systex | 0a3a39358031e92fa833cc73826a9c0f7ff7728042d59570753da99a9f5a3941

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260709-v71tqaex9m
SHA256 0a3a39358031e92fa833cc73826a9c0f7ff7728042d59570753da99a9f5a3941
MD5 426e4369bd656867edbdf94bd61c9e62
SHA1 77b09b7d80098898a4d5554678f595041650a569
SHA512 44af4e1d810d1267fd2df212604968228f3c6c5e34c9180a26def477216fb252eb70d4dc3a4684afaa4f3bfefb50c04ebae29c808d6cc3bc6caa08704ff26605
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2500	vpkhcauspnhfzxrp.exe
2732	vpkhcauspnhfzxrp.sys
2972	CreateProcess.exe
980	xspkhcausn.exe
3632	CreateProcess.exe
4564	CreateProcess.exe
1780	i_xspkhcausn.exe
3620	pkhczurmke.sys
4148	CreateProcess.exe
1524	ezwupjhfzx.exe
2056	CreateProcess.exe
2760	CreateProcess.exe
5160	i_ezwupjhfzx.exe
4888	wurmjecwuo.sys
5100	CreateProcess.exe
2708	rmjebwrpjh.exe
2812	CreateProcess.exe
1540	CreateProcess.exe
4616	i_rmjebwrpjh.exe
6072	rojhbztrlj.sys
1168	CreateProcess.exe
1872	geywqomgby.exe
2916	CreateProcess.exe
5000	CreateProcess.exe
1728	i_geywqomgby.exe
3976	roigbvtrlj.sys
3244	CreateProcess.exe
2008	ywqoigaytq.exe
2392	CreateProcess.exe
4504	CreateProcess.exe
1060	i_ywqoigaytq.exe
1580	nlfdywqoig.sys
1564	CreateProcess.exe
2832	gaytqlidyv.exe
3440	CreateProcess.exe
5396	CreateProcess.exe
5312	i_gaytqlidyv.exe
1176	aysqkidavt.sys
2396	CreateProcess.exe
2652	snlidavtnl.exe
2068	CreateProcess.exe
3212	CreateProcess.exe
3268	i_snlidavtnl.exe
2664	cavsnkfdxv.sys
1640	CreateProcess.exe
2612	usnhfdxvpn.exe
5436	CreateProcess.exe
4964	CreateProcess.exe
2164	i_usnhfdxvpn.exe
3512	kfcxupmcau.sys
5860	CreateProcess.exe
3404	upnhfzxrpj.exe
4476	CreateProcess.exe
4812	CreateProcess.exe
1048	i_upnhfzxrpj.exe
6040	khczusmkec.sys
2768	CreateProcess.exe
5672	pjhbzurmje.exe
2456	CreateProcess.exe
756	CreateProcess.exe
5596	i_pjhbzurmje.exe
4916	ezwrpjhbzt.sys
6068	CreateProcess.exe
5780	urmkecwuom.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_513257987\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_513257987\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1975801251\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1814989938\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1814989938\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_595764109\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1975801251\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1814989938\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1814989938\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqlidyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvnkfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqlidyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuojhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhcausnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvnkfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpkhcauspnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqomgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqomgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhcausnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwupjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwupjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuojhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhcausn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2980	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 18 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1072	ipconfig.exe
5976	ipconfig.exe
1780	ipconfig.exe
3984	ipconfig.exe
1724	ipconfig.exe
6064	ipconfig.exe
5976	ipconfig.exe
2832	ipconfig.exe
6040	ipconfig.exe
3880	ipconfig.exe
2880	ipconfig.exe
2024	ipconfig.exe
2260	ipconfig.exe
3856	ipconfig.exe
4132	ipconfig.exe
5312	ipconfig.exe
1124	ipconfig.exe
3392	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280923315815452"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{6304E3B1-012A-4638-B5FB-0EB7C6E26B32}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe
2500	vpkhcauspnhfzxrp.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	i_xspkhcausn.exe
Token: SeDebugPrivilege	5160	i_ezwupjhfzx.exe
Token: SeDebugPrivilege	4616	i_rmjebwrpjh.exe
Token: SeDebugPrivilege	1728	i_geywqomgby.exe
Token: SeDebugPrivilege	1060	i_ywqoigaytq.exe
Token: SeDebugPrivilege	5312	i_gaytqlidyv.exe
Token: SeDebugPrivilege	3268	i_snlidavtnl.exe
Token: SeDebugPrivilege	2164	i_usnhfdxvpn.exe
Token: SeDebugPrivilege	1048	i_upnhfzxrpj.exe
Token: SeDebugPrivilege	5596	i_pjhbzurmje.exe
Token: SeDebugPrivilege	5600	i_urmkecwuom.exe
Token: SeDebugPrivilege	2892	i_wtomgebwto.exe
Token: SeDebugPrivilege	2672	i_lgdywqoiga.exe
Token: SeDebugPrivilege	1044	i_igaysqniga.exe
Token: SeDebugPrivilege	4916	i_qcausnkfdx.exe
Token: SeDebugPrivilege	5968	i_xvnkfdxvsn.exe
Token: SeDebugPrivilege	2580	i_upnhcausnh.exe
Token: SeDebugPrivilege	3428	i_kecwuojhcz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 2500	4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4276 wrote to memory of 4600	4276	2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4600 wrote to memory of 5064	4600	iexplore.exe	90
PID 5064 wrote to memory of 3556	5064	msedge.exe	91
PID 5064 wrote to memory of 1140	5064	msedge.exe	93
PID 5064 wrote to memory of 2980	5064	msedge.exe	94
PID 5064 wrote to memory of 1140	5064	msedge.exe	93
PID 5064 wrote to memory of 1140	5064	msedge.exe	93
