systex | 291dc5c7f983c9fa557440d63d756e8755cc26d995118afa4bd38b60830d670e

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260820-pykhgsxcpg
SHA256 291dc5c7f983c9fa557440d63d756e8755cc26d995118afa4bd38b60830d670e
MD5 54b2ea06616b2e1fadbd585028d8f06b
SHA1 7691eb1a97c2c06f3b911c63252e79dd48ef3b02
SHA512 817decac7db4b1fa733501889b3cc1857d66ac6827be0d74d1c4a4471fd0f0af89365f67052c405b7c8b82f4dc5a44b13cfd159a0851116a4a0bb94bc08991b3
SSDEEP 3072:9jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3276	ytrljgbztrlgdbzt.exe
3040	ytrljgbztrlgdbzt.sys
1152	CreateProcess.exe
1888	bwtolgebvt.exe
4448	CreateProcess.exe
1424	CreateProcess.exe
3544	i_bwtolgebvt.exe
5036	gbysqoigay.sys
2744	CreateProcess.exe
4400	ysqljdbvql.exe
1548	CreateProcess.exe
4968	CreateProcess.exe
5708	i_ysqljdbvql.exe
5732	vsnligayvq.sys
5692	CreateProcess.exe
5928	qnlidavpni.exe
1716	CreateProcess.exe
5696	CreateProcess.exe
4480	i_qnlidavpni.exe
4452	vsnkfdxnhf.sys
5828	CreateProcess.exe
4660	nhfaxsqkic.exe
1276	CreateProcess.exe
4940	CreateProcess.exe
4000	i_nhfaxsqkic.exe
424	nkfcxvspki.sys
5708	CreateProcess.exe
6072	nkfcxuspcz.exe
5240	CreateProcess.exe
4208	CreateProcess.exe
1468	i_nkfcxuspcz.exe
5152	pnhfzusmke.sys
2636	CreateProcess.exe
5104	khczusmhez.exe
6068	CreateProcess.exe
3332	CreateProcess.exe
5748	i_khczusmhez.exe
6112	hezxrpjhez.sys
4136	CreateProcess.exe
920	hezwuomjhe.exe
6132	CreateProcess.exe
5284	CreateProcess.exe
4896	i_hezwuomjhe.exe
2972	rmjhezwuom.sys
5300	CreateProcess.exe
5476	ljgeywuomg.exe
5944	CreateProcess.exe
5624	CreateProcess.exe
1688	i_ljgeywuomg.exe
1324	ztrljgbztr.sys
4360	CreateProcess.exe
2840	rljgeywtom.exe
3504	CreateProcess.exe
5400	CreateProcess.exe
2548	i_rljgeywtom.exe
5640	vtnljdbvto.sys
424	CreateProcess.exe
1028	qolgdyvqoi.exe
5892	CreateProcess.exe
6124	CreateProcess.exe
1736	i_qolgdyvqoi.exe
4452	qlidaysqli.sys
4224	CreateProcess.exe
2696	kigaytnlid.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1599719646\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_942844913\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_692193668\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1468272336\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1468272336\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_942844913\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_692193668\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1468272336\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1468272336\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgeywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtolgebvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwuomjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaytnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoifdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoifdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtolgebvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlidavpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwuomjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaytnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqljdbvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljgbztrlgdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczusmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlidavpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxuspcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxuspcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeywuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgeywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqljdbvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeywuomg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6112	ipconfig.exe
1056	ipconfig.exe
3420	ipconfig.exe
5784	ipconfig.exe
864	ipconfig.exe
2808	ipconfig.exe
5096	ipconfig.exe
1056	ipconfig.exe
2452	ipconfig.exe
3248	ipconfig.exe
3420	ipconfig.exe
1944	ipconfig.exe
2768	ipconfig.exe
4652	ipconfig.exe
3100	ipconfig.exe
4152	ipconfig.exe
4244	ipconfig.exe
4512	ipconfig.exe
3436	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317034670102515"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{BB14CAC8-192E-4D6D-91B0-873CE977997C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe
3276	ytrljgbztrlgdbzt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	i_bwtolgebvt.exe
Token: SeDebugPrivilege	5708	i_ysqljdbvql.exe
Token: SeDebugPrivilege	4480	i_qnlidavpni.exe
Token: SeDebugPrivilege	4000	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	1468	i_nkfcxuspcz.exe
Token: SeDebugPrivilege	5748	i_khczusmhez.exe
Token: SeDebugPrivilege	4896	i_hezwuomjhe.exe
Token: SeDebugPrivilege	1688	i_ljgeywuomg.exe
Token: SeDebugPrivilege	2548	i_rljgeywtom.exe
Token: SeDebugPrivilege	1736	i_qolgdyvqoi.exe
Token: SeDebugPrivilege	4436	i_kigaytnlid.exe
Token: SeDebugPrivilege	6064	i_dxvpnkifax.exe
Token: SeDebugPrivilege	3980	i_nkfcausnkf.exe
Token: SeDebugPrivilege	2272	i_fcxupmhfzx.exe
Token: SeDebugPrivilege	5472	i_rpjhczurmk.exe
Token: SeDebugPrivilege	3516	i_bztrpjhecw.exe
Token: SeDebugPrivilege	2252	i_bzwrojhbzt.exe
Token: SeDebugPrivilege	5040	i_wqoigaytql.exe
Token: SeDebugPrivilege	1696	i_qoifdbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3276	4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4312 wrote to memory of 3000	4312	2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3000 wrote to memory of 6040	3000	iexplore.exe	92
PID 6040 wrote to memory of 2392	6040	msedge.exe	93
PID 6040 wrote to memory of 5988	6040	msedge.exe	94
PID 6040 wrote to memory of 5764	6040	msedge.exe	95
PID 6040 wrote to memory of 632	6040	msedge.exe	96
PID 6040 wrote to memory of 5764	6040	msedge.exe	95
PID 6040 wrote to memory of 5764	6040	msedge.exe	95
PID 6040 wrote to memory of 632	6040	msedge.exe	96
