systex | 1536fa43b9b520ae01ed44255cae981dbd02c3f977cccf2b7e1d606c53320d18

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261001-mfnfbas17n
SHA256 1536fa43b9b520ae01ed44255cae981dbd02c3f977cccf2b7e1d606c53320d18
MD5 8e7a9a61ba1d3a36732d5e3a1273b5d4
SHA1 6c7d28aeb6cbb28cc1aaf66b90f0e0971773d0b0
SHA512 a38181b0a551423dd93b11c7fd8dc5c02eb8fa7d28d0215df89aabdff824fe9d3b5fc7ff2f83affff59b5377da8025f8b08f59a2f54b63bcb1fba593d685a3b8
SSDEEP 3072:5jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1596	ztrljebwuomgbztr.exe
5156	ztrljebwuomgbztr.sys
3924	CreateProcess.exe
2936	olgebwtogb.exe
4540	CreateProcess.exe
5584	CreateProcess.exe
4952	i_olgebwtogb.exe
2796	geywqolgey.sys
5180	CreateProcess.exe
1800	gbytroigby.exe
1172	CreateProcess.exe
4276	CreateProcess.exe
5212	i_gbytroigby.exe
4212	tqoigayvtq.sys
3064	CreateProcess.exe
2852	vqoigaysql.exe
2100	CreateProcess.exe
2908	CreateProcess.exe
4660	i_vqoigaysql.exe
5288	vqnlidavtn.sys
2212	CreateProcess.exe
1200	nifaysqkic.exe
3808	CreateProcess.exe
2844	CreateProcess.exe
668	i_nifaysqkic.exe
5348	lidavsqkif.sys
4712	CreateProcess.exe
4152	zxvpnkfdxv.exe
4948	CreateProcess.exe
928	CreateProcess.exe
1916	i_zxvpnkfdxv.exe
1516	fcxusqkicx.sys
6020	CreateProcess.exe
700	cavpnhfzxs.exe
1500	CreateProcess.exe
2556	CreateProcess.exe
2904	i_cavpnhfzxs.exe
2968	xsmkhcausm.sys
4508	CreateProcess.exe
1064	wusmkhczxr.exe
1972	CreateProcess.exe
3672	CreateProcess.exe
3380	i_wusmkhczxr.exe
2516	zxrpmheczu.sys
5376	CreateProcess.exe
1636	xromhezwrp.exe
6048	CreateProcess.exe
1124	CreateProcess.exe
5060	i_xromhezwrp.exe
6008	ezwrojhbzt.sys
1676	CreateProcess.exe
4660	zwqojgeywr.exe
2848	CreateProcess.exe
2688	CreateProcess.exe
4940	i_zwqojgeywr.exe
5364	eywqojgeyw.sys
2652	CreateProcess.exe
2516	bwtrljhbyt.exe
1964	CreateProcess.exe
1892	CreateProcess.exe
1104	i_bwtrljhbyt.exe
4864	igbytrliga.sys
2504	CreateProcess.exe
2444	ligbytqljd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_2002040964\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_168629194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_791995239\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1036390108\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_168629194\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_791995239\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1036390108\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1036390108\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1036390108\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljhbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljhbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgebwtogb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytroigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqoifday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkifaxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojheywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytroigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsmkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwuomgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjebwtrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjebwtrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqojgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkifaxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgebwtogb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqojgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqoifday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsmkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkhcwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkhcwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojheywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1920	ipconfig.exe
692	ipconfig.exe
3080	ipconfig.exe
4744	ipconfig.exe
1064	ipconfig.exe
4100	ipconfig.exe
5044	ipconfig.exe
3100	ipconfig.exe
3296	ipconfig.exe
3916	ipconfig.exe
5744	ipconfig.exe
5464	ipconfig.exe
4824	ipconfig.exe
4460	ipconfig.exe
3256	ipconfig.exe
2060	ipconfig.exe
2780	ipconfig.exe
1676	ipconfig.exe
2796	ipconfig.exe
1232	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{CF545BDD-BBC1-4127-94F5-E88ED2A22033}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1596	ztrljebwuomgbztr.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1596	ztrljebwuomgbztr.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1596	ztrljebwuomgbztr.exe
1596	ztrljebwuomgbztr.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1596	ztrljebwuomgbztr.exe
1596	ztrljebwuomgbztr.exe
1596	ztrljebwuomgbztr.exe
1596	ztrljebwuomgbztr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	i_olgebwtogb.exe
Token: SeDebugPrivilege	5212	i_gbytroigby.exe
Token: SeDebugPrivilege	4660	i_vqoigaysql.exe
Token: SeDebugPrivilege	668	i_nifaysqkic.exe
Token: SeDebugPrivilege	1916	i_zxvpnkfdxv.exe
Token: SeDebugPrivilege	2904	i_cavpnhfzxs.exe
Token: SeDebugPrivilege	3380	i_wusmkhczxr.exe
Token: SeDebugPrivilege	5060	i_xromhezwrp.exe
Token: SeDebugPrivilege	4940	i_zwqojgeywr.exe
Token: SeDebugPrivilege	1104	i_bwtrljhbyt.exe
Token: SeDebugPrivilege	4952	i_ligbytqljd.exe
Token: SeDebugPrivilege	4692	i_ayvqoifday.exe
Token: SeDebugPrivilege	5704	i_qnicaysqki.exe
Token: SeDebugPrivilege	1036	i_snkifaxvsn.exe
Token: SeDebugPrivilege	3916	i_axsmkecaus.exe
Token: SeDebugPrivilege	3172	i_urmkhcwurm.exe
Token: SeDebugPrivilege	1232	i_rpjebwtrmj.exe
Token: SeDebugPrivilege	4352	i_wrojheywqo.exe
Token: SeDebugPrivilege	4148	i_romgeywqoj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1596	3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3368 wrote to memory of 4524	3368	2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4524 wrote to memory of 5392	4524	iexplore.exe	91
PID 5392 wrote to memory of 6116	5392	msedge.exe	92
PID 5392 wrote to memory of 1728	5392	msedge.exe	94
PID 5392 wrote to memory of 6140	5392	msedge.exe	95