PID 5064 wrote to memory of 5592	5064	msedge.exe	95
PID 5064 wrote to memory of 5592	5064	msedge.exe	95
PID 5064 wrote to memory of 1104	5064	msedge.exe	96
PID 5064 wrote to memory of 1104	5064	msedge.exe	96
PID 5064 wrote to memory of 1104	5064	msedge.exe	96
PID 5064 wrote to memory of 4840	5064	msedge.exe	97
PID 5064 wrote to memory of 4840	5064	msedge.exe	97
PID 5064 wrote to memory of 4840	5064	msedge.exe	97
PID 5064 wrote to memory of 1660	5064	msedge.exe	98
PID 5064 wrote to memory of 1660	5064	msedge.exe	98
PID 5064 wrote to memory of 1660	5064	msedge.exe	98
PID 5064 wrote to memory of 5880	5064	msedge.exe	99
PID 5064 wrote to memory of 5880	5064	msedge.exe	99
PID 5064 wrote to memory of 5880	5064	msedge.exe	99
PID 5064 wrote to memory of 3512	5064	msedge.exe	103
PID 5064 wrote to memory of 3512	5064	msedge.exe	103
PID 2500 wrote to memory of 2972	2500	vpkhcauspnhfzxrp.exe	104
PID 980 wrote to memory of 3632	980	xspkhcausn.exe	107
PID 5064 wrote to memory of 3304	5064	msedge.exe	110
PID 5064 wrote to memory of 5732	5064	msedge.exe	111
PID 5064 wrote to memory of 3304	5064	msedge.exe	110
PID 5064 wrote to memory of 5732	5064	msedge.exe	111
PID 5064 wrote to memory of 460	5064	msedge.exe	113
PID 5064 wrote to memory of 1932	5064	msedge.exe	114
PID 5064 wrote to memory of 1932	5064	msedge.exe	114
PID 5064 wrote to memory of 2992	5064	msedge.exe	117
PID 5064 wrote to memory of 2992	5064	msedge.exe	117
PID 2500 wrote to memory of 4564	2500	vpkhcauspnhfzxrp.exe	118
PID 2500 wrote to memory of 4148	2500	vpkhcauspnhfzxrp.exe	122
PID 1524 wrote to memory of 2056	1524	ezwupjhfzx.exe	124
PID 2500 wrote to memory of 2760	2500	vpkhcauspnhfzxrp.exe	127
PID 2500 wrote to memory of 5100	2500	vpkhcauspnhfzxrp.exe	131
PID 2708 wrote to memory of 2812	2708	rmjebwrpjh.exe	133
PID 2500 wrote to memory of 1540	2500	vpkhcauspnhfzxrp.exe	136
PID 2500 wrote to memory of 1168	2500	vpkhcauspnhfzxrp.exe	141
PID 1872 wrote to memory of 2916	1872	geywqomgby.exe	143
PID 2500 wrote to memory of 5000	2500	vpkhcauspnhfzxrp.exe	146
PID 5064 wrote to memory of 3012	5064	msedge.exe	147
PID 5064 wrote to memory of 1304	5064	msedge.exe	148
PID 5064 wrote to memory of 3112	5064	msedge.exe	149
PID 2500 wrote to memory of 3244	2500	vpkhcauspnhfzxrp.exe	153
PID 2008 wrote to memory of 2392	2008	ywqoigaytq.exe	155
PID 2500 wrote to memory of 4504	2500	vpkhcauspnhfzxrp.exe	158
PID 2500 wrote to memory of 1564	2500	vpkhcauspnhfzxrp.exe	162
PID 2832 wrote to memory of 3440	2832	gaytqlidyv.exe	164
PID 2500 wrote to memory of 5396	2500	vpkhcauspnhfzxrp.exe	167
PID 2500 wrote to memory of 2396	2500	vpkhcauspnhfzxrp.exe	171
PID 2652 wrote to memory of 2068	2652	snlidavtnl.exe	173
PID 2500 wrote to memory of 3212	2500	vpkhcauspnhfzxrp.exe	176
PID 2500 wrote to memory of 1640	2500	vpkhcauspnhfzxrp.exe	180
PID 2612 wrote to memory of 5436	2612	usnhfdxvpn.exe	182
PID 5064 wrote to memory of 564	5064	msedge.exe	185
PID 5064 wrote to memory of 564	5064	msedge.exe	185
PID 2500 wrote to memory of 4964	2500	vpkhcauspnhfzxrp.exe	189
PID 2500 wrote to memory of 5860	2500	vpkhcauspnhfzxrp.exe	193
PID 3404 wrote to memory of 4476	3404	upnhfzxrpj.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_426e4369bd656867edbdf94bd61c9e62_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Temp\vpkhcauspnhfzxrp.exe
  C:\Temp\vpkhcauspnhfzxrp.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkhcausn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2972
  - - C:\Temp\xspkhcausn.exe
      C:\Temp\xspkhcausn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkhcausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4564
  - - C:\Temp\i_xspkhcausn.exe
      C:\Temp\i_xspkhcausn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwupjhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4148
  - - C:\Temp\ezwupjhfzx.exe
      C:\Temp\ezwupjhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwupjhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2760
  - - C:\Temp\i_ezwupjhfzx.exe
      C:\Temp\i_ezwupjhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5100
  - - C:\Temp\rmjebwrpjh.exe
      C:\Temp\rmjebwrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1540
  - - C:\Temp\i_rmjebwrpjh.exe
      C:\Temp\i_rmjebwrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqomgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1168
  - - C:\Temp\geywqomgby.exe
      C:\Temp\geywqomgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqomgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5000
  - - C:\Temp\i_geywqomgby.exe
      C:\Temp\i_geywqomgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3244
  - - C:\Temp\ywqoigaytq.exe
      C:\Temp\ywqoigaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4504
  - - C:\Temp\i_ywqoigaytq.exe
      C:\Temp\i_ywqoigaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqlidyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1564
  - - C:\Temp\gaytqlidyv.exe
      C:\Temp\gaytqlidyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqlidyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5396
  - - C:\Temp\i_gaytqlidyv.exe
      C:\Temp\i_gaytqlidyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2396
  - - C:\Temp\snlidavtnl.exe
      C:\Temp\snlidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3212
  - - C:\Temp\i_snlidavtnl.exe
      C:\Temp\i_snlidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnhfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1640