PID 6040 wrote to memory of 2332	6040	msedge.exe	99
PID 6040 wrote to memory of 2208	6040	msedge.exe	98
PID 6040 wrote to memory of 2332	6040	msedge.exe	99
PID 6040 wrote to memory of 2332	6040	msedge.exe	99
PID 6040 wrote to memory of 2208	6040	msedge.exe	98
PID 6040 wrote to memory of 2208	6040	msedge.exe	98
PID 6040 wrote to memory of 5824	6040	msedge.exe	100
PID 6040 wrote to memory of 5556	6040	msedge.exe	101
PID 6040 wrote to memory of 5824	6040	msedge.exe	100
PID 6040 wrote to memory of 5824	6040	msedge.exe	100
PID 6040 wrote to memory of 5556	6040	msedge.exe	101
PID 6040 wrote to memory of 5556	6040	msedge.exe	101
PID 6040 wrote to memory of 5660	6040	msedge.exe	103
PID 6040 wrote to memory of 5660	6040	msedge.exe	103
PID 6040 wrote to memory of 5792	6040	msedge.exe	106
PID 6040 wrote to memory of 3952	6040	msedge.exe	107
PID 6040 wrote to memory of 5792	6040	msedge.exe	106
PID 6040 wrote to memory of 3952	6040	msedge.exe	107
PID 3276 wrote to memory of 1152	3276	ytrljgbztrlgdbzt.exe	108
PID 1888 wrote to memory of 4448	1888	bwtolgebvt.exe	111
PID 6040 wrote to memory of 3516	6040	msedge.exe	115
PID 6040 wrote to memory of 2212	6040	msedge.exe	116
PID 6040 wrote to memory of 2212	6040	msedge.exe	116
PID 6040 wrote to memory of 4352	6040	msedge.exe	119
PID 6040 wrote to memory of 4352	6040	msedge.exe	119
PID 3276 wrote to memory of 1424	3276	ytrljgbztrlgdbzt.exe	120
PID 3276 wrote to memory of 2744	3276	ytrljgbztrlgdbzt.exe	124
PID 4400 wrote to memory of 1548	4400	ysqljdbvql.exe	126
PID 3276 wrote to memory of 4968	3276	ytrljgbztrlgdbzt.exe	129
PID 3276 wrote to memory of 5692	3276	ytrljgbztrlgdbzt.exe	133
PID 5928 wrote to memory of 1716	5928	qnlidavpni.exe	135
PID 3276 wrote to memory of 5696	3276	ytrljgbztrlgdbzt.exe	138
PID 3276 wrote to memory of 5828	3276	ytrljgbztrlgdbzt.exe	143
PID 4660 wrote to memory of 1276	4660	nhfaxsqkic.exe	145
PID 3276 wrote to memory of 4940	3276	ytrljgbztrlgdbzt.exe	148
PID 6040 wrote to memory of 3844	6040	msedge.exe	150
PID 6040 wrote to memory of 2256	6040	msedge.exe	151
PID 6040 wrote to memory of 2556	6040	msedge.exe	152
PID 3276 wrote to memory of 5708	3276	ytrljgbztrlgdbzt.exe	155
PID 6072 wrote to memory of 5240	6072	nkfcxuspcz.exe	157
PID 3276 wrote to memory of 4208	3276	ytrljgbztrlgdbzt.exe	160
PID 3276 wrote to memory of 2636	3276	ytrljgbztrlgdbzt.exe	164
PID 5104 wrote to memory of 6068	5104	khczusmhez.exe	166
PID 3276 wrote to memory of 3332	3276	ytrljgbztrlgdbzt.exe	169
PID 3276 wrote to memory of 4136	3276	ytrljgbztrlgdbzt.exe	173
PID 920 wrote to memory of 6132	920	hezwuomjhe.exe	175
PID 3276 wrote to memory of 5284	3276	ytrljgbztrlgdbzt.exe	178
PID 3276 wrote to memory of 5300	3276	ytrljgbztrlgdbzt.exe	182
PID 5476 wrote to memory of 5944	5476	ljgeywuomg.exe	184
PID 3276 wrote to memory of 5624	3276	ytrljgbztrlgdbzt.exe	187
PID 6040 wrote to memory of 1456	6040	msedge.exe	189
PID 6040 wrote to memory of 1456	6040	msedge.exe	189
PID 3276 wrote to memory of 4360	3276	ytrljgbztrlgdbzt.exe	195
PID 2840 wrote to memory of 3504	2840	rljgeywtom.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_54b2ea06616b2e1fadbd585028d8f06b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Temp\ytrljgbztrlgdbzt.exe
  C:\Temp\ytrljgbztrlgdbzt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtolgebvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1152
  - - C:\Temp\bwtolgebvt.exe
      C:\Temp\bwtolgebvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtolgebvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1424
  - - C:\Temp\i_bwtolgebvt.exe
      C:\Temp\i_bwtolgebvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqljdbvql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2744
  - - C:\Temp\ysqljdbvql.exe
      C:\Temp\ysqljdbvql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqljdbvql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4968
  - - C:\Temp\i_ysqljdbvql.exe
      C:\Temp\i_ysqljdbvql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlidavpni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\qnlidavpni.exe
      C:\Temp\qnlidavpni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlidavpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Temp\i_qnlidavpni.exe
      C:\Temp\i_qnlidavpni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\nhfaxsqkic.exe
      C:\Temp\nhfaxsqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\i_nhfaxsqkic.exe
      C:\Temp\i_nhfaxsqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxuspcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5708
  - - C:\Temp\nkfcxuspcz.exe
      C:\Temp\nkfcxuspcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxuspcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4208
  - - C:\Temp\i_nkfcxuspcz.exe
      C:\Temp\i_nkfcxuspcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczusmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2636
  - - C:\Temp\khczusmhez.exe
      C:\Temp\khczusmhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczusmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3332
  - - C:\Temp\i_khczusmhez.exe
      C:\Temp\i_khczusmhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwuomjhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\hezwuomjhe.exe
      C:\Temp\hezwuomjhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwuomjhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5284
  - - C:\Temp\i_hezwuomjhe.exe
      C:\Temp\i_hezwuomjhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgeywuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\ljgeywuomg.exe
      C:\Temp\ljgeywuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgeywuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5624
  - - C:\Temp\i_ljgeywuomg.exe
