systex | 8c50392ca86d92761a809a1513eaeca453716ba9f5cbcaa613f5feea990f152e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260629-vm2waaat51
SHA256 8c50392ca86d92761a809a1513eaeca453716ba9f5cbcaa613f5feea990f152e
MD5 31a00c4cf2a7956fedab91e1b7549ac0
SHA1 f3f3ef84b5706dcc7e8ccce0cde61c90c82e9a48
SHA512 efc9ef06cbd340045b0ed8cd9894afb7c7eeff61efde3e069e67ca3806fed35818a21ecbd1e4653f7b109f2b918eb1162d565bf6a28c58789e03d66d8489a032
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
8	hfaxsqkhfcxusmki.exe
3976	hfaxsqkhfcxusmki.sys
1076	CreateProcess.exe
2640	usmkicxvpk.exe
5132	CreateProcess.exe
3032	CreateProcess.exe
4552	i_usmkicxvpk.exe
6128	cxupnhfzxu.sys
3964	CreateProcess.exe
1556	pjhfzwusmh.exe
4248	CreateProcess.exe
3036	CreateProcess.exe
1192	i_pjhfzwusmh.exe
3272	omkecxrpmh.sys
4484	CreateProcess.exe
3204	hezxuomhez.exe
5048	CreateProcess.exe
5368	CreateProcess.exe
5032	i_hezxuomhez.exe
4396	zwrpjhbztr.sys
2352	CreateProcess.exe
1912	zwuomjhbzt.exe
5268	CreateProcess.exe
5968	CreateProcess.exe
2036	i_zwuomjhbzt.exe
4552	wqojgdbztr.sys
5136	CreateProcess.exe
5240	qojgbytrlj.exe
1752	CreateProcess.exe
4812	CreateProcess.exe
5656	i_qojgbytrlj.exe
3476	wqoigbytql.sys
1128	CreateProcess.exe
5480	ljgbytqlig.exe
596	CreateProcess.exe
5644	CreateProcess.exe
2552	i_ljgbytqlig.exe
6132	qoigayvqoi.sys
3924	CreateProcess.exe
3864	oigdyvqoig.exe
4840	CreateProcess.exe
2868	CreateProcess.exe
3192	i_oigdyvqoig.exe
2952	lidavtnlfd.sys
5292	CreateProcess.exe
4844	idavsqkida.exe
2288	CreateProcess.exe
1612	CreateProcess.exe
2852	i_idavsqkida.exe
4368	caxsqkicax.sys
4496	CreateProcess.exe
3384	zxvpnhfaxs.exe
3236	CreateProcess.exe
2968	CreateProcess.exe
2804	i_zxvpnhfaxs.exe
1500	nkfcxupnhf.sys
3412	CreateProcess.exe
1796	caupnkecxu.exe
2732	CreateProcess.exe
6132	CreateProcess.exe
5916	i_caupnkecxu.exe
2044	nhfzxrpjhc.sys
5404	CreateProcess.exe
2520	hczxrpmhec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_224612688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1290757855\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2040107891\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2040107891\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1290757855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2076175727\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2076175727\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2040107891\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2040107891\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhezwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caupnkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhezwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkhfcxusmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fvsnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhfzwusmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhfzwusmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlgeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlgeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fvsnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caupnkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkicxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkicxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbytrlj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5208	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4636	ipconfig.exe
2840	ipconfig.exe
5272	ipconfig.exe
3708	ipconfig.exe
5272	ipconfig.exe
5280	ipconfig.exe
5228	ipconfig.exe
3400	ipconfig.exe
2420	ipconfig.exe
2588	ipconfig.exe
3592	ipconfig.exe
2172	ipconfig.exe
2492	ipconfig.exe
4804	ipconfig.exe
2052	ipconfig.exe
1840	ipconfig.exe
2560	ipconfig.exe
5764	ipconfig.exe
2416	ipconfig.exe
2648	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{4703288C-5C76-48A6-84A8-1225C225222A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe
8	hfaxsqkhfcxusmki.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	i_usmkicxvpk.exe
Token: SeDebugPrivilege	1192	i_pjhfzwusmh.exe
Token: SeDebugPrivilege	5032	i_hezxuomhez.exe
Token: SeDebugPrivilege	2036	i_zwuomjhbzt.exe
Token: SeDebugPrivilege	5656	i_qojgbytrlj.exe
Token: SeDebugPrivilege	2552	i_ljgbytqlig.exe
Token: SeDebugPrivilege	3192	i_oigdyvqoig.exe
Token: SeDebugPrivilege	2852	i_idavsqkida.exe
Token: SeDebugPrivilege	2804	i_zxvpnhfaxs.exe
Token: SeDebugPrivilege	5916	i_caupnkecxu.exe
Token: SeDebugPrivilege	3912	i_hczxrpmhec.exe
Token: SeDebugPrivilege	1432	i_mjhezwurpj.exe
Token: SeDebugPrivilege	5516	i_uomgeywqom.exe
Token: SeDebugPrivilege	2704	i_ytqljdbvto.exe
Token: SeDebugPrivilege	2596	i_yvtnlgeyvq.exe
Token: SeDebugPrivilege	420	i_ysqkidavtn.exe
Token: SeDebugPrivilege	5464	i_vsnkicaysq.exe
Token: SeDebugPrivilege	4380	i_fvsnkfcxvp.exe
Token: SeDebugPrivilege	4948	i_zurpkhcaus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 8	3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3920 wrote to memory of 4672	3920	2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4672 wrote to memory of 5652	4672	iexplore.exe	89
PID 5652 wrote to memory of 456	5652	msedge.exe	90
PID 5652 wrote to memory of 5204	5652	msedge.exe	92
PID 5652 wrote to memory of 5208	5652	msedge.exe	93
PID 5652 wrote to memory of 5204	5652	msedge.exe	92
PID 5652 wrote to memory of 5204	5652	msedge.exe	92
PID 5652 wrote to memory of 4960	5652	msedge.exe	94
PID 5652 wrote to memory of 4960	5652	msedge.exe	94
PID 5652 wrote to memory of 476	5652	msedge.exe	95
PID 5652 wrote to memory of 476	5652	msedge.exe	95
PID 5652 wrote to memory of 476	5652	msedge.exe	95