  - - C:\Temp\usnhfdxvpn.exe
      C:\Temp\usnhfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnhfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Temp\i_usnhfdxvpn.exe
      C:\Temp\i_usnhfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5860
  - - C:\Temp\upnhfzxrpj.exe
      C:\Temp\upnhfzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\i_upnhfzxrpj.exe
      C:\Temp\i_upnhfzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Temp\pjhbzurmje.exe
      C:\Temp\pjhbzurmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\i_pjhbzurmje.exe
      C:\Temp\i_pjhbzurmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    PID:5084
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgebwto.exe ups_run
    3⤵
    PID:4820
  - - C:\Temp\wtomgebwto.exe
      C:\Temp\wtomgebwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgebwto.exe ups_ins
    3⤵
    PID:1104
  - - C:\Temp\i_wtomgebwto.exe
      C:\Temp\i_wtomgebwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    PID:4556
  - - C:\Temp\lgdywqoiga.exe
      C:\Temp\lgdywqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    PID:2504
  - - C:\Temp\i_lgdywqoiga.exe
      C:\Temp\i_lgdywqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqniga.exe ups_run
    3⤵
    PID:752
  - - C:\Temp\igaysqniga.exe
      C:\Temp\igaysqniga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqniga.exe ups_ins
    3⤵
    PID:1048
  - - C:\Temp\i_igaysqniga.exe
      C:\Temp\i_igaysqniga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qcausnkfdx.exe ups_run
    3⤵
    PID:1128
  - - C:\Temp\qcausnkfdx.exe
      C:\Temp\qcausnkfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qcausnkfdx.exe ups_ins
    3⤵
    PID:844
  - - C:\Temp\i_qcausnkfdx.exe
      C:\Temp\i_qcausnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvnkfdxvsn.exe ups_run
    3⤵
    PID:2312
  - - C:\Temp\xvnkfdxvsn.exe
      C:\Temp\xvnkfdxvsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvnkfdxvsn.exe ups_ins
    3⤵
    PID:2028
  - - C:\Temp\i_xvnkfdxvsn.exe
      C:\Temp\i_xvnkfdxvsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhcausnh.exe ups_run
    3⤵
    PID:1320
  - - C:\Temp\upnhcausnh.exe
      C:\Temp\upnhcausnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhcausnh.exe ups_ins
    3⤵
    PID:2204
  - - C:\Temp\i_upnhcausnh.exe
      C:\Temp\i_upnhcausnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwuojhcz.exe ups_run
    3⤵
    PID:6040
  - - C:\Temp\kecwuojhcz.exe
      C:\Temp\kecwuojhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwuojhcz.exe ups_ins
    3⤵
    PID:2288
  - - C:\Temp\i_kecwuojhcz.exe
      C:\Temp\i_kecwuojhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe73b2c188,0x7ffe73b2c194,0x7ffe73b2c1a0
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,13277516637319808281,16061867364791274454,262144 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,16672267127178517556,9527478602332660514,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
      4⤵
      System Time Discovery
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,15130017180460869142,12645400028714581558,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:13
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,13362852022286304200,9006173799465924140,2097152 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,18371665506458943522,2676392905001385721,2097152 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4843305539026052162,10070869749093891039,2097152 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,8345432894075636764,10614067205332430139,2097152 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,18324279776089398064,14110359185163185346,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12072839977548052602,11775496283888664319,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1186994116697025840,490380993059789553,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,1658863098589757068,4504395233407427328,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,1658863098589757068,4504395233407427328,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8085595840477318364,16248193106560172806,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,9160735861032880879,6983891529028781074,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,8576446504035494921,15756404901917649030,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,3086436916960910384,17106916300322771360,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,17521621745095959576,14729119338952665286,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,18289732142070139163,905738415573691374,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7335949066586397207,773358374064807311,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,5283408891604180435,9378196909610747881,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,236024803164214038,11885088814184095736,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5608,i,15775203289124239983,18203207626350757584,262144 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:10
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,7998257536172112816,8885032560405502902,524288 --field-trial-handle=2480,i,1825420131154154159,9452686551098154736,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4944

