systex | ee9c130a23f2a292ce386f97dd7cca1500caa7c404f5d92d560598522aef4d9a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260712-kft7ragx7w
SHA256 ee9c130a23f2a292ce386f97dd7cca1500caa7c404f5d92d560598522aef4d9a
MD5 bb42b91b6457ae169b2ce2a02f73909e
SHA1 4288f49702c4c83d6b9cb28a96d48423dde353e6
SHA512 5612fcc32aaa84d00545313d627f74fd5336d61c6cecc0843f639d2ca76e3b79c2ce3c0412d1f0b40742d0140c475769b4fb8298faf7a95bddf005522ef62c2f
SSDEEP 3072:1FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3356	ljebwtomgeywqojg.exe
1160	ljebwtomgeywqojg.sys
4708	CreateProcess.exe
5112	oljdbwtomg.exe
4688	CreateProcess.exe
292	CreateProcess.exe
4796	i_oljdbwtomg.exe
2532	olgdywqoig.sys
4144	CreateProcess.exe
1360	aytqoigays.exe
1916	CreateProcess.exe
5168	CreateProcess.exe
4732	i_aytqoigays.exe
5096	gaysqkidav.sys
1896	CreateProcess.exe
3428	ysqkicavsq.exe
696	CreateProcess.exe
2764	CreateProcess.exe
5064	i_ysqkicavsq.exe
2320	nlfdavtnlf.sys
260	CreateProcess.exe
5332	usnkfcausn.exe
2500	CreateProcess.exe
4192	CreateProcess.exe
236	i_usnkfcausn.exe
3468	mkicausmkf.sys
4272	CreateProcess.exe
4416	faxspkhfax.exe
3332	CreateProcess.exe
2008	CreateProcess.exe
3816	i_faxspkhfax.exe
4600	nhfzxrpkhc.sys
5988	CreateProcess.exe
4580	cwusmkecxu.exe
4360	CreateProcess.exe
4616	CreateProcess.exe
3820	i_cwusmkecxu.exe
5428	omhecwuomh.sys
1736	CreateProcess.exe
2516	ecwuomhezx.exe
4528	CreateProcess.exe
4636	CreateProcess.exe
4820	i_ecwuomhezx.exe
2392	uomjebwuom.sys
1624	CreateProcess.exe
540	dbztrljebw.exe
3536	CreateProcess.exe
4368	CreateProcess.exe
4344	i_dbztrljebw.exe
4864	gbztrojgby.sys
3404	CreateProcess.exe
4960	ebwtolgeyw.exe
2820	CreateProcess.exe
5920	CreateProcess.exe
5460	i_ebwtolgeyw.exe
2624	ytqoigbywq.sys
5872	CreateProcess.exe
6124	tnljdbvtnl.exe
1792	CreateProcess.exe
4176	CreateProcess.exe
432	i_tnljdbvtnl.exe
5976	vqnlfdyvqo.sys
1612	CreateProcess.exe
2708	vsqkidavtn.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1471712777\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1543136954\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_525424259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_525424259\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1471712777\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1471712777\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_28174936\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1543136954\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1471712777\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfcayvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczxvpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkeczurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfcayvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczxvpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkeczurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcausn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
400	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
788	ipconfig.exe
5472	ipconfig.exe
2140	ipconfig.exe
2608	ipconfig.exe
3376	ipconfig.exe
5848	ipconfig.exe
1392	ipconfig.exe
4936	ipconfig.exe
4256	ipconfig.exe
2600	ipconfig.exe
708	ipconfig.exe
4840	ipconfig.exe
4548	ipconfig.exe
5856	ipconfig.exe
4864	ipconfig.exe
2520	ipconfig.exe
852	ipconfig.exe
2828	ipconfig.exe
4296	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283187931777298"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{6F2FA54E-17CC-4054-8002-7C918B614D06}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3356	ljebwtomgeywqojg.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3356	ljebwtomgeywqojg.exe
3356	ljebwtomgeywqojg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	i_oljdbwtomg.exe
Token: SeDebugPrivilege	4732	i_aytqoigays.exe
Token: SeDebugPrivilege	5064	i_ysqkicavsq.exe
Token: SeDebugPrivilege	236	i_usnkfcausn.exe
Token: SeDebugPrivilege	3816	i_faxspkhfax.exe
Token: SeDebugPrivilege	3820	i_cwusmkecxu.exe
Token: SeDebugPrivilege	4820	i_ecwuomhezx.exe
Token: SeDebugPrivilege	4344	i_dbztrljebw.exe
Token: SeDebugPrivilege	5460	i_ebwtolgeyw.exe
Token: SeDebugPrivilege	432	i_tnljdbvtnl.exe
Token: SeDebugPrivilege	3712	i_vsqkidavtn.exe
Token: SeDebugPrivilege	976	i_vpnlfcayvp.exe
Token: SeDebugPrivilege	2156	i_vpnhfaxsqk.exe
Token: SeDebugPrivilege	4256	i_pkhczxvpmk.exe
Token: SeDebugPrivilege	2812	i_smkeczurpj.exe
Token: SeDebugPrivilege	2372	i_trojhbztrm.exe
Token: SeDebugPrivilege	2324	i_ztrmjebwtr.exe
Token: SeDebugPrivilege	5792	i_tqoigbywqo.exe
Token: SeDebugPrivilege	4396	i_ytqljdbvtn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3356	3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3020 wrote to memory of 4060	3020	2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4060 wrote to memory of 4128	4060	iexplore.exe	90
PID 4128 wrote to memory of 4072	4128	msedge.exe	91
PID 4128 wrote to memory of 5600	4128	msedge.exe	92
PID 4128 wrote to memory of 400	4128	msedge.exe	93
PID 4128 wrote to memory of 5600	4128	msedge.exe	92
PID 4128 wrote to memory of 5600	4128	msedge.exe	92
PID 4128 wrote to memory of 2932	4128	msedge.exe	94
PID 4128 wrote to memory of 2932	4128	msedge.exe	94
PID 4128 wrote to memory of 1888	4128	msedge.exe	96
PID 4128 wrote to memory of 1888	4128	msedge.exe	96
PID 4128 wrote to memory of 1888	4128	msedge.exe	96
PID 4128 wrote to memory of 3024	4128	msedge.exe	97
PID 4128 wrote to memory of 3024	4128	msedge.exe	97