PID 5652 wrote to memory of 4092	5652	msedge.exe	96
PID 5652 wrote to memory of 4092	5652	msedge.exe	96
PID 5652 wrote to memory of 4092	5652	msedge.exe	96
PID 5652 wrote to memory of 3472	5652	msedge.exe	97
PID 5652 wrote to memory of 792	5652	msedge.exe	98
PID 5652 wrote to memory of 3472	5652	msedge.exe	97
PID 5652 wrote to memory of 3472	5652	msedge.exe	97
PID 5652 wrote to memory of 792	5652	msedge.exe	98
PID 5652 wrote to memory of 792	5652	msedge.exe	98
PID 5652 wrote to memory of 1516	5652	msedge.exe	100
PID 5652 wrote to memory of 1516	5652	msedge.exe	100
PID 5652 wrote to memory of 4388	5652	msedge.exe	101
PID 5652 wrote to memory of 4388	5652	msedge.exe	101
PID 5652 wrote to memory of 2516	5652	msedge.exe	102
PID 5652 wrote to memory of 2516	5652	msedge.exe	102
PID 8 wrote to memory of 1076	8	hfaxsqkhfcxusmki.exe	105
PID 5652 wrote to memory of 1840	5652	msedge.exe	108
PID 2640 wrote to memory of 5132	2640	usmkicxvpk.exe	110
PID 5652 wrote to memory of 1576	5652	msedge.exe	113
PID 5652 wrote to memory of 1576	5652	msedge.exe	113
PID 5652 wrote to memory of 852	5652	msedge.exe	116
PID 5652 wrote to memory of 852	5652	msedge.exe	116
PID 8 wrote to memory of 3032	8	hfaxsqkhfcxusmki.exe	117
PID 8 wrote to memory of 3964	8	hfaxsqkhfcxusmki.exe	121
PID 1556 wrote to memory of 4248	1556	pjhfzwusmh.exe	123
PID 8 wrote to memory of 3036	8	hfaxsqkhfcxusmki.exe	126
PID 8 wrote to memory of 4484	8	hfaxsqkhfcxusmki.exe	130
PID 3204 wrote to memory of 5048	3204	hezxuomhez.exe	132
PID 8 wrote to memory of 5368	8	hfaxsqkhfcxusmki.exe	135
PID 8 wrote to memory of 2352	8	hfaxsqkhfcxusmki.exe	139
PID 1912 wrote to memory of 5268	1912	zwuomjhbzt.exe	141
PID 8 wrote to memory of 5968	8	hfaxsqkhfcxusmki.exe	144
PID 5652 wrote to memory of 1700	5652	msedge.exe	146
PID 5652 wrote to memory of 4128	5652	msedge.exe	147
PID 5652 wrote to memory of 3600	5652	msedge.exe	148
PID 8 wrote to memory of 5136	8	hfaxsqkhfcxusmki.exe	151
PID 5240 wrote to memory of 1752	5240	qojgbytrlj.exe	153
PID 8 wrote to memory of 4812	8	hfaxsqkhfcxusmki.exe	156
PID 8 wrote to memory of 1128	8	hfaxsqkhfcxusmki.exe	160
PID 5480 wrote to memory of 596	5480	ljgbytqlig.exe	162
PID 8 wrote to memory of 5644	8	hfaxsqkhfcxusmki.exe	165
PID 8 wrote to memory of 3924	8	hfaxsqkhfcxusmki.exe	169
PID 3864 wrote to memory of 4840	3864	oigdyvqoig.exe	171
PID 8 wrote to memory of 2868	8	hfaxsqkhfcxusmki.exe	174
PID 8 wrote to memory of 5292	8	hfaxsqkhfcxusmki.exe	178
PID 4844 wrote to memory of 2288	4844	idavsqkida.exe	180
PID 8 wrote to memory of 1612	8	hfaxsqkhfcxusmki.exe	183
PID 5652 wrote to memory of 5388	5652	msedge.exe	185
PID 5652 wrote to memory of 5388	5652	msedge.exe	185
PID 8 wrote to memory of 4496	8	hfaxsqkhfcxusmki.exe	191
PID 3384 wrote to memory of 3236	3384	zxvpnhfaxs.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_31a00c4cf2a7956fedab91e1b7549ac0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Temp\hfaxsqkhfcxusmki.exe
  C:\Temp\hfaxsqkhfcxusmki.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkicxvpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1076
  - - C:\Temp\usmkicxvpk.exe
      C:\Temp\usmkicxvpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkicxvpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3032
  - - C:\Temp\i_usmkicxvpk.exe
      C:\Temp\i_usmkicxvpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhfzwusmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3964
  - - C:\Temp\pjhfzwusmh.exe
      C:\Temp\pjhfzwusmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhfzwusmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3036
  - - C:\Temp\i_pjhfzwusmh.exe
      C:\Temp\i_pjhfzwusmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\hezxuomhez.exe
      C:\Temp\hezxuomhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5368
  - - C:\Temp\i_hezxuomhez.exe
      C:\Temp\i_hezxuomhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2352
  - - C:\Temp\zwuomjhbzt.exe
      C:\Temp\zwuomjhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5968
  - - C:\Temp\i_zwuomjhbzt.exe
      C:\Temp\i_zwuomjhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5136
  - - C:\Temp\qojgbytrlj.exe
      C:\Temp\qojgbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\i_qojgbytrlj.exe
      C:\Temp\i_qojgbytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbytqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1128
  - - C:\Temp\ljgbytqlig.exe
      C:\Temp\ljgbytqlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbytqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5644
  - - C:\Temp\i_ljgbytqlig.exe
      C:\Temp\i_ljgbytqlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3924
  - - C:\Temp\oigdyvqoig.exe
      C:\Temp\oigdyvqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Temp\i_oigdyvqoig.exe
      C:\Temp\i_oigdyvqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5292
  - - C:\Temp\idavsqkida.exe
      C:\Temp\idavsqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1612
  - - C:\Temp\i_idavsqkida.exe
      C:\Temp\i_idavsqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4496
  - - C:\Temp\zxvpnhfaxs.exe
      C:\Temp\zxvpnhfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2968
  - - C:\Temp\i_zxvpnhfaxs.exe
      C:\Temp\i_zxvpnhfaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caupnkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\caupnkecxu.exe
      C:\Temp\caupnkecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caupnkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6132
  - - C:\Temp\i_caupnkecxu.exe