PID 5392 wrote to memory of 1728	5392	msedge.exe	94
PID 5392 wrote to memory of 1728	5392	msedge.exe	94
PID 5392 wrote to memory of 5396	5392	msedge.exe	96
PID 5392 wrote to memory of 5396	5392	msedge.exe	96
PID 5392 wrote to memory of 5712	5392	msedge.exe	98
PID 5392 wrote to memory of 1224	5392	msedge.exe	97
PID 5392 wrote to memory of 5712	5392	msedge.exe	98
PID 5392 wrote to memory of 5712	5392	msedge.exe	98
PID 5392 wrote to memory of 1224	5392	msedge.exe	97
PID 5392 wrote to memory of 1224	5392	msedge.exe	97
PID 5392 wrote to memory of 5664	5392	msedge.exe	99
PID 5392 wrote to memory of 2460	5392	msedge.exe	100
PID 5392 wrote to memory of 5664	5392	msedge.exe	99
PID 5392 wrote to memory of 5664	5392	msedge.exe	99
PID 5392 wrote to memory of 2460	5392	msedge.exe	100
PID 5392 wrote to memory of 2460	5392	msedge.exe	100
PID 5392 wrote to memory of 5908	5392	msedge.exe	101
PID 5392 wrote to memory of 5908	5392	msedge.exe	101
PID 5392 wrote to memory of 1392	5392	msedge.exe	106
PID 5392 wrote to memory of 2064	5392	msedge.exe	105
PID 5392 wrote to memory of 1392	5392	msedge.exe	106
PID 5392 wrote to memory of 2064	5392	msedge.exe	105
PID 5392 wrote to memory of 6136	5392	msedge.exe	108
PID 1596 wrote to memory of 3924	1596	ztrljebwuomgbztr.exe	110
PID 2936 wrote to memory of 4540	2936	olgebwtogb.exe	114
PID 5392 wrote to memory of 5356	5392	msedge.exe	117
PID 5392 wrote to memory of 5356	5392	msedge.exe	117
PID 5392 wrote to memory of 4292	5392	msedge.exe	118
PID 5392 wrote to memory of 4292	5392	msedge.exe	118
PID 1596 wrote to memory of 5584	1596	ztrljebwuomgbztr.exe	119
PID 1596 wrote to memory of 5180	1596	ztrljebwuomgbztr.exe	123
PID 1800 wrote to memory of 1172	1800	gbytroigby.exe	125
PID 1596 wrote to memory of 4276	1596	ztrljebwuomgbztr.exe	128
PID 1596 wrote to memory of 3064	1596	ztrljebwuomgbztr.exe	132
PID 2852 wrote to memory of 2100	2852	vqoigaysql.exe	134
PID 1596 wrote to memory of 2908	1596	ztrljebwuomgbztr.exe	137
PID 1596 wrote to memory of 2212	1596	ztrljebwuomgbztr.exe	142
PID 1200 wrote to memory of 3808	1200	nifaysqkic.exe	144
PID 1596 wrote to memory of 2844	1596	ztrljebwuomgbztr.exe	147
PID 5392 wrote to memory of 2552	5392	msedge.exe	149
PID 5392 wrote to memory of 2832	5392	msedge.exe	150
PID 5392 wrote to memory of 6108	5392	msedge.exe	151
PID 1596 wrote to memory of 4712	1596	ztrljebwuomgbztr.exe	154
PID 4152 wrote to memory of 4948	4152	zxvpnkfdxv.exe	156
PID 1596 wrote to memory of 928	1596	ztrljebwuomgbztr.exe	159
PID 1596 wrote to memory of 6020	1596	ztrljebwuomgbztr.exe	163
PID 700 wrote to memory of 1500	700	cavpnhfzxs.exe	165
PID 1596 wrote to memory of 2556	1596	ztrljebwuomgbztr.exe	168
PID 1596 wrote to memory of 4508	1596	ztrljebwuomgbztr.exe	172
PID 1064 wrote to memory of 1972	1064	wusmkhczxr.exe	174
PID 1596 wrote to memory of 3672	1596	ztrljebwuomgbztr.exe	177
PID 1596 wrote to memory of 5376	1596	ztrljebwuomgbztr.exe	181
PID 1636 wrote to memory of 6048	1636	xromhezwrp.exe	183
PID 1596 wrote to memory of 1124	1596	ztrljebwuomgbztr.exe	186
PID 5392 wrote to memory of 2776	5392	msedge.exe	188
PID 5392 wrote to memory of 2776	5392	msedge.exe	188
PID 1596 wrote to memory of 1676	1596	ztrljebwuomgbztr.exe	194
PID 4660 wrote to memory of 2848	4660	zwqojgeywr.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_8e7a9a61ba1d3a36732d5e3a1273b5d4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Temp\ztrljebwuomgbztr.exe
  C:\Temp\ztrljebwuomgbztr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgebwtogb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3924
  - - C:\Temp\olgebwtogb.exe
      C:\Temp\olgebwtogb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgebwtogb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\i_olgebwtogb.exe
      C:\Temp\i_olgebwtogb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytroigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Temp\gbytroigby.exe
      C:\Temp\gbytroigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytroigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4276
  - - C:\Temp\i_gbytroigby.exe
      C:\Temp\i_gbytroigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Temp\vqoigaysql.exe
      C:\Temp\vqoigaysql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2908
  - - C:\Temp\i_vqoigaysql.exe
      C:\Temp\i_vqoigaysql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2212
  - - C:\Temp\nifaysqkic.exe
      C:\Temp\nifaysqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2844
  - - C:\Temp\i_nifaysqkic.exe
      C:\Temp\i_nifaysqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\zxvpnkfdxv.exe
      C:\Temp\zxvpnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:928
  - - C:\Temp\i_zxvpnkfdxv.exe
      C:\Temp\i_zxvpnkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6020
  - - C:\Temp\cavpnhfzxs.exe
      C:\Temp\cavpnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2556
  - - C:\Temp\i_cavpnhfzxs.exe
      C:\Temp\i_cavpnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wusmkhczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4508
  - - C:\Temp\wusmkhczxr.exe
      C:\Temp\wusmkhczxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wusmkhczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3672
  - - C:\Temp\i_wusmkhczxr.exe
      C:\Temp\i_wusmkhczxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xromhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5376
  - - C:\Temp\xromhezwrp.exe
      C:\Temp\xromhezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xromhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1124
  - - C:\Temp\i_xromhezwrp.exe
      C:\Temp\i_xromhezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqojgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1676
  - - C:\Temp\zwqojgeywr.exe
      C:\Temp\zwqojgeywr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqojgeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\i_zwqojgeywr.exe