      C:\Temp\i_ljgeywuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljgeywtom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\rljgeywtom.exe
      C:\Temp\rljgeywtom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljgeywtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5400
  - - C:\Temp\i_rljgeywtom.exe
      C:\Temp\i_rljgeywtom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:424
  - - C:\Temp\qolgdyvqoi.exe
      C:\Temp\qolgdyvqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6124
  - - C:\Temp\i_qolgdyvqoi.exe
      C:\Temp\i_qolgdyvqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaytnlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4224
  - - C:\Temp\kigaytnlid.exe
      C:\Temp\kigaytnlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaytnlid.exe ups_ins
    3⤵
    PID:3436
  - - C:\Temp\i_kigaytnlid.exe
      C:\Temp\i_kigaytnlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnkifax.exe ups_run
    3⤵
    PID:5288
  - - C:\Temp\dxvpnkifax.exe
      C:\Temp\dxvpnkifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnkifax.exe ups_ins
    3⤵
    PID:5556
  - - C:\Temp\i_dxvpnkifax.exe
      C:\Temp\i_dxvpnkifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcausnkf.exe ups_run
    3⤵
    PID:3772
  - - C:\Temp\nkfcausnkf.exe
      C:\Temp\nkfcausnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcausnkf.exe ups_ins
    3⤵
    PID:1688
  - - C:\Temp\i_nkfcausnkf.exe
      C:\Temp\i_nkfcausnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxupmhfzx.exe ups_run
    3⤵
    PID:5768
  - - C:\Temp\fcxupmhfzx.exe
      C:\Temp\fcxupmhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxupmhfzx.exe ups_ins
    3⤵
    PID:4844
  - - C:\Temp\i_fcxupmhfzx.exe
      C:\Temp\i_fcxupmhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    PID:4592
  - - C:\Temp\rpjhczurmk.exe
      C:\Temp\rpjhczurmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    PID:4436
  - - C:\Temp\i_rpjhczurmk.exe
      C:\Temp\i_rpjhczurmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrpjhecw.exe ups_run
    3⤵
    PID:2256
  - - C:\Temp\bztrpjhecw.exe
      C:\Temp\bztrpjhecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrpjhecw.exe ups_ins
    3⤵
    PID:4348
  - - C:\Temp\i_bztrpjhecw.exe
      C:\Temp\i_bztrpjhecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwrojhbzt.exe ups_run
    3⤵
    PID:5940
  - - C:\Temp\bzwrojhbzt.exe
      C:\Temp\bzwrojhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwrojhbzt.exe ups_ins
    3⤵
    PID:2640
  - - C:\Temp\i_bzwrojhbzt.exe
      C:\Temp\i_bzwrojhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run
    3⤵
    PID:5572
  - - C:\Temp\wqoigaytql.exe
      C:\Temp\wqoigaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    PID:4812
  - - C:\Temp\i_wqoigaytql.exe
      C:\Temp\i_wqoigaytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoifdbvtnl.exe ups_run
    3⤵
    PID:3604
  - - C:\Temp\qoifdbvtnl.exe
      C:\Temp\qoifdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoifdbvtnl.exe ups_ins
    3⤵
    PID:3392
  - - C:\Temp\i_qoifdbvtnl.exe
      C:\Temp\i_qoifdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x268,0x374,0x7fffaadfc188,0x7fffaadfc194,0x7fffaadfc1a0
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,2192975227354265478,1156083628956081195,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:11
      4⤵
      System Time Discovery
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,3488965370691950935,18195377823422958198,262144 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,8580391006342249056,5480844887442991488,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,11250708001901483551,6158913788391552500,2097152 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,2552725112848201547,367756233529110481,2097152 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,10039693188190872092,14275579590465744482,2097152 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,11373999571952908234,5790030237213862704,2097152 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2808,i,1341515022260458338,11051912350097554617,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17360197191725854541,16987061484177479868,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3660994151976687798,9953553906607058984,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8968121747766261136,13973516017258045332,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8968121747766261136,13973516017258045332,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,2856546950114231673,5437664833547865371,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8481754234076799917,4460537876605783435,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,10366625689259176844,3423378436170467812,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,5597453017788747110,16361099009255635685,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,16413810495614103375,11036632314828135922,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,16832170185654860218,6685960522367089240,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,10534756812734903374,12270351471458171916,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,15638790115054517953,3415549697071634123,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,16924676559034876953,9435538484773478901,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6424,i,14985486880208039722,7152462964907427635,262144 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:10
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,9762395966073663438,4141501900350144961,524288 --field-trial-handle=2384,i,14086222813790812200,5420813429997461075,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:14
      4⤵
      PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1468