PID 4128 wrote to memory of 3024	4128	msedge.exe	97
PID 4128 wrote to memory of 1500	4128	msedge.exe	98
PID 4128 wrote to memory of 2156	4128	msedge.exe	99
PID 4128 wrote to memory of 1500	4128	msedge.exe	98
PID 4128 wrote to memory of 1500	4128	msedge.exe	98
PID 4128 wrote to memory of 2156	4128	msedge.exe	99
PID 4128 wrote to memory of 2156	4128	msedge.exe	99
PID 4128 wrote to memory of 3160	4128	msedge.exe	100
PID 4128 wrote to memory of 3160	4128	msedge.exe	100
PID 3356 wrote to memory of 4708	3356	ljebwtomgeywqojg.exe	104
PID 5112 wrote to memory of 4688	5112	oljdbwtomg.exe	107
PID 4128 wrote to memory of 2704	4128	msedge.exe	111
PID 4128 wrote to memory of 5728	4128	msedge.exe	110
PID 4128 wrote to memory of 2704	4128	msedge.exe	111
PID 4128 wrote to memory of 5728	4128	msedge.exe	110
PID 4128 wrote to memory of 1372	4128	msedge.exe	113
PID 4128 wrote to memory of 4528	4128	msedge.exe	114
PID 4128 wrote to memory of 4528	4128	msedge.exe	114
PID 4128 wrote to memory of 4824	4128	msedge.exe	117
PID 4128 wrote to memory of 4824	4128	msedge.exe	117
PID 3356 wrote to memory of 292	3356	ljebwtomgeywqojg.exe	118
PID 3356 wrote to memory of 4144	3356	ljebwtomgeywqojg.exe	122
PID 1360 wrote to memory of 1916	1360	aytqoigays.exe	124
PID 3356 wrote to memory of 5168	3356	ljebwtomgeywqojg.exe	127
PID 3356 wrote to memory of 1896	3356	ljebwtomgeywqojg.exe	131
PID 3428 wrote to memory of 696	3428	ysqkicavsq.exe	133
PID 3356 wrote to memory of 2764	3356	ljebwtomgeywqojg.exe	136
PID 3356 wrote to memory of 260	3356	ljebwtomgeywqojg.exe	141
PID 5332 wrote to memory of 2500	5332	usnkfcausn.exe	143
PID 3356 wrote to memory of 4192	3356	ljebwtomgeywqojg.exe	146
PID 4128 wrote to memory of 1888	4128	msedge.exe	148
PID 4128 wrote to memory of 4372	4128	msedge.exe	149
PID 4128 wrote to memory of 3368	4128	msedge.exe	150
PID 3356 wrote to memory of 4272	3356	ljebwtomgeywqojg.exe	153
PID 4416 wrote to memory of 3332	4416	faxspkhfax.exe	155
PID 3356 wrote to memory of 2008	3356	ljebwtomgeywqojg.exe	158
PID 3356 wrote to memory of 5988	3356	ljebwtomgeywqojg.exe	162
PID 4580 wrote to memory of 4360	4580	cwusmkecxu.exe	164
PID 3356 wrote to memory of 4616	3356	ljebwtomgeywqojg.exe	167
PID 3356 wrote to memory of 1736	3356	ljebwtomgeywqojg.exe	171
PID 2516 wrote to memory of 4528	2516	ecwuomhezx.exe	173
PID 4128 wrote to memory of 5360	4128	msedge.exe	176
PID 4128 wrote to memory of 5360	4128	msedge.exe	176
PID 4128 wrote to memory of 5360	4128	msedge.exe	176
PID 4128 wrote to memory of 4840	4128	msedge.exe	177
PID 4128 wrote to memory of 4840	4128	msedge.exe	177
PID 4128 wrote to memory of 4840	4128	msedge.exe	177
PID 3356 wrote to memory of 4636	3356	ljebwtomgeywqojg.exe	178
PID 3356 wrote to memory of 1624	3356	ljebwtomgeywqojg.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_bb42b91b6457ae169b2ce2a02f73909e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Temp\ljebwtomgeywqojg.exe
  C:\Temp\ljebwtomgeywqojg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\Temp\oljdbwtomg.exe
      C:\Temp\oljdbwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:292
  - - C:\Temp\i_oljdbwtomg.exe
      C:\Temp\i_oljdbwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\aytqoigays.exe
      C:\Temp\aytqoigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5168
  - - C:\Temp\i_aytqoigays.exe
      C:\Temp\i_aytqoigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicavsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1896
  - - C:\Temp\ysqkicavsq.exe
      C:\Temp\ysqkicavsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\i_ysqkicavsq.exe
      C:\Temp\i_ysqkicavsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnkfcausn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:260
  - - C:\Temp\usnkfcausn.exe
      C:\Temp\usnkfcausn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnkfcausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\i_usnkfcausn.exe
      C:\Temp\i_usnkfcausn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspkhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Temp\faxspkhfax.exe
      C:\Temp\faxspkhfax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspkhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Temp\i_faxspkhfax.exe
      C:\Temp\i_faxspkhfax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwusmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5988
  - - C:\Temp\cwusmkecxu.exe
      C:\Temp\cwusmkecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwusmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4616
  - - C:\Temp\i_cwusmkecxu.exe
      C:\Temp\i_cwusmkecxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1736
  - - C:\Temp\ecwuomhezx.exe
      C:\Temp\ecwuomhezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\i_ecwuomhezx.exe
      C:\Temp\i_ecwuomhezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1624
  - - C:\Temp\dbztrljebw.exe
      C:\Temp\dbztrljebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4368
  - - C:\Temp\i_dbztrljebw.exe
      C:\Temp\i_dbztrljebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3404
  - - C:\Temp\ebwtolgeyw.exe
      C:\Temp\ebwtolgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5920
  - - C:\Temp\i_ebwtolgeyw.exe
      C:\Temp\i_ebwtolgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\tnljdbvtnl.exe
      C:\Temp\tnljdbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\i_tnljdbvtnl.exe