C:\Temp\vpkhcauspnhfzxrp.sys
C:\Temp\vpkhcauspnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5328

C:\Temp\pkhczurmke.sys
C:\Temp\pkhczurmke.sys
1⤵
- Executes dropped EXE
PID:3620

C:\Temp\wurmjecwuo.sys
C:\Temp\wurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
- Executes dropped EXE
PID:6072

C:\Temp\roigbvtrlj.sys
C:\Temp\roigbvtrlj.sys
1⤵
- Executes dropped EXE
PID:3976

C:\Temp\nlfdywqoig.sys
C:\Temp\nlfdywqoig.sys
1⤵
- Executes dropped EXE
PID:1580

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
- Executes dropped EXE
PID:1176

C:\Temp\cavsnkfdxv.sys
C:\Temp\cavsnkfdxv.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Temp\kfcxupmcau.sys
C:\Temp\kfcxupmcau.sys
1⤵
- Executes dropped EXE
PID:3512

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:4916

C:\Temp\geywuomgey.sys
C:\Temp\geywuomgey.sys
1⤵
PID:3924

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
PID:2468

C:\Temp\aytqljgbql.sys
C:\Temp\aytqljgbql.sys
1⤵
PID:6108

C:\Temp\xvqnlfdxvt.sys
C:\Temp\xvqnlfdxvt.sys
1⤵
PID:3816

C:\Temp\nkfcxvpnkf.sys
C:\Temp\nkfcxvpnkf.sys
1⤵
PID:5056

C:\Temp\cxusmkfcau.sys
C:\Temp\cxusmkfcau.sys
1⤵
PID:4468

C:\Temp\pjhczurmjh.sys
C:\Temp\pjhczurmjh.sys
1⤵
PID:1172

C:\Temp\rpmhcwuomh.sys
C:\Temp\rpmhcwuomh.sys
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ezwupjhfzx.exe

Path C:\Temp\ezwupjhfzx.exe
Size 376KB
SHA256 ca145315f2907e98183a24d676edb1e254bbd698811441c9b287bc21c7a3168c
MD5 8cc4fbc13a0baad7837830f34d16762d
SHA1 57836937feccf1555544a8a6913fc2f054d706b4
SHA512 1a97911663b3f720a8bb53b50722be14f5d0a53510fcfd00a08ea8514890f06b81a9843a73c5b2794dedf62ff45e4b13c4c3dc066a2b8bcb02270f51cd82e845
SSDEEP 3072:sFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:sFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqlidyv.exe

Path C:\Temp\gaytqlidyv.exe
Size 376KB
SHA256 5b361a9d33f1364f7e482197115a059024c76838133df86dd8028b5cb0a42f27
MD5 16cafd377f2b51a7815fae3c75f404a3
SHA1 1c33bcafe5037edbb480488ee5e2cc53fa8f8666
SHA512 47239c9c64c9ef980978f982ba4057c9168b9f2e2a3be84964f8bdf2fddacfcec3dd12f66f1c567fd92b719726f0f1397d87fb87b27007431dab0b05f50d5e1c
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqomgby.exe

Path C:\Temp\geywqomgby.exe
Size 376KB
SHA256 3bfedb874c5bbc098ba1420c43f8cf6a95005d24446de46b04b450ffc27aac10
MD5 96749306b5b7a2974a8018ccc731354a
SHA1 04783048dbe39f3a9e0082681cdf388055829fe8
SHA512 c580c132f7939e5d69c65610e65a38424ad9485f271aa4172f38fd201318b8546c85a81c0d933db9848769bbeeb23c9766831fb5473e63b3536dc75d71f9518b
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwupjhfzx.exe