      C:\Temp\i_zwqojgeywr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljhbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2652
  - - C:\Temp\bwtrljhbyt.exe
      C:\Temp\bwtrljhbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrljhbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1892
  - - C:\Temp\i_bwtrljhbyt.exe
      C:\Temp\i_bwtrljhbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligbytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2504
  - - C:\Temp\ligbytqljd.exe
      C:\Temp\ligbytqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligbytqljd.exe ups_ins
    3⤵
    PID:5836
  - - C:\Temp\i_ligbytqljd.exe
      C:\Temp\i_ligbytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqoifday.exe ups_run
    3⤵
    PID:4136
  - - C:\Temp\ayvqoifday.exe
      C:\Temp\ayvqoifday.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqoifday.exe ups_ins
    3⤵
    PID:4224
  - - C:\Temp\i_ayvqoifday.exe
      C:\Temp\i_ayvqoifday.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnicaysqki.exe ups_run
    3⤵
    PID:4864
  - - C:\Temp\qnicaysqki.exe
      C:\Temp\qnicaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnicaysqki.exe ups_ins
    3⤵
    PID:1920
  - - C:\Temp\i_qnicaysqki.exe
      C:\Temp\i_qnicaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkifaxvsn.exe ups_run
    3⤵
    PID:4280
  - - C:\Temp\snkifaxvsn.exe
      C:\Temp\snkifaxvsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkifaxvsn.exe ups_ins
    3⤵
    PID:1108
  - - C:\Temp\i_snkifaxvsn.exe
      C:\Temp\i_snkifaxvsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsmkecaus.exe ups_run
    3⤵
    PID:4180
  - - C:\Temp\axsmkecaus.exe
      C:\Temp\axsmkecaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsmkecaus.exe ups_ins
    3⤵
    PID:1520
  - - C:\Temp\i_axsmkecaus.exe
      C:\Temp\i_axsmkecaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkhcwurm.exe ups_run
    3⤵
    PID:1560
  - - C:\Temp\urmkhcwurm.exe
      C:\Temp\urmkhcwurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkhcwurm.exe ups_ins
    3⤵
    PID:1576
  - - C:\Temp\i_urmkhcwurm.exe
      C:\Temp\i_urmkhcwurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjebwtrmj.exe ups_run
    3⤵
    PID:5640
  - - C:\Temp\rpjebwtrmj.exe
      C:\Temp\rpjebwtrmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjebwtrmj.exe ups_ins
    3⤵
    PID:4952
  - - C:\Temp\i_rpjebwtrmj.exe
      C:\Temp\i_rpjebwtrmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojheywqo.exe ups_run
    3⤵
    PID:5828
  - - C:\Temp\wrojheywqo.exe
      C:\Temp\wrojheywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojheywqo.exe ups_ins
    3⤵
    PID:2376
  - - C:\Temp\i_wrojheywqo.exe
      C:\Temp\i_wrojheywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgeywqoj.exe ups_run
    3⤵
    PID:4456
  - - C:\Temp\romgeywqoj.exe
      C:\Temp\romgeywqoj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgeywqoj.exe ups_ins
    3⤵
    PID:5088
  - - C:\Temp\i_romgeywqoj.exe
      C:\Temp\i_romgeywqoj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoigaytql.exe ups_run
    3⤵
    PID:2472
  - - C:\Temp\vqoigaytql.exe
      C:\Temp\vqoigaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5464
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff95f98c188,0x7ff95f98c194,0x7ff95f98c1a0
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,2099249079789418865,16253040388557484645,262144 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:2
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,14453298307202990119,3886936786367423594,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:11
      4⤵
      System Time Discovery
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,15199551583845261834,5959204729357826196,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,8075674205724682460,8799798847558357627,2097152 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,11644113723894704635,3865531989204924544,2097152 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,3668941620126557006,15117275326419472418,2097152 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6161231172397400801,1304869479069451644,2097152 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14558290984989994384,8988261189500610992,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11480548490460770768,7992256223686352766,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14669006101026250822,3730693100316972031,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13284825993401655313,4525687214385240125,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13284825993401655313,4525687214385240125,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,1199409997457467762,1800203566868891902,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,14950615696432679553,15214688570377628470,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,10289623271976825060,14811045767352698200,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,10103711775793739549,7903142620327438606,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,2090585488619543144,6320039514305788393,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,11131399176803260219,9197838442767475451,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,12138729991270925317,7317203172141817994,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,12994647845430123914,1597386820647515351,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,9902739375422288417,1505243108626440745,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,3063325558062525703,17091623671184080781,262144 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:10
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,13491282701456421420,8599460684623333833,524288 --field-trial-handle=2812,i,12241808300550099051,6938033437323359735,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2868