C:\Temp\ytrljgbztrlgdbzt.sys
C:\Temp\ytrljgbztrlgdbzt.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2256

C:\Temp\gbysqoigay.sys
C:\Temp\gbysqoigay.sys
1⤵
- Executes dropped EXE
PID:5036

C:\Temp\vsnligayvq.sys
C:\Temp\vsnligayvq.sys
1⤵
- Executes dropped EXE
PID:5732

C:\Temp\vsnkfdxnhf.sys
C:\Temp\vsnkfdxnhf.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\nkfcxvspki.sys
C:\Temp\nkfcxvspki.sys
1⤵
- Executes dropped EXE
PID:424

C:\Temp\pnhfzusmke.sys
C:\Temp\pnhfzusmke.sys
1⤵
- Executes dropped EXE
PID:5152

C:\Temp\hezxrpjhez.sys
C:\Temp\hezxrpjhez.sys
1⤵
- Executes dropped EXE
PID:6112

C:\Temp\rmjhezwuom.sys
C:\Temp\rmjhezwuom.sys
1⤵
- Executes dropped EXE
PID:2972

C:\Temp\ztrljgbztr.sys
C:\Temp\ztrljgbztr.sys
1⤵
- Executes dropped EXE
PID:1324

C:\Temp\vtnljdbvto.sys
C:\Temp\vtnljdbvto.sys
1⤵
- Executes dropped EXE
PID:5640

C:\Temp\qlidaysqli.sys
C:\Temp\qlidaysqli.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\kigaysqkig.sys
C:\Temp\kigaysqkig.sys
1⤵
PID:5224

C:\Temp\pnlfdxvpni.sys
C:\Temp\pnlfdxvpni.sys
1⤵
PID:2300

C:\Temp\kecxupnkec.sys
C:\Temp\kecxupnkec.sys
1⤵
PID:4380

C:\Temp\upmhecwupm.sys
C:\Temp\upmhecwupm.sys
1⤵
PID:2668

C:\Temp\pmhezxrpjh.sys
C:\Temp\pmhezxrpjh.sys
1⤵
PID:1852

C:\Temp\ebzwrojgey.sys
C:\Temp\ebzwrojgey.sys
1⤵
PID:1468

C:\Temp\yvtolgdbwt.sys
C:\Temp\yvtolgdbwt.sys
1⤵
PID:3404

C:\Temp\qnlidbvtql.sys
C:\Temp\qnlidbvtql.sys
1⤵
PID:1728

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtolgebvt.exe

Path C:\Temp\bwtolgebvt.exe
Size 376KB
SHA256 c43b07e73da769e11587dd81a72657fec103d45cd5f2d2913ce1a2f7778c3d51
MD5 b16a682bd39fcc8c0b51a77654bcc71d
SHA1 c05cf5becdf03ff13da8026d56f7790a97727c55
SHA512 c927bdb34c2d25db8af8e024abfb644fcfe696810f83ac2482ac6edc9d59de123942b0c853cd5f269ebf451374f870dece28eda037dce586e883996e6505970e
SSDEEP 3072:AjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbysqoigay.sys

Path C:\Temp\gbysqoigay.sys
Size 293KB
SHA256 4ed038dde1b7f9dccddb86ecf62b0c8f37c923101b8adf408ba4d62db198f49e
MD5 4410ba00218e2290cd3c7049f42c6971
SHA1 df7357109b3f4d243c15b61ea6635d61ea54c476
SHA512 e855754dd1bbff34b1cb84830c6dd9cd660a04e4a059c19e60bdadc173e25d982ea3cc18eda0dfd36bc9706385e41d9607295cf4a701e650b4067911bfc4d842
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtolgebvt.exe