Path C:\Temp\i_ezwupjhfzx.exe
Size 376KB
SHA256 c360798c92b46efaefc917da5d0642fa5af03e5b12d87a8564f3a952a757d2f6
MD5 e7dbaf9573964e88728ea09d385c6f6b
SHA1 64422790fe0dad7595c36ad9bc2575ea6abbf771
SHA512 459dfe51724a46c5629cf683314a627ab14ea940d226395ce2c56a85657d5489e99d4f30a62abb2a02ebdf36915f944a0f8c19bf3fa7ea8f5afc70d2be51de2c
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqlidyv.exe

Path C:\Temp\i_gaytqlidyv.exe
Size 376KB
SHA256 ee585e30705ebf102a89cf8fe5c11121018f6d20fc5b65f5773118039ea0c9bf
MD5 b896db941a355ead9701cf2350a01952
SHA1 7f1e7710849f59d104d07a16cd602bc6f02e7193
SHA512 278361eb82c54925039590a484f877053fb51259692cbcd077890c3ca337f833fa38a759a073f1976a352b3f8d624bdc443a843da5a8d6889120cf487ec63c79
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqomgby.exe

Path C:\Temp\i_geywqomgby.exe
Size 376KB
SHA256 8b83c545db1548af05e658e433c84091085fa93c3c07c1dc07535169f35afde9
MD5 3841dec684060bafa12182a0ff428a1e
SHA1 23c94e525663682ff1efcc27fc09e854d5cce763
SHA512 d8925f03b6b7c36ecdd55f248d956d606c655bf8b4d0105acb29cec623bb0965c69bef59521c50946c0de63442c3b12e88b7dc8712262aa111234e2a2822f21c
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjebwrpjh.exe

Path C:\Temp\i_rmjebwrpjh.exe
Size 376KB
SHA256 fbec4a431a9ca2ae2efa82099cbb79680072f0dc1fa3d59e368e1b5b33dffe54
MD5 a4c7aa7c4ba8ccdb12831cb4a51686ca
SHA1 5ded860785c6906b9d86a3727b6873aa6207cc54
SHA512 5439e87eaf88296aaadfb3b74896d805d2106b19ba1f4059034969fd9ae746d6ea6d624ba3490a22ebb3770d41c4fa6805fcefccdbfa38bb616cfdaea2b92f6b
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkhcausn.exe

Path C:\Temp\i_xspkhcausn.exe
Size 376KB
SHA256 1112a249097fc734d5a0eb19c2b65baa8fc6ea762f3077d59a009d9847272a8e
MD5 ae14afcd8a290479b79e6932f3959747
SHA1 57d7fa17c01dc4e36eb830b405b1bb950fdf8480
SHA512 168a286380c2a1250f2295ee909d7c78ff67c619bbf2118db638323aa8ab239518a5ee55085d012f35c6a78c6dda43096134b78dd69d8083e55c0e280801c976
SSDEEP 3072:3FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigaytq.exe

Path C:\Temp\i_ywqoigaytq.exe
Size 376KB
SHA256 35458662fc8ce5201d026c4f49b3e69b162ae773f980d5a2d3f33bc6af016519
MD5 868394087ba5e2499eabd1691ec8ed14
SHA1 19ba3aef0de61c8873f28a20434821aa460e0322
SHA512 a241a06abaee7bab8a9d398f86259211ae01e205bad902de391a72bc7683c9a5797cc33b2bbb13f7e8a334d805440b2a8b5b50f6e1f72c5e91e39ff6070a56b6
SSDEEP 3072:pHFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBL:1FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T189847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdywqoig.sys

Path C:\Temp\nlfdywqoig.sys
Size 293KB
SHA256 fb06213a06eec5474260affc29c2264934db3e557b12162681e83ac44f5e694e
MD5 b2623df1f5986f0a1e9ae92058c0d0b9
SHA1 e1746b7ea5c09380feb000cc9981f889b759af12
SHA512 93919d748d874f632b2c8feff9403465aa7ed3b913e1652ec1338ef2bbc7533a044e55434af72833b337ba83860dd861b281ab9d5f5789106b5e2b81ce5a17a1
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczurmke.sys

Path C:\Temp\pkhczurmke.sys
Size 293KB
SHA256 76cd0ef1ab891a650121caaf7185d6f68e49b119da224b604de1f45aee9ffe11
MD5 515254d739dc82cda93c81cecc524849
SHA1 57ba8046a7b5056567836c2965560a744e523226
SHA512 8f216cff26b6c55bd95881e6f6d801b1d0c42268049fc6f248faadae18174a0c0ff10373f4a517eabf0fa3b4cbceed0a11d6ddd5635954c54252e50787f850be
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T14C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebwrpjh.exe