      C:\Temp\i_caupnkecxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxrpmhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\hczxrpmhec.exe
      C:\Temp\hczxrpmhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxrpmhec.exe ups_ins
    3⤵
    PID:3460
  - - C:\Temp\i_hczxrpmhec.exe
      C:\Temp\i_hczxrpmhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhezwurpj.exe ups_run
    3⤵
    PID:3048
  - - C:\Temp\mjhezwurpj.exe
      C:\Temp\mjhezwurpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhezwurpj.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_mjhezwurpj.exe
      C:\Temp\i_mjhezwurpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywqom.exe ups_run
    3⤵
    PID:4644
  - - C:\Temp\uomgeywqom.exe
      C:\Temp\uomgeywqom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywqom.exe ups_ins
    3⤵
    PID:2404
  - - C:\Temp\i_uomgeywqom.exe
      C:\Temp\i_uomgeywqom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdbvto.exe ups_run
    3⤵
    PID:1464
  - - C:\Temp\ytqljdbvto.exe
      C:\Temp\ytqljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvto.exe ups_ins
    3⤵
    PID:5376
  - - C:\Temp\i_ytqljdbvto.exe
      C:\Temp\i_ytqljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlgeyvq.exe ups_run
    3⤵
    PID:1704
  - - C:\Temp\yvtnlgeyvq.exe
      C:\Temp\yvtnlgeyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlgeyvq.exe ups_ins
    3⤵
    PID:2476
  - - C:\Temp\i_yvtnlgeyvq.exe
      C:\Temp\i_yvtnlgeyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run
    3⤵
    PID:1204
  - - C:\Temp\ysqkidavtn.exe
      C:\Temp\ysqkidavtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins
    3⤵
    PID:5816
  - - C:\Temp\i_ysqkidavtn.exe
      C:\Temp\i_ysqkidavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkicaysq.exe ups_run
    3⤵
    PID:3844
  - - C:\Temp\vsnkicaysq.exe
      C:\Temp\vsnkicaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkicaysq.exe ups_ins
    3⤵
    PID:2784
  - - C:\Temp\i_vsnkicaysq.exe
      C:\Temp\i_vsnkicaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fvsnkfcxvp.exe ups_run
    3⤵
    PID:4444
  - - C:\Temp\fvsnkfcxvp.exe
      C:\Temp\fvsnkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fvsnkfcxvp.exe ups_ins
    3⤵
    PID:5540
  - - C:\Temp\i_fvsnkfcxvp.exe
      C:\Temp\i_fvsnkfcxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpkhcaus.exe ups_run
    3⤵
    PID:3728
  - - C:\Temp\zurpkhcaus.exe
      C:\Temp\zurpkhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpkhcaus.exe ups_ins
    3⤵
    PID:1396
  - - C:\Temp\i_zurpkhcaus.exe
      C:\Temp\i_zurpkhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzuomh.exe ups_run
    3⤵
    PID:4424
  - - C:\Temp\rpjhbzuomh.exe
      C:\Temp\rpjhbzuomh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2648
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8b8d4c188,0x7ff8b8d4c194,0x7ff8b8d4c1a0
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,3119829625881898834,15886972376919297448,262144 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,12156132043909639552,3651308149358110976,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
      4⤵
      System Time Discovery
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,10069596394226367324,6221351649935163500,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16475964939444544088,14373707940469496091,2097152 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,7515103751299418387,11796946063471226287,2097152 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,7238405288519526738,4339446118387541682,2097152 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,15013272001177303143,17954493960796287553,2097152 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,3024724962272758287,7737357206294301491,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1335137698760909228,3155989148638294305,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15390857986550320861,7485562148928207037,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12694746779898750283,4281387833612606373,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12694746779898750283,4281387833612606373,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17972919471708108902,6225469372827543418,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,13906419167065828261,14188550551908820720,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,3012337322713453689,10852373849367785919,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:14
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,14394932731238715979,14198799261671673442,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,14494189356129172720,1049650882773826150,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3193264027830337111,15881910406397445617,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,12963233475566154288,3454886304940284441,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4795402507389871075,6148177036303431401,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:14
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1642623995259353468,12279048324874309121,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5476,i,2225565930528013366,13198337849907238898,262144 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:10
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,17299479636744619383,8569144189291660619,524288 --field-trial-handle=2632,i,2745199499539123639,3183775910764688125,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5272