Path C:\Temp\i_bwtolgebvt.exe
Size 376KB
SHA256 a667aa5eed2990653c1dcb227cde618fdb53ce5118cef55f39973c751c1251e2
MD5 09b68f5a3f0806d876bb49571538a4df
SHA1 831a201b73255c7a949ffbfea309e20d5e4157b7
SHA512 683a6cc9959106802ae716b6be7a4545e8072fbee16ee3490932aa7c1840aac0112d410615ce7b658bb01a3859dcdc784e90ec651df180dcc8628dee82410a8e
SSDEEP 3072:njyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfaxsqkic.exe

Path C:\Temp\i_nhfaxsqkic.exe
Size 376KB
SHA256 cbe941b581e416f98cf2a751d66d0a277ea9bf4b37de2d7a9f2d0a5867ac2c8e
MD5 9537adbb394d052064a15540312bd14e
SHA1 ad96c09542fe2e5886f9571b7787df5bfaec7c9f
SHA512 06951079179f5b3b8d8ac08e754880704f06dc8763cf546564a2cd5c4e5cd4296444c2b54f56f6bef091e31a9649d51db4c96e9aa0471a014f5a24bfd24d8a95
SSDEEP 3072:tjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12B847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxuspcz.exe

Path C:\Temp\i_nkfcxuspcz.exe
Size 376KB
SHA256 0c6e9ba9ebcd618b0f52431755e63ab9dc49b2ad133252cbf07c648259515e05
MD5 66207822b4f21914289b0cf2f242e718
SHA1 698651f78a649c5c92b43d132853d38fdac8fa99
SHA512 47d6f3343864147bf96ae473103a5f2708cc286a1486d56d90a91526a2fe5ce4a729081d7be1395c840e91225f743cc64a140a2e9dc23f241b3c1367aa67bfab
SSDEEP 3072:8jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlidavpni.exe

Path C:\Temp\i_qnlidavpni.exe
Size 376KB
SHA256 88812c856cd95ead0f74102a86d49ecdc46b3a67d782a0f1b7ef6e321559adce
MD5 6837047dcd2dfe5742c419ea619e4636
SHA1 4800e2e8e2d464c307f52707c92a964c0a4a39aa
SHA512 7c2d39d6e5593f0a39fdd178496b0079b369f68bfd7fcbe0ad0877d1f07bcbcd495dfe3de6928a7fccb1de7dc973be040bc46daaf9506f363c3a427d23622903
SSDEEP 3072:DjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C3847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqljdbvql.exe

Path C:\Temp\i_ysqljdbvql.exe
Size 376KB
SHA256 235be8b1ef44953f58c0af5751086cb2966aa2f0a630d458cdfe4fe42a0a1cf8
MD5 591b8832fb507f5b3f82ba76214fe2f9
SHA1 d497f5c8411f3fb4ca97f428b1ac5b3634d4c341
SHA512 2dda5397e4af1045abd6eb927d5ce0c080c7ec88195bbcd2cd4aee71097fa21410d0152f5311628e81b1701eeda4d520be423ae74669ad2bdd8fdda84ab36e32
SSDEEP 3072:gjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmhez.exe

Path C:\Temp\khczusmhez.exe
Size 376KB
SHA256 4a70898a8f0fcde0209a2c51e37c4fdb6c5bd315a7acb19a62a8c98c76aba4fd
MD5 1478cf4c36463f529f4a46dfcd671a7d
SHA1 bfc06294b905190e098a7ba419a5770015963824
SHA512 219484a09c48fccf5aa29c1ed5c1bb7560742d716903b4663ca33be7d25dc7a9ac20c8a5f5ed389a7242027748a56cac99bf402c4a7e6fd55cbb541b21dffe12
SSDEEP 3072:ajyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxsqkic.exe

Path C:\Temp\nhfaxsqkic.exe
Size 376KB
SHA256 078b5a0924875505dec4380d399af488f626f26fa0cd4a9e79f1775fed8184f6
MD5 301ec46c8804c710c4f3a2af14d0cd52
SHA1 451b0d86039d3d8f57913162b749f35ad7764fa8
SHA512 13eeae6a7f313bcdfa88940ae7ba49cce88248b1d685ba0f60f508e6240f37484ce63c51cbc6ae7b408f86e4fca92b72b52d55b804ce09526234d543a16aa37f
SSDEEP 3072:XjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxuspcz.exe

Path C:\Temp\nkfcxuspcz.exe
Size 376KB
SHA256 bbf1f391aaaf550192c35991439cfce0b149a15c83d54ee5b21a94a05c998b86
MD5 07c29ea345b8ae570698b6b677c6a5a5
SHA1 8099540522a2ebd507600ed15badc6bda2ab7c49
SHA512 542967dd2abbc83fb77b7fe053dd6858856fcdccb98d7b1cecc72b2bc245ab40b5ca6699c7824def6dd8bd593fb6348ebe9c2d3752e81598e23f05b0677b3975
SSDEEP 3072:NjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvspki.sys