Path C:\Temp\rmjebwrpjh.exe
Size 376KB
SHA256 c7f7fd6c88c1f1cf70f59c213f447e6da7344602c7af48f5b5a1d478eb444786
MD5 74bc3a087e96de95a9270dbcabfb12a8
SHA1 68ca857f9d32654d119ff50e7351fc5c4d28e006
SHA512 04ae398bab4e7126b1fe6d30cda8fae77a146b79cff468720e0d68b8bdc2fb2d2407840ba1b6fc8cabf37f299040c2faac7de35baf4a4d63a2c7929565e32654
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T112847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roigbvtrlj.sys

Path C:\Temp\roigbvtrlj.sys
Size 293KB
SHA256 5faf658866842d373e5ab458b5c73e51f00a0ad95e6eb3ca0afada595b217db6
MD5 6a44ec5f3e2ca1dad40c514b8e177931
SHA1 b0170748cbfed83e45657763b241a93ac1f0f098
SHA512 d883ec86255536303099e55dd702e20e8051ce9297599a5430e6a4754aa3b3e48ea004f6f4adbb29a060f3d90cbad3ba8fc3472ccaefab5371c5eb4308e971ba
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrlj.sys

Path C:\Temp\rojhbztrlj.sys
Size 293KB
SHA256 400022ce3c3bf6d785ec5cded88d291e27321bbd32144633de1a904f3c110be0
MD5 5187b5a467a523ba3473c040581b67d9
SHA1 208c619f5b6dfb4c1720294f9e04590a27fe2d0e
SHA512 4eeb91ac82b5b0c978b40bd8614ccfb35fc3d6e66925a0a2abf05288a128acceac226076a9ee49427ab122ca44e105afd6ad349c5e70149236d912b3e0c86b70
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T14F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpkhcauspnhfzxrp.exe

Path C:\Temp\vpkhcauspnhfzxrp.exe
Size 376KB
SHA256 706f6421dbfb38c803953217e60cac1e3a3c192fcb8379f048a2a87905190b02
MD5 e6be314ce0871a55efd7e8576e2c8e1c
SHA1 cff5de73fdd34e7214f9b8fb7e325cf6304ff842
SHA512 5c781541f63e6f398db3e49ed915de12545fd2cb62fb7bdc93e6f8daec0da00a357bf875b3c4ab6b9b9cb19aaa425c15924e165b5b1b5286e1406907d2d8980e
SSDEEP 3072:gFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpkhcauspnhfzxrp.sys

Path C:\Temp\vpkhcauspnhfzxrp.sys
Size 293KB
SHA256 a99470a85ad669c991de650ee99541b6c6a58d96a46df4283113346e8b543e7d
MD5 22fb640993b9ae20fbbc59b37c86391b
SHA1 f5fae216ef8152cbddeff81e2a3d437ab5dda3a1
SHA512 450fc1249e98a9dcf64c4ba165b41f58358c08bdf6e1f025b43eac37ea088261fd9dac265c771e5f0a60eb1887202b8cd445eb65529fed60cebb00e75ad30e14
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T190545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurmjecwuo.sys

Path C:\Temp\wurmjecwuo.sys
Size 293KB
SHA256 a918067b02597161c6dadac972450cac736d57b851ac016a0fe5b784ef17bde1
MD5 6a9768d80b5f6b98d28e895eaf3e322b
SHA1 e7919e1720f3768ab26a7eaa29b1f3730ee66afb
SHA512 6377439c6c7b5a022732f4001a71bb62c84584b613f737437743e3195587e6bca41035ca1f60f5c5952a4e713131b5abece4b3dbf5237bf259c0940b4c0f2081
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T149545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcausn.exe

Path C:\Temp\xspkhcausn.exe
Size 376KB
SHA256 6e8ccf6d0f23c99024357ad59eba9314f96f21239290d0daacfe7aa1b3c066fc
MD5 9bbf0ceecbd8cf82e00e6d298e58c03f
SHA1 d6dcb3a8a864db567783e7840c96b238d8244c27
SHA512 e8e52b576b153377b8df5a0fde485162d50080e43bb7754052e1490e4cedf56c039a1c56ce9f4df05959d9338174874dc14b1339d54e6ff28cbba9ec6a67e188
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaytq.exe