C:\Temp\hfaxsqkhfcxusmki.sys
C:\Temp\hfaxsqkhfcxusmki.sys
1⤵
- Executes dropped EXE
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2420

C:\Temp\cxupnhfzxu.sys
C:\Temp\cxupnhfzxu.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\omkecxrpmh.sys
C:\Temp\omkecxrpmh.sys
1⤵
- Executes dropped EXE
PID:3272

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\wqojgdbztr.sys
C:\Temp\wqojgdbztr.sys
1⤵
- Executes dropped EXE
PID:4552

C:\Temp\wqoigbytql.sys
C:\Temp\wqoigbytql.sys
1⤵
- Executes dropped EXE
PID:3476

C:\Temp\qoigayvqoi.sys
C:\Temp\qoigayvqoi.sys
1⤵
- Executes dropped EXE
PID:6132

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:2952

C:\Temp\caxsqkicax.sys
C:\Temp\caxsqkicax.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\nkfcxupnhf.sys
C:\Temp\nkfcxupnhf.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\nhfzxrpjhc.sys
C:\Temp\nhfzxrpjhc.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Temp\mjeczurpjh.sys
C:\Temp\mjeczurpjh.sys
1⤵
PID:1880

C:\Temp\rojhbztroj.sys
C:\Temp\rojhbztroj.sys
1⤵
PID:3392

C:\Temp\ebwtolgebw.sys
C:\Temp\ebwtolgebw.sys
1⤵
PID:4784

C:\Temp\dbvtnligey.sys
C:\Temp\dbvtnligey.sys
1⤵
PID:3644

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
PID:3772

C:\Temp\xvsnlfdxvp.sys
C:\Temp\xvsnlfdxvp.sys
1⤵
PID:1872

C:\Temp\faxvsnkfdx.sys
C:\Temp\faxvsnkfdx.sys
1⤵
PID:476

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
PID:2112

C:\Temp\rpjhfzxupm.sys
C:\Temp\rpjhfzxupm.sys
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxupnhfzxu.sys

Path C:\Temp\cxupnhfzxu.sys
Size 293KB
SHA256 c93bb9146c30cc2e43907f295344e876cf02d57fd87f30e695ff85517893092c
MD5 a28a61f43da7b972b420d0942b0eeb00
SHA1 7358f29498c37957fe55f6fdde85116997bd9d30
SHA512 6e392138553e789803a46702d7e4e83b63d37212634e2faf4615cdfb867e3f03aaad4210dc7efcb2bf856dd2deb2e2c9af0982efc950b98136d386899ae97eb4
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T113545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxuomhez.exe