      C:\Temp\i_tnljdbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1612
  - - C:\Temp\vsqkidavtn.exe
      C:\Temp\vsqkidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkidavtn.exe ups_ins
    3⤵
    PID:5592
  - - C:\Temp\i_vsqkidavtn.exe
      C:\Temp\i_vsqkidavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnlfcayvp.exe ups_run
    3⤵
    PID:3024
  - - C:\Temp\vpnlfcayvp.exe
      C:\Temp\vpnlfcayvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnlfcayvp.exe ups_ins
    3⤵
    PID:5432
  - - C:\Temp\i_vpnlfcayvp.exe
      C:\Temp\i_vpnlfcayvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxsqk.exe ups_run
    3⤵
    PID:1920
  - - C:\Temp\vpnhfaxsqk.exe
      C:\Temp\vpnhfaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
    3⤵
    PID:4856
  - - C:\Temp\i_vpnhfaxsqk.exe
      C:\Temp\i_vpnhfaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczxvpmk.exe ups_run
    3⤵
    PID:6044
  - - C:\Temp\pkhczxvpmk.exe
      C:\Temp\pkhczxvpmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczxvpmk.exe ups_ins
    3⤵
    PID:4432
  - - C:\Temp\i_pkhczxvpmk.exe
      C:\Temp\i_pkhczxvpmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkeczurpj.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\smkeczurpj.exe
      C:\Temp\smkeczurpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkeczurpj.exe ups_ins
    3⤵
    PID:5172
  - - C:\Temp\i_smkeczurpj.exe
      C:\Temp\i_smkeczurpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trojhbztrm.exe ups_run
    3⤵
    PID:3724
  - - C:\Temp\trojhbztrm.exe
      C:\Temp\trojhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trojhbztrm.exe ups_ins
    3⤵
    PID:4068
  - - C:\Temp\i_trojhbztrm.exe
      C:\Temp\i_trojhbztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjebwtr.exe ups_run
    3⤵
    PID:4728
  - - C:\Temp\ztrmjebwtr.exe
      C:\Temp\ztrmjebwtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjebwtr.exe ups_ins
    3⤵
    PID:1972
  - - C:\Temp\i_ztrmjebwtr.exe
      C:\Temp\i_ztrmjebwtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigbywqo.exe ups_run
    3⤵
    PID:2692
  - - C:\Temp\tqoigbywqo.exe
      C:\Temp\tqoigbywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigbywqo.exe ups_ins
    3⤵
    PID:2616
  - - C:\Temp\i_tqoigbywqo.exe
      C:\Temp\i_tqoigbywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    PID:3100
  - - C:\Temp\ytqljdbvtn.exe
      C:\Temp\ytqljdbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    PID:2928
  - - C:\Temp\i_ytqljdbvtn.exe
      C:\Temp\i_ytqljdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,7648421644440624507,15284618524715865111,262144 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10607196125995769782,3689629921940912707,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
      4⤵
      System Time Discovery
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,1541925555746078835,1706699882893943944,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,13945066337666886354,14142818532247520656,2097152 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,5237309165341241256,3194410126378889611,2097152 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,14199756790550942470,7389830706711311316,2097152 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:9
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,9972226302111349709,13491893884062979561,2097152 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7196490694979958025,3317031065691559240,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,12878156106771715003,4205023920408320335,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,5417390992684047929,12119734810984058473,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5736315651447414849,2979385975183687790,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5736315651447414849,2979385975183687790,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4571258131636508263,8345528908676333279,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,16914895807664703230,6028847365483280842,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,12811980361841646052,5220658599111244940,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,2136232419401453969,6056074233564605900,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,4260078166037380762,18410670399277721396,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5668,i,16880030815748724610,14054129963839535410,2097152 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6652,i,14512868172727545197,11046433496896365570,2097152 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,2446315524415586017,10144243564207979470,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,2882782065311358061,3530227872106458864,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,18102136047862510671,10953354919989768475,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15649679579269451801,14830619317627786604,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,6565463160699858154,15926802229499657008,262144 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:10
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,2785079036350788375,8133417601560209871,524288 --field-trial-handle=2304,i,18439810812607070880,6181879637146472228,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:14
      4⤵
      PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6140