C:\Temp\ztrljebwuomgbztr.sys
C:\Temp\ztrljebwuomgbztr.sys
1⤵
- Executes dropped EXE
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2552

C:\Temp\geywqolgey.sys
C:\Temp\geywqolgey.sys
1⤵
- Executes dropped EXE
PID:2796

C:\Temp\tqoigayvtq.sys
C:\Temp\tqoigayvtq.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\vqnlidavtn.sys
C:\Temp\vqnlidavtn.sys
1⤵
- Executes dropped EXE
PID:5288

C:\Temp\lidavsqkif.sys
C:\Temp\lidavsqkif.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\fcxusqkicx.sys
C:\Temp\fcxusqkicx.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Temp\xsmkhcausm.sys
C:\Temp\xsmkhcausm.sys
1⤵
- Executes dropped EXE
PID:2968

C:\Temp\zxrpmheczu.sys
C:\Temp\zxrpmheczu.sys
1⤵
- Executes dropped EXE
PID:2516

C:\Temp\ezwrojhbzt.sys
C:\Temp\ezwrojhbzt.sys
1⤵
- Executes dropped EXE
PID:6008

C:\Temp\eywqojgeyw.sys
C:\Temp\eywqojgeyw.sys
1⤵
- Executes dropped EXE
PID:5364

C:\Temp\igbytrliga.sys
C:\Temp\igbytrliga.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\gdyvqnlfdy.sys
C:\Temp\gdyvqnlfdy.sys
1⤵
PID:2136

C:\Temp\yvqnifaysq.sys
C:\Temp\yvqnifaysq.sys
1⤵
PID:4400

C:\Temp\sqkicavsnk.sys
C:\Temp\sqkicavsnk.sys
1⤵
PID:2264

C:\Temp\uspnhfzxsp.sys
C:\Temp\uspnhfzxsp.sys
1⤵
PID:4624

C:\Temp\urmjhczusm.sys
C:\Temp\urmjhczusm.sys
1⤵
PID:348

C:\Temp\wuomkhezwu.sys
C:\Temp\wuomkhezwu.sys
1⤵
PID:5980

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:1824

C:\Temp\rljgeywtro.sys
C:\Temp\rljgeywtro.sys
1⤵
PID:3904

C:\Temp\dbvtndyvtn.sys
C:\Temp\dbvtndyvtn.sys
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cavpnhfzxs.exe

Path C:\Temp\cavpnhfzxs.exe
Size 376KB
SHA256 c3a894f464c2ee6cb66a20f6cd5e47d8c1e8fd1e23457305f95c04295bd27824
MD5 90c7ad3a8db54ddf328e18309f6410ad
SHA1 f48e3618244ba1aa781e7be78c602476a1fba76e
SHA512 f303f441d161e46845705f75272c5de0fb27b5710b8b395d7ca71a0add9f65e94e7fcabefd575fbeb858e9002f9dcb35a39abb60e5d2ea0f3d2b8bb3f9e57514
SSDEEP 3072:/jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:byLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusqkicx.sys