Path C:\Temp\hezxuomhez.exe
Size 376KB
SHA256 910378a59e959f33c1be08f01a517651533c4818f7363feba81de3235a6cfab5
MD5 c2b2c98ba631ee9d5827ab2e5118838b
SHA1 b4b13410ecd5a39764684710a32e2499b342b4c0
SHA512 7b4edaabe003c4ef075158be2d7c5b03f0765bb5d91803122645e47893be9c9b260c8ad277f496ca145f51d2c406f11fc01416af3b129146a8e8223549fd5bac
SSDEEP 3072:ZFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsqkhfcxusmki.exe

Path C:\Temp\hfaxsqkhfcxusmki.exe
Size 376KB
SHA256 95edd9da2cd3e7f52ab817497442f828eb80865ef01c00aa2522332adb2268cf
MD5 7329bbb455b15905d0f471810868ece2
SHA1 3a84c5fd78a918fc8a7a4c36f7c3ea9c44385189
SHA512 86bddb618326033a25917a4c1afcdd4dc2b27785e39f3996d9eafd5c0372d0d497befe6fc3697af0c4c289e96eb9719f680eaa9ba6e1ea219da280e0b6262bc5
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsqkhfcxusmki.sys

Path C:\Temp\hfaxsqkhfcxusmki.sys
Size 293KB
SHA256 4d6f9af88c5173ebd65102b5ce9e234c9481fed44edd6fdc95a12d15abe0d49d
MD5 7d2cd3061d9d9810994f6e0f68288549
SHA1 78d3cc6f88bd92ec2377cfc73cec28687640b948
SHA512 a9276680490368cf044a2b5a5487cfcc8389f8531b0171a4ede22217eb693e05e70ff46d09fdcf4b5940ebf017ea1e728ec5c14e9783fd599c66fda3bd394cd6
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxuomhez.exe

Path C:\Temp\i_hezxuomhez.exe
Size 376KB
SHA256 7611faac9305777cc6796d8c3ef3275055f0b9e2e205fdd5074c483640cf0341
MD5 d6fdf2707cb3a4b1810fed64897085c5
SHA1 2a50114eadb73bc39bf8fdea9897276a07ac1f2d
SHA512 b29b8e8011b7468c67673d4c2d94eac73d156ede30c7ae8af34107f4ba5f093d1c5614dfc7bbc7a8dd48f003b3ac8c7ea18b5fa2443f0f5c017a340db4883e8c
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhfzwusmh.exe

Path C:\Temp\i_pjhfzwusmh.exe
Size 376KB
SHA256 04440f585753e4cb871920dd7257f90cf11b1107992104ad8027f4396a5f3674
MD5 efa0341e6c784c424e80724ecada0263
SHA1 53f6ff1bc0abd6b677f47c8329744f29810b5018
SHA512 5195651068a4c54cc730f7893ab7ff0487b3888e89d938c1ae2bb4919bafe0a9218b9e1eca2d816a17c5ec6bab7c7edeccba6e9a794cac18031ae9292e9e22c9
SSDEEP 3072:XFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qojgbytrlj.exe

Path C:\Temp\i_qojgbytrlj.exe
Size 376KB
SHA256 88f5d1f509a5ed0db9760a47dd39f3d47ccbfaa6c6fca5bfa732144376c322cd
MD5 05bb7e481dc250c029572a39112ff7fd
SHA1 a76712d531c34ec267295cbefef7465b0422cad8
SHA512 392a07e1608f292d2afd51e49e154266d371afb3ce958d70fa300d37e86ad25c1ad00937fa21344f6962a3bd3844c699157d9f3b093f54d0611692f408d2cf7c
SSDEEP 3072:hFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:hFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkicxvpk.exe

Path C:\Temp\i_usmkicxvpk.exe
Size 376KB
SHA256 42c23193b46eea89b0f214f460ca7aa6ff8e7d7919f852c09d10beb5b8a26913
MD5 a3da09b47b2e287814107a35f40f18cc
SHA1 ba9a7cd147ecd37539660b30795b78855c39730d
SHA512 3109f9390468817e6f9a383959a2535fc6479e282beac545184622da1c1f4436201b5921a5ed9fdea6586bc2917b15e72f57dc2e9e0734799874628266fbca50
SSDEEP 3072:+EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx:+EFL1JeIJjiJcbI03GBc3ucY5DCSjXT
TLSH
T123847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwuomjhbzt.exe

Path C:\Temp\i_zwuomjhbzt.exe
Size 376KB
SHA256 114fab6a7ad04d6f2b23ff02d988ffb31bebc169a8df38471ac1b361db171f70
MD5 4df13968f8c8cb5c175cbd95c181e536
SHA1 0edb83e844277e109bf54ee8d6ba2d32b4d2330d
SHA512 563becdabebbc7208b9a017731365fecacaa1fede8dcfbd1a91ef847a31eca2f2bb5647118c1bc092939d80b3808ff6e1cfc8fd7f3133d9d00064346db266f35
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbytqlig.exe