C:\Temp\ljebwtomgeywqojg.sys
C:\Temp\ljebwtomgeywqojg.sys
1⤵
- Executes dropped EXE
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5424

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:2532

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
- Executes dropped EXE
PID:5096

C:\Temp\nlfdavtnlf.sys
C:\Temp\nlfdavtnlf.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\mkicausmkf.sys
C:\Temp\mkicausmkf.sys
1⤵
- Executes dropped EXE
PID:3468

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:4600

C:\Temp\omhecwuomh.sys
C:\Temp\omhecwuomh.sys
1⤵
- Executes dropped EXE
PID:5428

C:\Temp\uomjebwuom.sys
C:\Temp\uomjebwuom.sys
1⤵
- Executes dropped EXE
PID:2392

C:\Temp\gbztrojgby.sys
C:\Temp\gbztrojgby.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\ytqoigbywq.sys
C:\Temp\ytqoigbywq.sys
1⤵
- Executes dropped EXE
PID:2624

C:\Temp\vqnlfdyvqo.sys
C:\Temp\vqnlfdyvqo.sys
1⤵
- Executes dropped EXE
PID:5976

C:\Temp\avsnlidays.sys
C:\Temp\avsnlidays.sys
1⤵
PID:4132

C:\Temp\xvpnifdxvp.sys
C:\Temp\xvpnifdxvp.sys
1⤵
PID:816

C:\Temp\pkhcausmkh.sys
C:\Temp\pkhcausmkh.sys
1⤵
PID:5512

C:\Temp\pmkeczurpj.sys
C:\Temp\pmkeczurpj.sys
1⤵
PID:1444

C:\Temp\czurmjeczu.sys
C:\Temp\czurmjeczu.sys
1⤵
PID:4568

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
PID:1960

C:\Temp\trljgbytrl.sys
C:\Temp\trljgbytrl.sys
1⤵
PID:1956

C:\Temp\yvtqljdbvt.sys
C:\Temp\yvtqljdbvt.sys
1⤵
PID:4864

C:\Temp\ysqkifdbvs.sys
C:\Temp\ysqkifdbvs.sys
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqoigays.exe

Path C:\Temp\aytqoigays.exe
Size 376KB
SHA256 a4ce8f28f7c1d4b26e98fd5767d8e2c8725927d1b4009b8e529dbcf63ed759ba
MD5 62a4fa9a55bb315e9cde2bd2be19d76a
SHA1 74e3cae9b941ca0f327f9060e6329a9a42c4c4ab
SHA512 8c8aef8f8e816755b0bf727bdcc23587b0c79ac34511c150d63701a5196abb6e392e71cd592114869ac3d21d61802cdfc1aa68155f75b9aa7f7d064390c2925e
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwusmkecxu.exe

Path C:\Temp\cwusmkecxu.exe
Size 376KB
SHA256 d49a62ff9672234553da981eb8591c06b848bdd726e86a884a514bef047148c7
MD5 2e5aecd5a20bff032b8a53c36f33a2cd
SHA1 08462efed880bf484d048047c9fa8f231a396ad9
SHA512 a7e63befd6a860eb645a5cf06cd4faeaf4736313951841a405dae66d60c361c7420f037a6554a1fcd507fea124e1acb2e8b23b7a1b4a52ebe498e3ec55a8989d
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkhfax.exe