Path C:\Temp\fcxusqkicx.sys
Size 293KB
SHA256 6ead3e1cb0f574090dc236fbf1c45837d152d33665bfebe2d3b06afec3f7569e
MD5 e811388a64882ac75b7577f090ae8fa1
SHA1 83fdea2a544d63bdc6e39dc0cae7069a72472af9
SHA512 6faa469fb4adccbebd99ead0a7be57d507da76e9b6b50aa85a768d58704f1421c73afc1a9b4be1483219809e3fa6e41dbdb2a892701bfd1caa44d76e2df6fb11
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytroigby.exe

Path C:\Temp\gbytroigby.exe
Size 376KB
SHA256 c5310211bb2f8e529bfc46e796a9303f81800860ea3504da0f3edd4b98bbd1ac
MD5 f6bb45a2b2d1240258194c133b41aa45
SHA1 b9f22012e23351040921844dba7c3d43ce479a8d
SHA512 3cad866d181653539410a6c6759366cd95616cdb5b793444c56d35d148a5e64b7a9a39fd18a68b5f20bc52f4079536fcc723c54b7026b89a3f71b8e6fdee36e9
SSDEEP 3072:GjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqolgey.sys

Path C:\Temp\geywqolgey.sys
Size 293KB
SHA256 28b5935c1ab4e15ea8d9bd5322f423020a96a2a39bb95ab49ad2f4e36f1a8ad2
MD5 9d9f18e6ace5de379b5bfbbdde363950
SHA1 8cefa9c2a472713be93eee378ec73dd9cd469729
SHA512 9ba1ca7d8d764607fc2b1a413fbc39ee3c0ec008b15d7d76fb713f4073f5029c7b75a24f37864c642eead5d07ce5150b5b05ae9063a22dad8197a64bcb8d3c9b
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cavpnhfzxs.exe

Path C:\Temp\i_cavpnhfzxs.exe
Size 376KB
SHA256 c27c3309b5374b2f48e8c8f95159ff518315ded1e1441b9ee2a3b1b9e5c8e570
MD5 d142dba21ccff51936f3ce1e2d7ba063
SHA1 aca9778d74346129920cefdb00c3e640e22c40a2
SHA512 f0134e92202d3c018ddbd992d2fe8f634d4e4ef8d156537d822fd582cff876adf33f8ac14d4a80a1290086c581fe71a4b6a70282b8f5091c09303ea128c17706
SSDEEP 3072:xjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytroigby.exe

Path C:\Temp\i_gbytroigby.exe
Size 376KB
SHA256 90a4df13a5a733cb8b74609e48243e295162ffcb239f62f4c758a3271457ebe7
MD5 61112f7a583b6fa5990d5e210feb7bea
SHA1 d929b2b5e6ee6a6c423389165ffd964a724aa859
SHA512 44b5864864c86d708cab9c8f3e36ebb81ad956f3ebf28c7f403a30d25feabdbf5765b3177de96a7021d6e122b6a703ffd964c4aeae660c02432bcf612de906d2
SSDEEP 3072:ejyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaysqkic.exe

Path C:\Temp\i_nifaysqkic.exe
Size 376KB
SHA256 febd74c44b06fdc0fcb14aab985d2dbfdfd788e653decb1a4d313dbacfe5545f
MD5 c2783aede12ae0a686adb5c9633a59f1
SHA1 8616500b14ad2f914438ab1d4eb0b0e80a172873
SHA512 6631e84cc3bdc4141ede20fe46821cc3ea79d539998689714dd84de517ceaed09a2fdeb40914a74ad8365112016f7bd28d33d18d383260a8e0e453d8fb0a2015
SSDEEP 3072:pjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgebwtogb.exe

Path C:\Temp\i_olgebwtogb.exe
Size 376KB
SHA256 80dba938dfe3450f059869f77a7243427dc08d1bfed50a397489ddcfddaf8443
MD5 40d95a64edd61ed33d354211994791d5
SHA1 78a60b6d745ad4ea5a06cbdf0d2514f42bea072c
SHA512 09a0625ed9d42c708eb0855ae14c1251864d03e2c02121dc53ff80035d0d77268f4f30b76c7f9c63dfe5afb4daa144ce0d68dcaa46bcc4a0a38617beab3f0a09
SSDEEP 3072:rjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigaysql.exe

Path C:\Temp\i_vqoigaysql.exe
Size 376KB
SHA256 b259fabe75098ff63ccb9983bb3991dbf6f29c6afbccdbe6283654aafc329fa5
MD5 4e877a76dd1ae3d6bdf7f0a791f5462e
SHA1 fb0e15639a4c6445672965751a63dd4bcbc026ce
SHA512 a34fdcfa8367501e403125c2833b37b10f334d33dcf37db4631c4deaf764283004b466c6c27bffd0f989208103e7ca18b9575177ac7c16716f47be7c6f69ab0a
SSDEEP 3072:ijyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpnkfdxv.exe

Path C:\Temp\i_zxvpnkfdxv.exe
Size 376KB
SHA256 e0d6b489b3599051ddeb6597618cf4457aadf95d3ff18a3cd9e202c8cf78e3fc
MD5 57b118ff802ef5982d197a1aa4473ec7
SHA1 3113a803e01a20ec257fc0094d4ee7a743dbe50d
SHA512 29d00166c39533585c8a4d5b8a8603ce0649f75f145662395a75bbac325a7d57bd58454768da1964dfbbfec049ae014daf378ae97ea9ddee8888f65e121088fe
SSDEEP 3072:hjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavsqkif.sys