Path C:\Temp\nkfcxvspki.sys
Size 293KB
SHA256 56a81a1895015b2f21ceba76d9e893fd6f8b8c0434b558a5dd6e2e5e6805bc3f
MD5 76a351859b2e46a6db60a0c8c753dc1e
SHA1 ae5f42cfd14294b90f858e0fffa31f7c1d8b0735
SHA512 e97a035a3d16b565c2403ae6f294d75cd6a514ff88c6db9faeafffaf74e85074916f8b84e69975fe2d75c73bd0b7c1415f9cf85419824dbda0fb68ec2649fb7f
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzusmke.sys

Path C:\Temp\pnhfzusmke.sys
Size 293KB
SHA256 f65319a831770db53dd02b51293d3d4b572299aeeb579de61b4b7effa5e8cf7c
MD5 360bde05e8393402a24ff2f6b45f6f7f
SHA1 f552d87187f597a627347d8c8ed761d8e6e1593b
SHA512 94aa051e1923bf0e676a50175136eec019888c9f4e2d5d571dabc9991115973edf2edc28771afa6794d3c9d490ab62784660fd344c7da4adb3bef0d7602d24cd
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlidavpni.exe

Path C:\Temp\qnlidavpni.exe
Size 376KB
SHA256 dc25def50157c74b65a07ef643df5703ef840e72da19aa1f1719a4c6c191d049
MD5 2097a168a6d25d1fa1b90183a5add280
SHA1 4346c7dced3e942604fa849a304022374fa16a4b
SHA512 7bc85f9890aa202427f057e258c469b55c9e622d47bd6f40935769de464c1a34123a5ee6f22b272e4605b42e8b0ad400329e91d5c50aca43e26ff1fb3c7e80c3
SSDEEP 3072:EjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ayLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxnhf.sys

Path C:\Temp\vsnkfdxnhf.sys
Size 293KB
SHA256 35ddbdf542be7f4c5d4d8cec16b5dbc9b57a09afe6d76943fc8ec7aff48a7f8f
MD5 9f48dae2715f07e6463209e2e3aa7710
SHA1 04a5ecfd0cfed3ff8f17f8d73b91c67124d5049a
SHA512 60b4e54fd85cb6565e12c56f74c91fdaff8ce42a97f54bcba2361bac4717d04ff0047e638cb96ee5a9d05d624208eba371e5d19c239824999f0b91abab0ea0dc
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T156545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnligayvq.sys

Path C:\Temp\vsnligayvq.sys
Size 293KB
SHA256 5559d097dd9c0844565e344fda580b964a4eddd47507ae14bbf4eb2ae66fb67a
MD5 8283641f94e1d640f8adb8c823631840
SHA1 da53b020787ae48ffddfa0fd2877eaa1b899b0a1
SHA512 7824e923d6608ddefae0b75640be167c3fa09ec44476a0a69647fc7c8562a37ca3960a723c82409ad6108bdf25008e3ffcba986de93c8557de7e9f3097400d6b
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqljdbvql.exe

Path C:\Temp\ysqljdbvql.exe
Size 376KB
SHA256 adef7afeeb242f0b7660b3db43083d56ad0e524996a7c3ca0ff903b4cdf98bd0
MD5 57dba22e8fafe917426c570c47a349ef
SHA1 0aa77f181429b63cbed834512ed579e6b8ef730f
SHA512 5f216d0e6b958fd519d3754f109a72970abec24c7fe79b2050d3f04772072b9697899c91456ca5149640a9f8541e58e0992db96d4d5b6bdf21f500b06a3828b8
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljgbztrlgdbzt.exe

Path C:\Temp\ytrljgbztrlgdbzt.exe
Size 376KB
SHA256 c3aeac44f3a693897c8bb41cdbb68aecb2bc339e480f0572ebe44a38f0fe8fa5
MD5 1a04fd6987865952a5dbbd59bad38eda
SHA1 b43da5a9ec9f9ad2de43957217839c401c985663
SHA512 b3fabba409526434c55ab8e4c121040b4be0dc3ce1fd10e63d7efdaabcfdf77309738c04fbf6bea68feb18c7cdcdac39753b2e3f4a9cb1ed40fca8b5ddb891ef
SSDEEP 3072:jjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljgbztrlgdbzt.sys