Path C:\Temp\ljgbytqlig.exe
Size 376KB
SHA256 7b2830fa7e1a12837c78f51e2e25820de73808b5ef4bc8a578717f27f16faa5c
MD5 b645d8ca422b8872bb6b417f86f694f2
SHA1 f0e8c67c7aaee1fdcb1cc07205ca1ae31e541030
SHA512 4464383d028a9127f4569c92156b1af044aace7a73ece0d23bc0c1b9ac411687119e9392b32d2031bb6f55b576d08347dd9ea6507a54f1e3ca20f6d488e2c05b
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omkecxrpmh.sys

Path C:\Temp\omkecxrpmh.sys
Size 293KB
SHA256 056eb71b8dbff2662b61bfb9d580b4c77220e1ab77342b130f00e55f590830c4
MD5 0f34a6cfe1be126f446447e903dbfc10
SHA1 b7d45ac00eaca16dd9fb333b15ca41d6fcebcbed
SHA512 486e81869a3f5dd5bf23c3d0068cf70c8f59290e239e0f8889e5d7c063afbc7c31b605c9ab1e9fd4aefd1b3189bec0c806e25f61e35acb250cce40d1b6ee7b02
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfzwusmh.exe

Path C:\Temp\pjhfzwusmh.exe
Size 376KB
SHA256 1d349a041a1d307fc62511fb7588d00583ad0e7efcb088dbcd313e0fbb5ed8bb
MD5 e9bf9e50699d45854990aec31c9d4196
SHA1 b52503cdcbec9e3a5733c58735a44b78a44f031a
SHA512 6ccb63f867e1c4d64545295532ff28be352080781fb085eee8df42a6e300f80bad19dab6db5fff65167c8ac985039a51bc7b210d933def8728ae95b9c874e4b5
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbytrlj.exe

Path C:\Temp\qojgbytrlj.exe
Size 376KB
SHA256 cbde28946e22cfa09d8cf1be689f39eaab12c2f5bb8ec7c0ccacc74c7fc8e623
MD5 88f528242f1373dce8a4d574efb17c11
SHA1 4c1b6e890113173ea4f2142e2ddcc37ac7d133cc
SHA512 493aa5f24ff6d2fbaf0b89047e5df2bce1026d3d03a4b93473523cff269ca41bcce3f4c2e87a71f1db8c3b6b9da1255f5634badbe095aa5c7d75e6c0a8bf2e75
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T145847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkicxvpk.exe

Path C:\Temp\usmkicxvpk.exe
Size 376KB
SHA256 243634d793b65d9b98beebc4d6a63e5a0446736c9b84927d871bc42446601dde
MD5 f076162652e5ebb8164e13538ac7021c
SHA1 5d0be894fa7a4bdd32b16b01a9ff1c24bc1330f5
SHA512 609f13633fc68d9c48bdd382943610c704a6c5ff3202bfb6b12e0aef937abdd08a568304af89e426ac09806524a440481e9cdcf6200b2ee54ac6383192032587
SSDEEP 3072:SFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbytql.sys

Path C:\Temp\wqoigbytql.sys
Size 293KB
SHA256 84d1acea4022f6050d9eb3d7886d0013643302b2a87a090498d33326c84aa147
MD5 e6aa4ab97f1066abbedb75446a439e1b
SHA1 31c84b8621537f1692816e753b51f8bb56f7794e
SHA512 97ed0e7469f05b8e901165b091966add99547c849ae8ed5f0dd55e9df4e9c48aa065fa3acb8f684bc49bcf8455379ee16f1120b2cfbeb16ab63fb05467bb643b
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgdbztr.sys

Path C:\Temp\wqojgdbztr.sys
Size 293KB
SHA256 2c360bd79d987149dab82b3af71e4488c60310a043f5dca63a86980934800382
MD5 5bbde4fbbc1c52cc407f0c683c63b998
SHA1 0d5f530ad30b289cabf67cc92f7c65fd54d01de9
SHA512 6e0a66e40d589858c155b46b59045b4ea60a3a0cf90ae4df2f0ff0fb3d9e333d7c35b4c6a9b15d342259629dc34afaaf8bce6216b420b2a2e957aa74632c7908
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbztr.sys

Path C:\Temp\zwrpjhbztr.sys
Size 293KB
SHA256 c5417903985a627d8e9434ff948457aad4f6a190310850bbd031a8a77d4d92d0
MD5 1d4073d8307f9b68839946b6895d733f
SHA1 639e96cf5e65e4be29d845e1846050c1ece1ac19
SHA512 c62fba01f5db8390b9e4a18be46de427a5a28cf8fd43733a1eb6baccdfaa6bb2914b625a2deda3b3b605551bc92a6f1aa5329265c1c66aaa48afc327f5da32c7
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomjhbzt.exe