Path C:\Temp\faxspkhfax.exe
Size 376KB
SHA256 2d54d44686a41917c2425cca6e25aa25f9c9b31527738dfdf3996fe87a661e69
MD5 83ccfc9fff0e905b7170236e891c43a5
SHA1 d31635c42282c8063543986843221d1430e4dcb0
SHA512 34ec2044e11dda74d4a30dae530878a4213b0557eec1bffe4604d29e776662a427439f12d9e7ff03a4cda49fc621f8c272794ab8cc63f398df144e468f542324
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkidav.sys

Path C:\Temp\gaysqkidav.sys
Size 293KB
SHA256 a3892aa8d1f06134b8aca0e6b54ebfaa0d79bf40bcde11ef4d2b83c5186b3fa4
MD5 1d242ac55532ff9d9b89c714f3857c0c
SHA1 150f6efad6a3c838d755def23da2f2218726c16a
SHA512 df626a384a26a6f6ebebcbf5a57262b0f201d9e3b51585a2f872d1de36d12f61f1abfd974cd191358663e9218c62b43f0ca118cc29184de453c24b3d078b94b0
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqoigays.exe

Path C:\Temp\i_aytqoigays.exe
Size 376KB
SHA256 256d87fc51e29e69fef714b34034372119c7a5eff3ddbccc5781c84ca6bcdb45
MD5 e32b7fdcda4497ec34d7bfa0bac6bf4d
SHA1 302ab1c9a9f3fee129765781edffd55de4afa3ce
SHA512 7e825a91e217135011941dbfca97ea0b7405552a46a312ebde3c404f3c19e71afa673566cccec3718376f4b528c04711c8752ba5578faafad308a378553a52d0
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkhfax.exe

Path C:\Temp\i_faxspkhfax.exe
Size 376KB
SHA256 be9710cfe02529f8ac1f55326f11ec8deb3e1c3eece9d3b7a063dcf25b9a4077
MD5 1c234cabb435f59be80f10b25a806219
SHA1 8f02da0f9b7cffa711e080e9796b17e1bd092431
SHA512 de821e25affc03fdf897554f8134999a9c9c350751c0b878dd098069801f852e3f1ae0434ab1b20c163adfe1a1ce3f9dc4bac1a64d8c36c6c50b5abcffaeb42f
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T162847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljdbwtomg.exe

Path C:\Temp\i_oljdbwtomg.exe
Size 376KB
SHA256 645b929dbc642b0f7339264ab76c05f305633e1d125383a8f32456f4d52c34e7
MD5 01f6e81b50787c154b9b3025033d7bc1
SHA1 b6980ae60a12391c457d5c2d29524fa9a07d611f
SHA512 410e82d1d2bc0d91fe7c99fc9cc3e716edab65dd0b46d13d6a467f19782e68aef84fde8c6df27cf716ce59b2aa367a29e6c44b54c71bf8bbc1055709025bbb32
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T171847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usnkfcausn.exe

Path C:\Temp\i_usnkfcausn.exe
Size 376KB
SHA256 23a8f1e0bc73dfea0af80eae5b765efb0920178b7335b1e72c5824b0aa9e5a3b
MD5 51682d379fabb459254dad278da2e548
SHA1 097a169aeac13c6db8047250cf75484d320c20b2
SHA512 4de57986ebbf85732f610a1927a55004e82765228a50928040c2911156961dc53995623bfa9d3fa0e716d35cb9b603815cfdcc5d52b9d7098df0e910b8c836bd
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicavsq.exe

Path C:\Temp\i_ysqkicavsq.exe
Size 376KB
SHA256 eba97a7a136ca43adc2f7bffe505667391ea95053856862135fba68b85f80245
MD5 9e39588c9a99c3b3d27fa11b4cfb5443
SHA1 acbac925168366a5097c273246079f59119285b8
SHA512 30bd2242f96baf5325ee11509e20ca3b123612661e07b54e68c6020e297577a8953266b485a199eb42f7bcc871ec28e2a871ada9539616df65fa1d28980413b3
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwtomgeywqojg.exe

Path C:\Temp\ljebwtomgeywqojg.exe
Size 376KB
SHA256 7ccbace433e17bb74652897cb52d5c25fb9dcd0142ee1aaf1a2a00e61cd7c1fc
MD5 2dbccbbc90d4b9a2f066665591c597f0
SHA1 5a4f149219bd4d01fe8b42b389414ce8b835830a
SHA512 2bde217e887d57e98d11cad3e4abc97a46fd7c44bb01ec72c6b68fe1654d6a43e4ac7a8bf106e603d5deb855142abb21757151b4c7393cef286e9b52090bab4e
SSDEEP 3072:rFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwtomgeywqojg.sys