Path C:\Temp\lidavsqkif.sys
Size 293KB
SHA256 f5abb7f900c3483d658a1eac9d17cd9aa24020c903304932d3b58282abe04362
MD5 8aa9d22a8cc9853a4ed8d097d863938f
SHA1 623ad27cfd26cfd46dd4118c72c56343b8bd1cef
SHA512 fc051f5fed36db953e1d7ea4aa8a63e360508a0d10462f934b254587aa829a556f0d4c4d8b8f37ae4b00035c6007c55f3127fa654ad024b2b9a9f4b15cb7b57d
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T10A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkic.exe

Path C:\Temp\nifaysqkic.exe
Size 376KB
SHA256 38cf9697eec9269fddb22663895c41ca9cfde30a7f0c993d25b078cadb7e13b5
MD5 4917e0c34c2bfac6c820172db02024aa
SHA1 1ad39b414796cb20c03b57779e19bf39783cbd6e
SHA512 fe62d5b852cc4157fd592e2c771fe7e767d3b569cdeacb5987dd3553c0e7cd425d618558c4dbd9aad2b1f8e76d412b8d5e8055c8e2faac99439c7aa6ae5edb6e
SSDEEP 3072:OjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:AyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgebwtogb.exe

Path C:\Temp\olgebwtogb.exe
Size 376KB
SHA256 5790aaefc36fe486e938b719d0750857605268bf26e6aadd3a6b3e162320b107
MD5 71bcf8dbc464bf0f2d08b6d3073a6035
SHA1 cea77463740e3db6d11197e9502a282b65b7e2da
SHA512 5afb6ea7e718f8c639c6fd88381bf63102aff029639d20acc9c5bc320cc0f7b0fd1ad020ffd70f2b9ea8cc24fffb8071042d34bf7ea474243a44e09d58e05372
SSDEEP 3072:KjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqoigayvtq.sys

Path C:\Temp\tqoigayvtq.sys
Size 293KB
SHA256 f23605c35429b36c4989bad74ad6d8ec29827eaac42d65004f3aa45ba6052590
MD5 a75b363a5f12efff086d600f8c6cd481
SHA1 46cd7c427c06f9c530eba8a39b9c5087f4792f3d
SHA512 1917a0e6df662e11d855e0f611fc7f99e5d267f1fdcddd9bce3d3dfbabfc2a1738886ee9a495b3adc2ed03f1564192fc5d17ea19f17126faae3adc26d26f604a
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnlidavtn.sys

Path C:\Temp\vqnlidavtn.sys
Size 293KB
SHA256 21819f96d59a2660bee6efcefebd0d7a83dfaac69d16c0fb2bdd25764920616c
MD5 f3454bf8461b3e02c3b2621fb7469a67
SHA1 6a77720c272501dbe002ea288d81a9a7280fdca8
SHA512 1c53d43d5cc907efbb6d1b70be94f976caeb1abc7990c460405d07e26b8cb668122b0fa6272ea35daa1a0c578ac1763e1ff011d38cb81b71c00119a2b9dc13f2
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T12E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.exe

Path C:\Temp\vqoigaysql.exe
Size 376KB
SHA256 aa092be3c44dfbad022a5ca37b3833c1012187e1d2714be05e7adcfe70b02a37
MD5 fe6c7eb9f28f521475897aa7ff88e4f3
SHA1 212178d5e978e1251c01974b5faa3bfce329d9d6
SHA512 454fae46f1261555d65fe1e7345cd196444be560289eb46566a1605a2afb51eb75b449c78da36938516b51f8454b664e6a320c6f15be2ecffa8ba44696837115
SSDEEP 3072:DjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuomgbztr.exe

Path C:\Temp\ztrljebwuomgbztr.exe
Size 376KB
SHA256 12e0707223745081cb9e0bb8d34429429a3418b122c05659813533a33dbd16fd
MD5 dfcc90d148965e9dd37591cb249f001f
SHA1 7095ec33d13ba2e7b84b9f40aeb8f1521f6e087c
SHA512 2422e9768f9da510a8f6889829cb06613c0b340a469838d19d017d6846a4e2c14a7139236ea2eb5b7c8f01d5cf2eeb7ce02f69339aaf398371a1aef321845986
SSDEEP 3072:yjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwuomgbztr.sys

Path C:\Temp\ztrljebwuomgbztr.sys
Size 293KB
SHA256 8a8747b5a313a0818856659842f7712766e8f13f4027835435f529c7785a7d46
MD5 95d57414121ec2705f4f3c9f36fc7884
SHA1 36ff5712460bce5e1e5693244052d8406794027d
SHA512 378ff259333bd420e84d9cf474e20c1c6dce9df5ddd057c1067ffd35ce8c4a04618a6e76abbc44f3abd4be2d276418ff1396f14b5de501be4ee336be7062dfb2
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpnkfdxv.exe

