ebd6b3a122ea0c7
SSDEEP 384:nYiF1tNn/s3n9Sv8NLi8TUNTUlIRXPvuTewMEqfbYG8oqGqrI0ZOObjI9G6w74Tw:jF1j+96QiwgxudDG8DGUHZ29M9
TLSH
T198E2C3F198D78973E89E4B97A37E2E969AFCD163B4884984F7C44D0CCC861BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0ef1f5883f1761d20ddc8d43dcee8f8d3bb93ddf9f1e7a0f1f67bad455473b0e
MD5 c4c85f62be0612a3897833e1b92938db
SHA1 a2067a71af126141a16dd03e4e0d28802e0eada9
SHA512 0f87b10ae704c8f8b2e3a64d088e8af8d207adf8c060c16336a435125567aa2139fdf747498e6063cfb832b402540c87b2ffa73414e70a8456c7c29a1c789b4b
TLSH
T1F7513FE08C381AD5D4BD0A7FB08B34EC81ECC726F49034397858EA985A7975D318083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d7a782174bc9d3d7860f17583c0970a10ca5b138e174f4fab67627d6ee8c49e5
MD5 2bf415d63a2da07b62f718d394b5ebfc
SHA1 7dea981491cc47d7f6b7c095177328fc8565dd3c
SHA512 944b4dcadb5da7de1444fb0ae020b9a66873270e03511a6b5987ebfe22510cbe33dcba374d35039ec9320247a50d82d1a286b07b76dcee0b80d4fc1a8aa0018e
TLSH
T1B34141E04C382AD5D4BE0A7FB08B34ECC0ECC726F490347D7858EA985A7965D218483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3fa390d3a8296238804cc6dbf2f63c2c0ccb39e1ef96fbfe00d0875bada4294f
MD5 9b468592a877460400c45d5440d8fa69
SHA1 dac9c82b5ca380cc3fe48875564d09fe0b625381
SHA512 7c59b33f15600e0d361c8dac10fe9084ea8f18d7ad8c03c99d9fa6f6b18334c81730aaea577ecefa101b7807643f21cb148f6ef16d80d16bd00caf945da50636
TLSH
T1C64141E08C382AD5D4BE0A7F709B34FCC1ECD726F490343D6858EA985A7A65D218483F
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1673713861\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 89566ddd0d8ea36d351ffaff4037efc5690d9a2d5895481036655ce61e31060f
MD5 252baf7726911fefb91016377bbfdd60
SHA1 a9a39ff784ca083ededdd660348b2e8be3222225
SHA512 6e72b58f2393aa111f346ff44ec9117fccd5227b7b5c333dc879206bb1aa53679fc02d57a39a9ce454bf589cf82ea353da9a0ff0e6053d93eeb758090d80a651
TLSH
T13C71048366A8C5B2C2DA5BF503835144F6FB1278076330240B555586AB3473654B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1740-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1740-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1952-152-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2244-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2984-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2984-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3248-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3540-207-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4764-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4856-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4856-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6364-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6524-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6568-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6568-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6568-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download