Path C:\Temp\ljebwtomgeywqojg.sys
Size 293KB
SHA256 0e1d7fae6aca48f8b65e07eb7c9abce20ef7edb7b7107e3e2c40020d0cc93e64
MD5 f67738e8f9d1e3dc2a8602ac0ccd4f89
SHA1 12910b3e0c7ed47369526e7b582efe687f774e95
SHA512 c7306bdea9e4080ed08b1f22d4f45d127684d12b2ce2fc3888472043909ba90c62cfb84d888c790fd5bcc3ad5ccd9dc6e43ad7d8fd17a7b3c7f01f4d73d0bd7e
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkicausmkf.sys

Path C:\Temp\mkicausmkf.sys
Size 293KB
SHA256 25be9437a1c89fa31399c2adb9b5fd2d694771973fff93528514d8c36d286bc9
MD5 8ebd502f453bf8660734566eb0927bcf
SHA1 67f5d4a3f71e4a4c0ea0b7262c3c1ab10329e398
SHA512 388c9820c729fb25e04336495a1b1a0177a12f8fafe10fec165d2ab4fe9edda70e4a24a81451b7eb31fdf2ea992a534f3305bae330a56132124527730bc5b3fb
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T18E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxrpkhc.sys

Path C:\Temp\nhfzxrpkhc.sys
Size 293KB
SHA256 dbcfcf31cffa9c235ca64972566a326cb2352c6f0c9900cf8983ccc9bd1a704a
MD5 4d6be4a4f83bd5d061676549f696e48f
SHA1 50ece1b2a93d1040ced28966ccdc54005863e51d
SHA512 5bf3d9aa7d87ab87b4db09ba25710ba571778f8cb4df33e61c34ee88427ee39730e677ff88d84bb6a98f7594b2fa2784b1a9890334417cc96588e66b6a478984
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavtnlf.sys

Path C:\Temp\nlfdavtnlf.sys
Size 293KB
SHA256 70ce06ec998c281c2751b6524c4ab33be59f8644177530bebbfa5d5bd861c035
MD5 7462356c2d24a09b724b3b0751e874b4
SHA1 d756e05fc091d10ac3c6a8f93483d913a0c272e5
SHA512 bf2fe8f278ded2b6c7bd20476bcd737ecc405a56ffa29e7dec25796d127be3910deff2d1c87ce39adeb821b8ef3b08e8f1cc1d791aa72e4c1bb945c8a996ee9c
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.sys

Path C:\Temp\olgdywqoig.sys
Size 293KB
SHA256 1c1bb198dbb6897d81df2f6e0c468ef8fa1bbcd1be41d4d7f228c112203fc06a
MD5 d7a437ad285819ebec5ad5adba031c35
SHA1 bd5cadaa162812e410df7e2ab23d5b2ef449bac6
SHA512 8ad43ed9a343bcf6fa6b2b5b74a1a75337beb5bf4ab5b9d4b24bb03e0d28257b1975abbbc36e8cb8024526c328a691e062ff8817b3c8397935062d5d68902293
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbwtomg.exe

Path C:\Temp\oljdbwtomg.exe
Size 376KB
SHA256 b6381ba9c186d60509456758cdc679bae2619d56ec77901c1bd4b5fdfb0b9f70
MD5 e27f7fbf852a6e18dab624e2486f919f
SHA1 54641d85ed8104132a132ab4d1550b4da87f6f98
SHA512 88dcc864f9199c6bffd1b33961bf049f6542d4e13d9cc507dbb4ff1eb7679ebb6b683ea3ee1c00fb89984aac1a3092bb6ee06c859e9a8893f8de7b5a9ef758ff
SSDEEP 3072:HFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfcausn.exe

Path C:\Temp\usnkfcausn.exe
Size 376KB
SHA256 16782892f90bb8765c0303f3cc44f105e13b83ccb59c899a8b73d2143b6d4626
MD5 184c82dba8498933227e6cde569449f7
SHA1 5e47c2587d18a068b95eeecf380c578d1cc80c6f
SHA512 49fd20d1e6d7f6875370531a88215aece4cc00f9ad9dc312e1b67aab9476888e3188e61c3e1d60055c0b37aee3acbf009be48d2598c70b740998aac64aad571e
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsq.exe

Path C:\Temp\ysqkicavsq.exe
Size 376KB
SHA256 7855e530d3f7aa01b68707d8f31a25725ed4644527a73b08bbbf2afa478741d9
MD5 c919e6495d16772e0f56a0b1102a9153
SHA1 03e9f484b1935c7a37483d4408359cf033dbad5b
SHA512 d2d38ce831c2d4780e96022a79fe71d793de8bcd2fcffba630831fd57b1b9f480550875759340fb61e369ec24bc861b5adc5632e12f1d3fd60494eecce5813a5
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