Path C:\Temp\zxvpnkfdxv.exe
Size 376KB
SHA256 7ba71d9071d7fb1b726ab7192dbe27d5138c36b55665fbc2b378927521065a10
MD5 eba415d71078852d1f32f8b046417e22
SHA1 9c9145c7e142f4450d86e9717db4c698cc0432b7
SHA512 6cbb484b5ba7b96d2832885282bbdcbe40230c14cf9b5cffb50f37b0661efe915eda9b6a7b20ad7e86859e0672e35b1e0f2efe974e8204d8953a68bcb6cf3791
SSDEEP 3072:qjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:EyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

1c8e9af3-6d8e-48e4-83d8-56751000a176.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c8e9af3-6d8e-48e4-83d8-56751000a176.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e549870e1208349bd56adae23310e010e0d81194cc5eb7d8658cae0c980deeb2
MD5 8aa55cd9a4f0f7576e342b2c215905b7
SHA1 ad0b6cb901d22d6f2944f3648fb5727051b8f195
SHA512 17261924a2a63a2df67a9d9034ab5ccda7d7445089bd35cbaba1ae1fde7aab16a047fd3831cad684be328d7549e7127c668ac1cc225c9522ddb2f048b6298a58
TLSH
T1C541FAC242A0A39CF7B8857DB5C00E93FAF2A9B06487DF500654C5FBBAC1399FE54200
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e817b9e656856affe8559e86e30ab0b3e8947e7851ad2712fc1e0a945b08fda1
MD5 b954ca26586934f6c3c3b6debf44d711
SHA1 d49f0392e50cd63976d7ee9d2303d5987d5b3982
SHA512 999da216c472c37da8b66d2e90a4fb9b8e7630d7076a67ec02b7b5ceb802bcd4b33f01f4c5077f654ca2c8197080f5b6d02c7fe8bc2cc143e09a7bd4b9c3c59b
TLSH
T10351C0F7C3E8862E890156F4AB147E2BCE1D0924832C3D5AC8E49F1B93E34B1D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 70b5590f0d0d1e8236a7d542d70395d46d64fd2d439880e91573990d3410616d
MD5 83bec3ae3f756eda8bbfbeca78db0e5f
SHA1 05a43f73051fe245c30ca96555ef942e72faf3de
SHA512 b9439b5237972bd49b83741571615031d0b430597019cdcfc1ec9d253d7955043f474f36c2290777085a7eccc7f39acaa58412c01db499226571f0934a6552ff
SSDEEP 192:sxRpRpCF/fOs7jZrbVzoA8p9f/g6+WNC4n/YuQtDGiIgVmJ:sxRp+F/fOs7N/4R/55/oI
TLSH
T1CB42B819AD28AD7B4CCBD21DFB557F53D2F91132A0951E48B6FC8A2C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fdb297efe5aa0975a040168cc20f2fcdfbace2322b4936903aa8e1dea2362ca6
MD5 012017e2d5c255ae549e51164caddbb8
SHA1 8a439687a52075a8921e6f66fc1a5e7ef5f3b999
SHA512 6fdb950fc12f6b51e2d119b625c6731d1518f3f29cbd898cc73f1a7733ddbde31a7cf021c995224f25f52dfade39509ec1935aac2cd98b106126ad935bc97175
SSDEEP 192:sxRqRpCF/fOsyjZrbVzoA8p9f/g6+WNC4n/YuQtDGiIgD8mJ:sxRq+F/fOsyN/4R/55/oD
TLSH
T1BB42B719AE28AD7B4CCBD21DFB557F53D2F91132A0951E48B6FC9A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eccb5b702227e028b9e9c45e89eab799ebfb10ce415c60f804ab5bd3b45485bf
MD5 64b765678d40af80cba44880d300058a
SHA1 1beb316464692ef780d43bbd4c96d0114eb758e6
SHA512 4325eba76bec809da4b9653a8e8764ffd96764706a7dd8e4431da10d0a3acc618fd44c289764228414d03f323a53c67fdf15b300ec22f8efadcc7421d8205826
SSDEEP 192:sxRqRpCF/fOsUjZrbVzoA8p9f/g6+WNC4n/YuptDGiIgDumJ:sxRq+F/fOsUN/4R/55/J9
TLSH
T11342C919AD28AD7B4CCBD61DFB557F13E2F95032A0911E48B6FC8A2C15E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2878da6bfd32d919d580e371025c8e8d0a646b98723f02f915b12c2f622d602b
MD5 fa6c2ede00946949d01737f1969b64d5
SHA1 ebdc53a0bea6b4e2116721a12562cf557b8485e8
SHA512 d53f4a3ee0254d7e2752e10a5760d0f4a4398cd637aad4940b1939c1b44812aa0820521132c97f93420a2ef8ddd614ce41c7d074d8ae5bfb9cfc9dfaef4da383
SSDEEP 768:/jnh5H7pLuLbcJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcElRkPnrostd7:/jnh5BEbcJWg6cfCwu1jaHEliP0Ud7
TLSH
T139D2D97B740CCA7F4F900ADDE8197E9B6DA802CB9698C98047FE945C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c5577ae34afa6bf0b5dfcd2bd629a80036c63c15feecb711964c6a93db76c059
MD5 6d91529ce5b0dac861f8c49a3c5b7101
SHA1 81cbb121c8058277d6e5ffefb754d2d771329a9d
SHA512 c8b52a35378e6b5630d8fa41f1e19e50e2a9a38ac85b57b9cd4972968db509d86d7beff125cea79a2abd680058f1ef6f56d5e2cdefe3a980e8c69ff14a50c123
SSDEEP 48:KM9MZN3LXYTD+LIa1YKV99fYR1IoOfN1yD3SL3pJZiTB0RIaHiKVH9FiRnyo8d3t:KkC4Kf6+qUAKNimiGoK7SQoIK5emQ
TLSH