Path C:\Temp\zwuomjhbzt.exe
Size 376KB
SHA256 39e32ed3e70960347f5373ad00b86c2ba3dfd649c2d3f8a72012f060cf298505
MD5 fa6895e72ce584684e887fc65f5797b0
SHA1 99016076957240a0e497c95726bb82cad37909ba
SHA512 0c9a901703d1c986b78ec6f193d189488925fe94c6a084975c2083e9d0bd5ec145872f8a5ce31ef902c7685235280d1e92a8c22e5a73253369e4b6875fc9e955
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

7050fa33-a506-476b-9b27-f16bd5d0407e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7050fa33-a506-476b-9b27-f16bd5d0407e.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e58e7a53f358bf11601eb6a7e66adcf2be9b34683cb678af73be4d923de05383
MD5 35cf638d27a58d4213a5761e923ae72e
SHA1 1f0fe139b2b5e85dffb4cb35a816724aa1fdf8ae
SHA512 1806c282d63071a1d4b79c141e193e734318e304eddfc6303d6e2aea55a3dfa2a51b121a966147c95390668a3a43633bde89b7d3ed4082d9ce06a661f2a3eebf
TLSH
T1575151673AB2EA5EEB6000B54BE25BF57331C55A6E0FAE601059B0F7CF8B777A081440
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b779d286bd53f9b325a6022bf36fac330b47e90cd2c6c2af3d9e93e03ce94a4c
MD5 00281ff5bb0d72aee310951a117ff573
SHA1 3d4b3eaccfb9561b50b6cd3be5e78b9b720bdb68
SHA512 55879b787b32a41002164409e3081c9a9a5785dd766a9e9b3477b3e9daf1604699c3a5d1bfa6df78a04b80504623b4981be6472e4d91ca92a97536b8f457df2e
TLSH
T19B519CF7C7E8866E890156F0AB147E2BCE2D0954832C3D5AC8E4EF5B93E2471D141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 80beef3570a478d6fc5c8b6de5c71627b21243f977fe9e43370dc83df1889a1f
MD5 c3efb5f68ab3b8231c1435bace98e9ff
SHA1 bf3f6c75f609a5f46ab1a6802133c03e6be8bc17
SHA512 17c8b06fb353c6bd2e2cd91c7591aed4a2f66c5139a1996fa6e8b0d14f08412d737e7568b4661e5081f8248ddf95d28422c44711d65938bc09435729d77f40fe
SSDEEP 192:sxRXR6yM/jK1Ml8wcr/fCsDeoZ4KKKzoA8p9P/g6+WNCCx/Y4wAe01GnIgtJ:sxRXwCr/fCsDeW4jHx/51//e0w3
TLSH
T15E62E916AA249977CCDBD209F955BF53D6F81563A2900E44AEFCCA0C01E7ADD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dc7d787d09a6654316e4423369ce200815fe86df89c81b296917a19e0a22e942
MD5 7639f693b082914906265a9ddaf72a67
SHA1 2ab16a2639190b0d7f032375772370ebce7f428f
SHA512 3c1b915f4dc277774e89233effaaa78d96f8eeedaea3b576b5c5b693e05d34d66751ca1df0048187b75c79ddad73f859017eb706832299cabfb07c9821093a87
SSDEEP 192:sxRIR6yM/jK1Ml8wcr/fCsteoZ4KKKzoA8p9P/g6+WNCCx/Y4wAe01GnIgDEJ:sxRIwCr/fCsteW4jHx/51//e0wM
TLSH
T19162E916AA2499778CDBD209FA55BF53D6F81563A2900E44AEFCCB0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bb0170ae69c195fb0c96b965540f05a448bac324dd5adc6e173d248d61449e1a
MD5 6a74c8cd12cc67595a02e30398e3af25
SHA1 2a4f71c27e7c9442196b0dd3e9f9f6d799dbb4d1
SHA512 233389f199c757b8ca2e2c9779329b23db5060d35cc00566411180abc69ff6999f0e85a9a55a65119e24c4ae6fbfb4d7825dd41ef813f46e68139f223f1a3f98
SSDEEP 192:sxRIR6yM/jK1Ml8UQ5cr/fCsteoZ4KKKzoA8prP/g6+WNCCx/Y4oAe01GnIgDEJ:sxRIwqur/fCsteW4jHr/51/ne0wM
TLSH
T13162D816AA2499778CDBD209F955BF53D6F85563A2900E44AEFCCB0C01E7ADD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 268aa417b4e6d15000bd59d821613f0e3e57b61e3165be7332efcd744807878b
MD5 c674a11e15798e3b211cfe043eb9f9e3
SHA1 df3dd160d47080f5f3545a0c2453603cda9f65a6
SHA512 df63ca2609a09262b11573d4fa98f488e3ea66969edc1e0d8ceb12dc64e5855ef83758399b6ab00a49c309fc91c1eaf3862048446dea87d5495473d0bb6fb6b3
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO8MXNGKroKTpvF:Tqi0NHE7C3WgNxfezu1jaJ8M9GhA
TLSH
T113E2ED7B680CCB7E4F804E9CEC2A7E9A6DE801CF96D8C95447EA840C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3fb70989acb85d2d2b5447308eda6a3ba05133e511589e07f4b6d4d21dc5eb4
MD5 8a62db40fe7667014fcf0c99024e3aab
SHA1 d30d2e59179e39f49ce86a1aedf12dc34adaecc2
SHA512 4661cdd1e746c08f2b67df488e2b5b730d773cac9cb8587bafab8770ca139f2daf69cdd0144689016c3105ffaa12f7e8cc096b4bd4368ed07e08e863c01dae4d
SSDEEP 24:K8+Ju8kI5KChg16SjIByXYnozobIvKfhW1aSBuAepuksIhKyho1aS7AQyXrHIh29:KobI5KUg0HyxUIvK5Wc+LIhKEo8GyVz