Path C:\Temp\ywqoigaytq.exe
Size 376KB
SHA256 c016abff02163d066399e13a71f1bc1829ba8c17928439500240952ed4af65d8
MD5 34ae6dcc088c5c433b824409ef0bd8ea
SHA1 827f88925b45bf9fb1661846561a32d49c1cad1d
SHA512 1a21981a8ec2864e3230dce50c9e685d8ce24ade674d7fc00878b383cb8f83d431be23f4235327f6959771123e407ac7e8aedeb9e426bbded283fae8d1b499e4
SSDEEP 3072:7FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9fe82d5f89c093b9e73bc61db1da47b34ed26b4bc4ce053a376d95b06e248beb
MD5 b67e56e2cf3581861507f308f128a4b2
SHA1 4790a7b2b125ba2d334c30cf03dafd3a44da2c15
SHA512 fd22534f43f03d6756f66d84b103b212adc924d91541c367fff64c4201692480d2f4a5275b267ad2fa32b4a23db117666ee6a633564a65ea97ba291b29aefec5
TLSH
T138D02BE623544C88C0C031323972B348A1005E20024511DC1500B1388CE22C105030E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99856548fba2b09b26625f38792bc79bdd7b32d45b519c4f695f0c02b1f9b790
MD5 56cad0e2a0b77dbb713fe58128bdd05f
SHA1 bbbc2d67892cc177ca9a4cdd80e59b98d7e85044
SHA512 45e78603d1d496442fe7415895fb68db4abe5c366b4cc78a7aacc8ee188c19be13c62ca471f444e7cf61081562ad79aca905719506e78854282bd937745810ad
TLSH
T17BD02BEA23444D88C0C031323971B348A1105E20124511DC140071388CE22C105030F9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b2b889d8a0041715ec0e031c1893e824c9e10015501c43423ece1b5348588447
MD5 db722b308e89b23bef7ea61e194148fd
SHA1 ed9b22f4e8d855be198c71f19f57b4d45684d42d
SHA512 1118e92464c96e940b1b4851ad290888a25d42d21b1ca81a8c2f2f8083e6aac005243eba1d2fc9689263fea98189c329bffc373bf8ae1134958bb2f65049ac58
TLSH
T1A161CA9533320AD2CB1D42B261D556993570A77F43CF6F06EA8461B8B8FABD49301DE4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b629dd5eb254420e65109511dff9e56534840f022f04b13af6367a8d84be4e06
MD5 147898528bff940b3491fdbe3a506454
SHA1 af74f6303ce39cc0e74927ce7c5d03fd70e3d136
SHA512 7669284db16c2d4c193f33a0981e17cb8cfd413d1bcf39b4975160938055046ac6a6eb9ea452c8dce36baa67c750c39b30457544759b88e4919c855bd4d9ec8e
TLSH
T1FD41CDF3C3E4866EC91186F0AB187E1BCE2D0911832C3D5AC9E4AE1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0c832215dc74a374592ec22b53932366ed630fa0be1653ee8b80764c6f064bfb
MD5 cc1bfafdc1a51cee41eed04cbe3c5e70
SHA1 2feb21ff427dbde16e8d59b5069188c6b22bfe2b
SHA512 aa98518e3df5ebb6d181b4b0210f2202ffa8b040ce1ac08b2d5032c3e62712ef88790a517afe79220b91779ac785eb0d6c9bbb1c7b48cd342ce2dd1c77c42884
SSDEEP 192:sxR9RTyM/jK1Ml8wCr/ftsIORWlZpoJzoA8pi/g6+WNIYntEbM4GzIgtJ:sxR9H8r/ftsIOsLpoUi/5IGf3
TLSH
T16E52EB166A34993BCCDBD209FA557F53D6F91573A2901E44AAFCCA0C00E66ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 841d2ea3bd096d8598062eec3cf4d53d9d51cc20ed4679fbba6512c76b26e1d9
MD5 b4d5f651fab6320df2557665398ec560
SHA1 e604003a09653ad26b754a1aa487fe5aed45f198
SHA512 c1d44af88eb15dc09d5db6fe7b01440e8ead89f85d11e44b0c6b9103cd0ccf79ff5c357c0ec9a025269c3db0c45dacdc151493542a87b528db5a1a8bc4947a03
SSDEEP 192:sxRqRTyM/jK1Ml8UQXQCr/ftstORslZpoJzoA8pw/g6+WNIYnNbM4GzIgDmJ:sxRqHqXr/ftstOSLpoUw/5I7f2
TLSH
T1E362D9166A24993BDCDBD209FA527F53D6F95473A2941E44AAFCCB0C00E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 20276f1711c8f5a7d4fdb11685b431cdbaaa5c442d7d270cb9284dbc095f5bb0
MD5 6cf0d0572c042c1d493bc235d9752757
SHA1 fbae639198f9276c49cdd3c0a6d59b2d7944ffd9
SHA512 7d15e2c0b29c3f6a6e989137ca5f7cb711f0b6c8a05921acc8e7a621e655611f2659757de0977490c74aaf6773cddd295187ff85aa5b9779371060a4b2009902
SSDEEP 192:sxRqRTyM/jK1Ml8wCr/ftstORWlZpoJzoA8pi/g6+WNIYntEbM4GzIgDwJ:sxRqH8r/ftstOsLpoUi/5IGfY
TLSH
T1BF52DB166A34997BCCDBD209FA567F53D6F91473A2941E449AFCCA0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e70f82e90fdc830a00ad659debcf85a8ebc116ec43d5da5b616aec074282cb86
MD5 0f3fd7fdae5f9f508dc6880d08c8d70e
SHA1 2a6821ea56380cb597ed783c25e2ea235f7db0bd
SHA512 bfcba35973eca98bf576e394de158fb5a17abbc7af3a92f79d5929ff1249a08bf9c11a733f32ed138bc2fae67de4f2395121d280765683c0e3d8d463c32b987d
SSDEEP 768:BwSIrY7pLuL7cxWghdfAx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc0QLwhro0VM22:BwSIrEE7cxWghdfAxu1jaQc0Ewa0OB
TLSH
T1ABE2EC7B680CCB7F4F804A9CEC29BD9E6DA801CF56D8895447FA880C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b37e0181-9a12-452b-b7d3-660fef439182.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b37e0181-9a12-452b-b7d3-660fef439182.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e6cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e6cc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1b4a0cfe29fe8a947fbd6d482b02f5767dd39cb8a6ff57e26d89e32064472eb8
MD5 fa1b2e79f1ef7def6f63b6f196ccfb19
SHA1 1718055e76f916db7a091421c5ccda699bd9655a
SHA512 cc9d6df84e47ddaf41b88b65aa689997869f73548cdd05a1ef28c1670d2a02b92afd35c8877c502535ef96bfb4ab3233d03c84f4c2cdcc59c0e57aaace56ee4a
SSDEEP 768:lrv+4UNbdx39f6aLsjkYpjxLlVPgd5663k/JUiixe/:lbsbT3ZJm93Pf6UxUvI
TLSH
T14903C036D4A8E673ECE6D284B1476516BFF8619786C40B94C1EA2F0E458B09E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f0a19ec458e741cbd91123543fb758b15bf5e8bb6fb793549419a55313631afa
MD5 36e3ce55b7871badf2d9f2146935cf6d
SHA1 dce1fb0fab0d861b276ddaab276f8dc5f2dae795
SHA512 ea0a5e0a34cebad252d63b7ef7aff6f0aa8fc748849706f54a618756a5675b2550efb84a90c87309c8eb9349a86cf400c424e080c5c9c9840eb8f0be80b8cd1b
SSDEEP 768:rj+993eex0gLsjm7YpjxLlVPgd5663kHQb9MY:+993e6m93Pf6Uwb+Y
TLSH
T18AF2C03594669EB39CD6D298F14B3685BFF411BB85C41E04D6DA9F0E08C32EE531BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 77c156645e87bd8366152f0cadc497292f807129823497854661e9af792267e4
MD5 09b8251ed4359a11aff9bcc0774ab4a0
SHA1 2b1dfcd467803fbac9eda4cae4ed9aa562534d2c
SHA512 eda6a59fb9b0a0a98ad51175e219bfb1fc5925b181cfd9074ccaa640e284d74ed71253ee1b6cdf501abd8b273b5b92cf145ade38e558a0516747c48728b0a564
SSDEEP 768:Kj+993rexhgLsjmbYpjxLlVPgd5663kHQb9MY:p993r1m93Pf6Uwb+Y
TLSH
T181F2CF3594669EB39CD6D2A4F14B3685BFF411BB85C41E04D2EAAF0E08C32DE531BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