Path C:\Temp\ytrljgbztrlgdbzt.sys
Size 293KB
SHA256 2a85e86477d31233b266b59fc01970fb8670385f8e2d7b75c01a6bc8f2e26022
MD5 97c3f5caeadbaeba893f4bafa9b2ffb5
SHA1 ebb60cc22a26e1555250c69894e6d0b21dd42a16
SHA512 09a083c8e0d073fa66426e2927a3aa279292e917e9b5e7e9bb44b32f498585347d8e775d02bafeb11dcc6e1e7ba923779f4ad433e21226c01ea225430f3b8e74
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4f2d0e17ae2d508747a61a6c27ffdd1ba0f7524d07c988f41ef57fb7845e6f8e
MD5 85bb90445916275a1eaf765d81b1df5d
SHA1 4f98e10ecfaee5d1cd27bb79e68ebacefd48a264
SHA512 47864f22b8c911bc364eaad51d8425e98fede4454a3b7584a1ea7de8e8888253b4743451d5b94584e74abd78b26ef9c2b598dfd75d6bd7d893e5dcb67f7a2918
TLSH
T1A1519B5047729DDDCB6A8EFD53DC0D4772F8A43B06279F0B044A6E7819EA344570089F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c346.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c346.TMP
Size 2KB
SHA256 3109b7c72da36f3f5ef9131a3f733664efd904e9ab91d133d9ec16bdd89493fe
MD5 95eeb54fefce059a32f79fc3433760e7
SHA1 54a408f1f9fe6464b72482285a36224b9615999d
SHA512 f7dcf7500ef44f3775005056e034b81b0d3d1e9c580d650af18b6fc5bb7914848bbd709076d34400bb436164f1c7d76ee0fbfa66d0ebf3d714bfa878914f750f
TLSH
T101519B5047329DDDCB6A8EFD53EC0D4BB2F8A43B05279F0B044A6E7819EA344574089F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7a8f2691c349965252c8b7890458105e40ef4893974471b95ed94286d7157c74
MD5 302342ba250da088aff8f9542a821489
SHA1 b6a28237f33a1ed4643224c8cbb0bd11895a559e
SHA512 f7b39558f566e4e6a591bb720f0a0c1430803a2caffbe6768f4ffabbad803772ba93273651de0463a6368a55e1e3ab09ec8094b5704feb8c2a522f3b5a0f236b
TLSH
T1DC41BEF783F4956E8E0156F0AA146E1BCE2D0511432C7D5AC9E4AF2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