82b67453-cf4c-40db-a8df-9d6768cbc348.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82b67453-cf4c-40db-a8df-9d6768cbc348.tmp
Size 13KB
SHA256 0ee4c977ee652fc5a55ea15b57cdf89f7336006eb903f3d2e6e3e24a504d7d05
MD5 3e8c39374952388902965dd449536207
SHA1 2a5bc91e99816ce4080553d2080d867f4d71d5d8
SHA512 2851925e52060415cf790587aa85b6497f7a20f8e82b510a036ae1f46ff46f1b4a824c5c28cdf24dae8a23796660a87972f2b2645d95c0a2e8d09841095dec11
SSDEEP 192:sxRwRpyM/jK1Ml8wCe/fLsQhI3HZeklQzoA8pi/g6+WNIYorCYr+GKuqIgtJ:sxRwx8e/fLsYI35eklJi/5I+Gu3
TLSH
T12552D905AA245977CCDBD20DFA55BF93D6F91573A2901E44AAFCCB1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c78e32226205f59a1ed348813411aa28e9e8fa26247cb86b17dbeb21478de5b8
MD5 cbf5a651ce82cffb1c6231cbd89f4290
SHA1 86611ac130b4e2cd14655537825842965f63be94
SHA512 ae62752ac71881248c0fd0078d98d5165474c1e94bd58a31ba60909a87ec3d29adda46f5db7742975450f7e1acdb9d50a2432e82d24d08acfd1842bfeec0f3d1
TLSH
T1B55118B023B2D9D3D765877357E26A8E36F0946B260B2E5980643D758906F2CECF102F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b2b0ca1b7e23bd131fc1754ed1be6c595d4828ab5583854607864198d113ce5d
MD5 603e5164482fbe49bd69020ea2a597bf
SHA1 2b2b02d81f1b124b1af683c032930aa582b88a20
SHA512 2403c144104f8cdf82507fdce4d97456a915d43e17c021e26740ef407e3a0cae32f216e4d64ca937207da93c0f119513699ac409c31fc8312f33fcf712a4b3d4
TLSH
T1D041BDF3C3E8856ED90196F0AA187E2BCE1D0915432C3D5AC9E4AF5B93E2871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 183f242bd1b8406524e8165d64eca41cfb792c9fc0718f0d308ddc1f4a757090
MD5 4495e53474b3dcd6a729bf7d1ba2d956
SHA1 c301f2d4cfaa16a580a3076980f9052b18e7b41c
SHA512 9cddda268dc62f70bb44fdf9f182272cce2bb8f6df2035bf29617e3f89a4999403935267d969409de762597e96c0e5eda76c52daa6325f0c5c44746f46dc7af4
SSDEEP 192:sxR/RpyM/jK1Ml8wCe/fLs2hI3HZeklQzoA8pi/g6+WNIYorCYr+GKuqIgD4J:sxR/x8e/fLseI35eklJi/5I+Gug
TLSH
T1D252DA05AA245977CCDBD20DFA51BF93D6F81473A2901E44AAFCCB1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65186f309afb301b19ae716ceb7abb9b617faa570c1e959b9bcf3ff5049ad2ef
MD5 39d9a60e026d1ff1ea42377dc2029a09
SHA1 ab40a968f4101612a4e50c8d5ba6e5ea72e3e37d
SHA512 1f0df5b6843a0ea1afc9a943d31405cb978d91a2d517bae9ebc90570b8cf1496dabdf629f11c9dbd959698a58029b6d9bcfff103fde79a8c163d9e91c6588284
SSDEEP 192:sxR/RpyM/jK1Ml8UQrCe/fLs2h33HZeklEzoA8prh/g6+WNCLB/YopgCYr+GKuqO:sxR/Dqee/fLse335ekllN/5k/JGuO
TLSH
T1F562EA06AA245D77DCDBD20DF951BB93D6F85473A2941E44AAFCCB1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b01b5ab444bd5c59a782c6f752d520786b38a492d861b3b84fc64001ed09ab28
MD5 c7a2cc1d3c9ade3e32b1f13fb1c83f44
SHA1 0e6fa640a27fc46f160720033bd684089d119671
SHA512 d80399bebbcb51f81b5242b3d06fef3ee3a4cd36248baa2fef9b90fadb82d190607d6a2516565836fd9cfdeb158374fc2f1cd03a130cb27b67046275ad971e6d
SSDEEP 192:sxR/RpyM/jK1Ml8wCe/fLs2h33HZeklEzoA8prh/g6+WNCLB/YopgCYr+GKuqIgO:sxR/D8e/fLse335ekllN/5k/JGuO
TLSH
T15062EA06AA245D77DCDBD20DF951BB93D6F85473A2901E44AAFCDB1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d582d8896e6596dcb7b5b18f94294d4467cacd8c5298c03aa7beb6fa728a3f09
MD5 ddcdeee57915d288e73d2b5f4a479442
SHA1 929bde926b1b5c7e486ff939257a5bbe4cdc3c0d
SHA512 ae08bd5c2c6e6a3060960f0e293397c00e8ce22712e1675b28ad20e03397c9034196e1c4aa2a7ab69c51e3b60b94473751130a8e13d15a3bda94a08853bd7ac3
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVjopVuGsrockGex:jXwHnUE7gRWgs2fJ2u1ja8op4G3d3j
TLSH
T1B9E2EC7B680CCBBE4F404A9CEC25BD9E6DA802CB96D88D5447FA840C03C6AEB55175DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e01b8fefb98a1151faf4ac20dacd5dc5f3c88d76b988b7d63d260ba5654394a1
MD5 c3cd40d7455e420aa6a75e216adb2fa3
SHA1 378e99a9ddaa0ba23d18f4639bd839b0db3e93de