e761d0e9-9d51-48ea-87c5-e2815d720c44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e761d0e9-9d51-48ea-87c5-e2815d720c44.tmp
Size 38KB
SHA256 9716ea1bcc4b8626258b315cfae430c1f23ac4fb6e2082b6dd8440876b7c5976
MD5 8a65c17eb2fe16a5cca316f05ba7b34b
SHA1 e7e2cb16096945f2f4fd677d401f98e74bd3ae94
SHA512 a416425b8b752a78a67967cea47fd272802dd357adb3ca87aeeb1be326dbce3164fd9a2df3a9705f73dbb6b05fe99e63149ec6220e3a7fe161d2e7d3f6d99a24
SSDEEP 768:3F1j+9h36wgOexhF8jmPYpjxLlVPgd5663kHQb9MY:+9h3BYm93Pf6Uwb+Y
TLSH
T1B6039D36D8A5DB7BACE287D4F64B3689EEE011B785C85D84E6DA9E0D04C31DE030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fa14c42-31dd-4d16-8f2a-fd4c18a59371.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8fa14c42-31dd-4d16-8f2a-fd4c18a59371.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5064_908411751\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a3ae315a53662d359a509e1eaa042d74a148522e73362f52b711bd911141afc3
MD5 158e369d4cc60bca30a6d1885436e3fe
SHA1 8ee4e79fd500013cecc3dc8b724d238c73157897
SHA512 ba9a4f99ea776a0a7213607fc242b7f6e46340064e124734bfbd88186587a3766583ce66801df59d18da25fb57db539231600f77ddd02cd94d32db29d7cf9344
TLSH
T12871008366A9C9B3C1DA5FF003835244F1FB227C077320204B515986AB30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1172-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1176-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1580-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2468-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2732-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3620-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3816-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3924-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3976-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4916-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5056-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6108-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download