T1AAC16660317B4650383D3A0C70FAA6DA1B4176A3743CE56B3BEA40A58D6BE055DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4085.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4085.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4aab1af1410ff3cca786ed1735a30c62a6f9defdea1b2f3178cadafa48078239
MD5 6a67be91a4831268d91bcb44c21a24f7
SHA1 718ebcd22879face23ef33c53a7982f9969a0c72
SHA512 7523371d4889cf1b793f01b1f4e4edce4765d123605f2021e5b26918ea800efef9a86f146866f1a3ee74e0e1a6b9e3ee6148e891b97412ca386f9d1e80e334fc
SSDEEP 768:FWR3JmSO5p1j81+6MIYNa8S5oYklnA+/2sNV:cR3wpB8kwTWRdA02sNV
TLSH
T1D0F2BF3599A8DDB39CEBA384B34673926EE42133D0D45F98D9EC1B1D01836AF1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b9f4aab6c57d6e3a02b57537f8b0e84f2fa6d7f14070f1523feba5c1fef97212
MD5 ead7d495acb8c1a43748da42164637a1
SHA1 e1273b7d16b30818eb436859832c75c03acfd11d
SHA512 34345435871b4517097400e67f73b106c129f2881291560fb00d32ac12dc72b0fb459cce2a181814d8880e25a2b92e1298b22c85aa09f090c20f996e16fcdc84
SSDEEP 768:5+/UxvxjgC+k3KmSO5p1j81+6MIYNa8S5oYklnA+/9a:dZj3+k3LpB8kwTWRdA09a
TLSH
T16E03B139A9A9AD6398E7A384B30A63D7AEE4117390C45EECC9E81F1D05C377F1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 622f48280f2b388b923ee476d83aa920b9b94320291d96c3051ab38227c3b8be
MD5 788302546e5c6d9e26017085fa2b4d6b
SHA1 a70b22ee29a8b139854b0a2bf2989528c3604960
SHA512 a4a6db3a9e97f788923903519363e29a8671acb53c1e6800c53520dacf77ac39362090611f12c55e21268b3502d5ae1b0ab1d6d316ee84abfe400604ec4a6a91
SSDEEP 768:do/UxvxjgC+23XfOSO5p1jdJMIYNa8S5oYklnAa0SH8L4:nZj3+23PqpBdHTWRdAXS04
TLSH
T19B03C0399D94A8738CF663C4770A9357AEF55263D0C16AF88AEC1F0E17C72AD5303456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2e192fc17ee4e454c2d8c5b70e6ce889318c87ce689db5672c000a27617f81d3
MD5 9948e677c77f120365bcfa114c741ff1
SHA1 08687bd62c943eba3797ab1d4538a4e99b2bcdb1
SHA512 1fab66770b51d0ca769cf720f9679c68fc3b9a466950f4a45123b23c7c0500b18f752faf9299a085fbb064a8da9fd204edc303aea38f20f999455df2bcc6ecd4
SSDEEP 768:IR3emSO5p1j81+6MIYNa8S5oYklnA+/2sNV:IR3/pB8kwTWRdA02sNV
TLSH
T14FF2BF35A9A9DDB39CEBA384F30673926EE42133D0D45E98D9EC5B1D01836AF1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 4fc2e0ec14acecc109d12f91dd97ac53293c7015854fac364d1284b691f9edd8
MD5 e48bd1470310ce3a3ff6b8a58e49f701
SHA1 9a9ea109f928a2e11bb6a032c9feba71686c7fab
SHA512 c8765e5a404047287a870802d1706f2524423f3161270c6869a034f8f27111d447d72b62ba38089733838beeeb6cba867c0f19d8731137ddcea177c0b45922e7
SSDEEP 768:wFQG3wwgvpXO5p1j818OMIYNa8S5oYklnA+/2sNV:jG37pB8yUTWRdA02sNV
TLSH
T1451328F598D79977D8AE5383A33D6E429EBCD163B0889994BBD80D4CCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5392_605302235\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c02278acbd2f122cbcec7589cd73e1df66518545e037d8b8a2bcb579aada3eb1
MD5 2abd27bd7c72d25476d67804b171dece
SHA1 aa1940d278bb2e93a3fbaa93ca2702c0a0d692c2
SHA512 506219b9506e679de7cf2775407326033c70f1d0d17823015e1d8c0019993feaac34dfef158cdfd733497efd939d31f078ba6d5623bc541e8acce3deb8d50b07
TLSH
T14E71238397B9C9B3C5DE5FF102835648F6FB22380B2330300B515946AB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/348-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/348-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1824-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2136-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2516-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2796-184-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2968-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3904-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4400-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4624-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5156-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5288-256-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5364-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5980-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6120-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download