TLSH
T11191084071FB1B00793D291E96B8941F5641307130EEA8BB7BA961E66F67D010FFCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1672266f80836142ef1189b7fad174d7b9029cfce1334ca3580cbf659857d31d
MD5 2b31b162dc8a367572e2fe39f538c1ae
SHA1 038c127e3bc1b7a61c2b4d1b1d87c22751488643
SHA512 8433955bb29d67a3671a3873f9b18678364cde88dad4d29477d321ba2b3b78171ef238020386acc4bc08b62a7baca0053b62c856d3d616abf74b56e1c56ee91a
SSDEEP 768:Kj+9P3n86hX9ltI9K1+AW+152MvSCaiGMzn12bfJY:p9P3D9I9ypx2p4ByJY
TLSH
T1FB135AF598D79973C8AE83C3637E2E465DBCC15375840994BBD84E0DCC862BFD20A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d08d79a78c7743654f6727a1a43559311482559daf5683c20aa1e9203d2e1a1e
MD5 e6051e04e09b6e6eede77c88eb1ce786
SHA1 b1b5975e162767a7002c88d39bfd11999101f5a8
SHA512 2702ce4f17494662063793cfbe1aa88ef8f76dc2fb32a76b0c9e10e894a8bc58b71a88ab1186d5283fc57e8b045febe31989cf20f9074401ab795fc0b5731e4e
SSDEEP 768:uj+9P3QFthX9ltI9KG+AW+152MvSCaiGMzn12bfJY:N9P3e9I93px2p4ByJY
TLSH
T18EF2AE32A85A9D734CE7C6C4778B3796AEA016A385C51E58CDD98F0E01C738D235BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6ca563d8aba7a3848b883731fdc1407c4fad545b7bf3aa1bbbaf7f3e8af90b7e
MD5 f7ab9b24d52eb98a726ad02efafae34f
SHA1 a2ce6eeb0903230d9d03c64c53e98ffd9af6514e
SHA512 5f75ac31057f71ea039162c1b8eca53d8b27c047a74538e6d2029382d6c08a4dbbdec469849efea22a9e219f02f25dd25b4ec0540bf8e576cff38c6cdc5269ff
SSDEEP 768:Arv+4UNbd23RPthX9ltIB+AW+152MvSCa2ekr+8rir9:Absbs3N9IBpx2pBkrDriR
TLSH
T11D03CF32D869A9738CB6C6C4764B36137EB4519386C10B94CDDE2B4E429B6CD230BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d542421aba40ae9d9e6787b1c6fac5a43f2bc1af765ac56f0f50afcd2e96c7a1
MD5 38739f54e2c651328683c0c463219b4c
SHA1 2b63487516ea0d22a5b77f646e3db22e1b15a25c
SHA512 99a1aba997c3ffa67a43eb789c62b514e6407620f6c1793630eac50b9bebdd70aa313cdfd4152798a946dbebea2026d343e8c139c8d7fcbaa1782be4fdbc5290
SSDEEP 768:drv+4UNbd53wFthX9ltI9KG+AW+152MvSCaiGMzn12bfJ3:dbsbz3+9I93px2p4ByJ3
TLSH
T14013CF32E8699D738DF7D6C4B28B36437EA4159389C50A64CDD98B4D019B28E234FE37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

14587ff8-8595-4881-bedf-a46b8cda78d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\14587ff8-8595-4881-bedf-a46b8cda78d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5652_1220413274\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 762c5f2310ccca01fca85cf3f6ee1c3419b4ac867bf60f6b959fd8c1c3e5b517
MD5 31236f14a3e55d5ddf5465b50508bdf5
SHA1 bca9cb3d264c92646fab7386f8bad2abe816f081
SHA512 85d06a5dd4a7817df87ec04d9688ead9823ba4446e6b16a2846818e3409851c2e4c43f1201221bf9dfcb28df2812d0dd8fa0abf3834557c669c72500397459aa
TLSH
T15871239367A9D5F3C6DA5FF002835244F1FF223C0B2330200B525986AB30A3A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-429-0x00000000002C0000-0x000000000031F000-memory.dmp

Download

memory/476-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1872-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1880-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1880-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2112-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2560-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2952-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3272-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3644-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3644-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3772-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3976-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4368-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4552-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4784-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6132-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download