SHA512 ed75d2f3b28dd30b7b892e581413541065c50098548ceac6e5a65454c73466d05377d9de39675f9d68486001d968f9ff52e5c44ae97262232c61c6513bcf9d84
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgziryr0wym:C3gFB31lERe1JDggH2vHG5FaHoZs4q2Q
TLSH
T193915051713A1284387E7A1E80A5AD5ED6C275737215B42F7BE801A65FABE034CFC8CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b1eba81-4972-4bd7-a331-773216d451c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7b1eba81-4972-4bd7-a331-773216d451c5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 20fb38e0b0cae962ddbf5ba357c5f4f1f32e76be62304b8aa7e1122b0dad312b
MD5 535e7b4b0bbf07ad4b871d300481c975
SHA1 ac20354d3cadbfa5296c890e090cf4cf426d0d50
SHA512 685566dec321e06bceaf7f00824e480f488d05998a0300f8e190e27938f00aca095c1dd6f62826669e36a40d813a6b4d47d336c2ede98958468bd41cd6fcd1db
SSDEEP 768:1j+9Z3m8vS/TBOW8Fsm4ONXyer1IRCzni9Mb9Ms:A9Z3kad4SIqn/b+s
TLSH
T1AAF2BE30E556DE234CD5A3DAB2473382BEF820BBC5C40F94EAE99F4E058766D170A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6928fbe6e8714f7ac1ffee19290072da16e105db6225a2c8f955261c10662b08
MD5 33204e2a40b96958113f3b8e45feef0d
SHA1 c07279fad6d38552bd77d3a6696b8df168f5272e
SHA512 164bba9bea0535493a27ebd513453b347f131f967dc2a9f49ba29b9ff8ac4c84272c97705d39fc4fca838f363dfa2aca968fcc7ca375caa132c4d8090c767f33
SSDEEP 768:bF1j+9n3WwgR8NxxsOW8Fsm+ONXyer1IRCzni9Mb9Ms:69n3XDd+SIqn/b+s
TLSH
T1271317F594D78A36D89E5387B33E2E469EBCD067B5884984BBC55E4DCC821BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 78a1fd889341d80a296ccf4618b4f4960ba5830f34e6efaf2f8ba67de4f2c95b
MD5 22b68f3d55484ea9f9cf4d5845f38483
SHA1 0d94ffe9694dafc1b681522bb776d5feaa5691db
SHA512 f8ddd89cf2b905ca74ba51dae565e811441f628f886d7778963b3622a05040db0a0aa13b4e574ce13ad42226b88a59a47ceab1063d21262fa99a893bf8605bca
SSDEEP 768:Aj+9Z3981S/TBOW8Fsm4ONXyer1IRCzni9Mb9Ms:/9Z3zad4SIqn/b+s
TLSH
T1EEF2BE30E955DE234CD1A3DAB2473382BEF820BBC5C40F94EAE99F4E058766D170A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5f55e96e86cb5cbc900dc730894a756d2a0cf6125f586976b28013541bde2f8
MD5 fb868543194defb6bfe06c8b4a98b287
SHA1 fadc5d6b3b857beda031ebff48f3ceb802790f47
SHA512 e4ae278f06f2a582b031995c0a06393c840f2503ad0175dc4cab5293c0ab7a9205de8ad2add54ac857fd09967fa7f98419c88e3335b94a993b58d9aefb65453c
SSDEEP 768:hrv+4UNbdz3x9/TBOW8FxONXyer1IRCzniBReVH1SK7:hbsbV3XaxSIqnOEH1l
TLSH
T1DA03BE36E5A89E338CE2A3C6B14B73037FB86057D6840B90E9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4128_1614541361\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5afb76c3a82838556133f985f1d7bc8e0e1705a34170f1f31d442d6658c017eb
MD5 0594844e21eb88a36f5fc8df83234d4e
SHA1 e8db41a681935d33abec06ecfc6d99ae6b89f6f4
SHA512 fd7e24643de0570af5a9f05946dac881faf74248b7f3908e1087c86a61e28b64f578c12955d4dffd88ce2b7ed38733314c40725e68aeed610c6819d05602dadb
TLSH
T18571238357B9C5B3C5DA9BF102835604F6FF2238472370340F915546EB30A7A24B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1160-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1444-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1956-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2320-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2392-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2532-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3468-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4132-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4916-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5428-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5512-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5976-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download