da045d91-889f-4ce9-88a1-616eeed69165.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\da045d91-889f-4ce9-88a1-616eeed69165.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 de2f9b91da1a4edaa95a042b2f835f14d1eb064054d1a8c337735e5681158d2e
MD5 640304aabc2f7047acaa18be4b035e21
SHA1 9850e87c2186d2284a9651b1fb77d5861830b487
SHA512 f6a1f79bbb58fa1b445dc5d007434b7e1b097a9f36c1405a3a70b61b26bb4fad1c39c25b8c195d6dae91ff3ffd1a9d50996b98305f04f8be71f702ccfd4c0737
SSDEEP 192:sxRBRgC2/f6FsZK7ZXXgrG9kzoA8p9c/g6+WNC8j/YZ7/qlusYGNIgVXJ:sxRBZ2/f6FsZK1XjFC/5l/PV9r
TLSH
T15742B7556E28A93B8CC7E61DBB557F53D2F96032A0D06E48ABFC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d1d2dafb1864505d55ae621f87128542b9c065c97a3cdc839ea4355eadc85829
MD5 712be2300ca93f0f40e81de34d2a71a9
SHA1 e842c8c134d747168b59e7536d5117263a908669
SHA512 ae656fbc1b7bcb82c1685eb2f3fce73d55225046f9990fe9e6fcb348c4a04439b201a390d6e09670c0e651edb731a338144a56b4775cc21ff66f56c5ad468d6f
SSDEEP 192:sxRyRgC2/f6FsXK7ZXXgrG9kzoA8p9c/g6+WNC8j/YZ7/qlusYGNIgDAwXJ:sxRyZ2/f6FsXK1XjFC/5l/PV9sE
TLSH
T1DD42B8596E28A93B8CC7E61DBB557F53D3F96032A0D06E48ABFC861C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7a47de941f7f683f186a51f814273bfeaf0d468ae75d55f4e6ad23a69d24ca5
MD5 e0ec4de64eb628284b7b603f35294b1c
SHA1 c0fac8951c6d1e9f2caf72dd44a918107e735697
SHA512 1f82470a98fca2f1bc8cdb62b64824696ec3336cb85a962723804c315f7535064bb58a0f6c969beae26d7076659c21789a7384c4cbcc8e704dd8e73ed80fc4e5
SSDEEP 192:sxRyRgC2/f6FsXI7ZXXgrG9kzoA8p9c/g6+WNC8j/YZ7/dl6sYGNIgDACXJ:sxRyZ2/f6FsXI1XjFC/5l/k59sS
TLSH
T10E42C9596928A93F9CC7E61DBB557F53E3F9603290D15E48ABFC8A1C00E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 da843e4f7a5521b5e3253fdec0bafef0bda48d6a99d5e2fa3560eb80edaba7c8
MD5 4d9853c44133a91d1e5aa256c403bd3d
SHA1 9c0690df49521a39766ea75e528de6332af42497
SHA512 2c4e2e9d2735a33d52685c347234297af8ade27b48a079d573b49f3b6694d77793236dcc9e93adf3c1d48d8080a81504065e48c76669cf60043c57841450b1bb
SSDEEP 768:ky2SfS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhKuSV4vrob+h:ky2SfqE7evWgd5f/bu1jaSKuU48Kh
TLSH
T101D2D97B640CCB7F4F804ADDA8197F9E6DA802CB9698C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22bfc18b-ff58-4b36-a148-0135ffedbb77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\22bfc18b-ff58-4b36-a148-0135ffedbb77.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fcd62037cb345e27b83833c34c816fafef66f9c5539313a44bac4422b82fa57c
MD5 afe6afc6981282ca43c7ed126a5c6cbd
SHA1 9dd4afe66f68ea36b97b3165e612f3f4ac6d8009
SHA512 be47d796bd593a1793fa92c467cd2eb446eda0f60c6cccbb7af86302e4ae1232fdf959ea52ed0d3d8a481d813551f0129fcd47aea3c171c03ce16cb5402ee111
SSDEEP 768:oFQP3qwgd86KLfLYAam6aQMGdjWca4Ghf90X6:LP3WTmaME6p0q
TLSH
T1480317F198D78937D8AE5783A73D6E46A9BCD163B4888884FBD45D0CCD821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cbe90326100346daa31e7a5235f61e0507af0b828422a5170a47edd0e3427533
MD5 2704a4e88820b0c5199964b0306bfb87
SHA1 897204fa412153e5d5ebe28f3eca4237257c26ec
SHA512 57dfc242f5d0999ff18d7b7b038a5a8ded82165e70ee6b9ce0d4b54e38a47b6c72b32e6da28054a6197d33f1258036ab0518445c4fef1d6d2d3584f44475d6da
SSDEEP 768:/rv+4UNbdq3W8qgL2AAam6aQMGdjWca4GhfBbPeU/:/bsbc32KmaME6pjH
TLSH
T129F2AE31A86C9573DDB79A99F21B6787BFF021A388D40E84D9D95B0D839708E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d34abf2853e48d02fcc0dbc10a738d197d927f8949e872d018f3f8e16ec2ae78
MD5 a3af2276e31f20c8106eb1d53ee53898
SHA1 3ba828876ca60d706f9a2bb9a00883b854c345e3
SHA512 dde1bf32282155c3277a56aa4a8213c60f4c82ae06fd650faa858595cb04b252988cf2e663217edae8b7d0428332bf48dc39f4dbaca5e67a72af4f8ccb25e5bc
SSDEEP 768:Irv+4UNbdu3d12qgLfLIBAam6aQMGdjWca4Ghf90m+:Ibsbg3dTDmaME6p0d
TLSH
T14DF2AF31A86CD9339DB7A695F21B6787BFB021A388C44E84D9D95F0D02C758E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 85a643144bc1aab320b2b74b432fbb24c0935334fbdab08a12395d6d15ef0d54
MD5 2d2722c79326dae16846229c169210cb
SHA1 70aa9e9fce4123f0c95d41c0546eddce4d4606e5
SHA512 d17490efff11abf6160c59a20fcded523a7a216dfe058c609274b17f13eb03fdea1adb47e865a20a9485ec762ebd2c1398c71e9eed952c39a0089f2081b3da7c
SSDEEP 768:Ix3dL2qgLfLIEAam6aQMGdjWca4Ghf90X6:Ix3dZmmaME6p0q
TLSH
T17DE29E7158A9D8739CA7A695F72A2787FEF0217388D84E84D9D99F0D028358E2707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 72603f76a3b3e4b1372c09ef2066946c91277e71bbcfc44b4041d9ed465283ef
MD5 b73a80fd76aa8d6a48a88f74c67ec3cd
SHA1 86f4329c44c412a5f85535225110c17d8f16a40a
SHA512 a66de768ca273021c8636fa31a24b45292bf08c6b4c8dceee4b230c855fcc2205b6d749cab889fe1ba5bad08b538c5ddb102b5e1203f15bced4850083547a14e
SSDEEP 768:Px3Qp2qgLfLIEAam6aQMGdjWca4Ghf90X6:Px3QXmmaME6p0q
TLSH
T111E29E715CA9D8339CA7A695F72A2787FEF0217388D84E84D9D99F0D028358E2707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 340cd90904a696e471cba8a3296c17fca250c836b043c63215ced45697a44c4a
MD5 f283e422e59113d21fe33efc997623cb
SHA1 a0ee64ca8f4e587106fa5d0a951e9f87e83e783a
SHA512 f38d8944357e1cc0cb986275a57e18ef1ac282698066861f2b91164dccd1e76fe54dc395007972936ed4ce78ec62fe56c488c6e8d7ccf629b00c9ff3182d674e
SSDEEP 768:/rv+4UNbdq33IqgLfLI0Aam6aQMGdjWca4Ghfw0PeU/:/bsbc3XWmaME6p3H
TLSH
T153F2BE31A86CD9339CB7A695F21B6787BEB021B388C44E84D9D96F0D429748E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

70b33980-f205-4826-9cdd-5a48477b1bda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\70b33980-f205-4826-9cdd-5a48477b1bda.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6040_1274811569\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5bb944c0241248f1b4d33057cbc2e3bb39a803a70ae020cff4405ad764b60386
MD5 721fae9cdb30c1a67ba836a4c4167874
SHA1 0fe354e079b956dabb31cbed831f790e63effa27
SHA512 f1dd5673f83ca4e1a5d9d286d38a4520c488f003f78b83ce337bb200a4b27e728f8a18e363ddd23cd726e7de7bfb288b20f9b881bd0d5c241df7543177b512cb
TLSH
T1D971238367E9D9F3C1DA9BF012835644F6FB2278072330200B925986AB30A3A14BDF08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1252-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1324-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1468-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1728-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1852-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1852-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2300-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2668-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3040-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4380-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5640-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5732-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6112-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download