systex | 8efb69391e6da29e7171766ebdb4861343ee8207fac241d1126efc2343ff6fb8

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260715-pphyascv2n
SHA256 8efb69391e6da29e7171766ebdb4861343ee8207fac241d1126efc2343ff6fb8
MD5 1275f0a4f5882cc90a66a487674ad90f
SHA1 2dcd6d5be96101f9036180c4205a24d3744af987
SHA512 b6e3024d60d7b82bc8081d0da473def03cffb4f1c38b6e81128922f6cdde47b83cf72b84c2e43f41454b37cd89ef37d344c39d03d2793ebfbd20810925482570
SSDEEP 3072:FViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5560	usmkfcxvsnkhczxv.exe
3392	usmkfcxvsnkhczxv.sys
2228	CreateProcess.exe
4736	caxspcxsne.exe
2264	CreateProcess.exe
2980	CreateProcess.exe
2572	i_caxspcxsne.exe
1320	smkecwusmk.sys
3076	CreateProcess.exe
1004	khczxupmhe.exe
4168	CreateProcess.exe
1720	CreateProcess.exe
3872	i_khczxupmhe.exe
2332	cwuomhezxr.sys
4028	CreateProcess.exe
1592	wuomgezwrp.exe
1952	CreateProcess.exe
4484	CreateProcess.exe
2156	i_wuomgezwrp.exe
4540	hbzwrojgeb.sys
4048	CreateProcess.exe
5320	jgeywtomge.exe
3520	CreateProcess.exe
5364	CreateProcess.exe
3972	i_jgeywtomge.exe
4060	uoljdbwtom.sys
2256	CreateProcess.exe
5964	geywqojgay.exe
4440	CreateProcess.exe
5756	CreateProcess.exe
5780	i_geywqojgay.exe
460	qolgeywqoi.sys
1804	CreateProcess.exe
3048	qoigeyvtnl.exe
1152	CreateProcess.exe
1572	CreateProcess.exe
5664	i_qoigeyvtnl.exe
2712	qnlidayvqn.sys
3844	CreateProcess.exe
2956	tnkigaysqo.exe
4564	CreateProcess.exe
804	CreateProcess.exe
1324	i_tnkigaysqo.exe
4252	vsnlfdxvqn.sys
4036	CreateProcess.exe
3924	snlfdxvpnh.exe
6140	CreateProcess.exe
4568	CreateProcess.exe
4524	i_snlfdxvpnh.exe
4308	xvpnkfcaxs.sys
5600	CreateProcess.exe
4848	mkecxupnhf.exe
4140	CreateProcess.exe
5840	CreateProcess.exe
4864	i_mkecxupnhf.exe
1600	khfcxvpnhf.sys
4944	CreateProcess.exe
2916	hfzxrpkhca.exe
4888	CreateProcess.exe
1740	CreateProcess.exe
1292	i_hfzxrpkhca.exe
4024	mhfzxrpjhc.sys
4548	CreateProcess.exe
4576	hecwuomkhf.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1716988906\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_385908085\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_385908085\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_858018726\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_858018726\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_152779254\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_152779254\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_152779254\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_152779254\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxusnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigeyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkigaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspcxsne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicausnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkigaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqoigavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigeyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwuomkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqoigavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicausnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwuomkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxusnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvsnkhczxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspcxsne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczxupmhe.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4360	ipconfig.exe
4460	ipconfig.exe
4000	ipconfig.exe
5528	ipconfig.exe
2320	ipconfig.exe
4548	ipconfig.exe
5332	ipconfig.exe
4856	ipconfig.exe
3556	ipconfig.exe
3056	ipconfig.exe
3108	ipconfig.exe
5016	ipconfig.exe
2960	ipconfig.exe
5572	ipconfig.exe
4328	ipconfig.exe
2780	ipconfig.exe
2440	ipconfig.exe
2116	ipconfig.exe
1756	ipconfig.exe
5984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285922215798464"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{F6FA042B-87AA-48B2-88C0-F872EFF69E63}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe
5560	usmkfcxvsnkhczxv.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	i_caxspcxsne.exe
Token: SeDebugPrivilege	3872	i_khczxupmhe.exe
Token: SeDebugPrivilege	2156	i_wuomgezwrp.exe
Token: SeDebugPrivilege	3972	i_jgeywtomge.exe
Token: SeDebugPrivilege	5780	i_geywqojgay.exe
Token: SeDebugPrivilege	5664	i_qoigeyvtnl.exe
Token: SeDebugPrivilege	1324	i_tnkigaysqo.exe
Token: SeDebugPrivilege	4524	i_snlfdxvpnh.exe
Token: SeDebugPrivilege	4864	i_mkecxupnhf.exe
Token: SeDebugPrivilege	1292	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	1188	i_hecwuomkhf.exe
Token: SeDebugPrivilege	5608	i_mjebzwrojh.exe
Token: SeDebugPrivilege	5528	i_bztrljebol.exe
Token: SeDebugPrivilege	3056	i_qoljdbvtqo.exe
Token: SeDebugPrivilege	1416	i_ysqoigavtq.exe
Token: SeDebugPrivilege	5168	i_qkicavtnlf.exe
Token: SeDebugPrivilege	3404	i_snkicausnl.exe
Token: SeDebugPrivilege	4044	i_fcxusnkfcx.exe
Token: SeDebugPrivilege	5072	i_wurmjhczus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 5560	4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4116 wrote to memory of 2984	4116	2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2984 wrote to memory of 3360	2984	iexplore.exe	89
PID 3360 wrote to memory of 6068	3360	msedge.exe	90
PID 3360 wrote to memory of 5972	3360	msedge.exe	91
PID 3360 wrote to memory of 5668	3360	msedge.exe	93
PID 3360 wrote to memory of 5972	3360	msedge.exe	91
PID 3360 wrote to memory of 5972	3360	msedge.exe	91
PID 3360 wrote to memory of 4344	3360	msedge.exe	94
PID 3360 wrote to memory of 4344	3360	msedge.exe	94
PID 3360 wrote to memory of 1476	3360	msedge.exe	95
PID 3360 wrote to memory of 2552	3360	msedge.exe	96
PID 3360 wrote to memory of 1476	3360	msedge.exe	95
PID 3360 wrote to memory of 1476	3360	msedge.exe	95
PID 3360 wrote to memory of 2552	3360	msedge.exe	96
PID 3360 wrote to memory of 2552	3360	msedge.exe	96
PID 3360 wrote to memory of 2880	3360	msedge.exe	97
PID 3360 wrote to memory of 5656	3360	msedge.exe	98
PID 3360 wrote to memory of 2880	3360	msedge.exe	97
PID 3360 wrote to memory of 2880	3360	msedge.exe	97
PID 3360 wrote to memory of 5656	3360	msedge.exe	98
PID 3360 wrote to memory of 5656	3360	msedge.exe	98
PID 3360 wrote to memory of 4140	3360	msedge.exe	99
PID 3360 wrote to memory of 4140	3360	msedge.exe	99
PID 3360 wrote to memory of 3676	3360	msedge.exe	103
PID 3360 wrote to memory of 5852	3360	msedge.exe	104
PID 3360 wrote to memory of 3676	3360	msedge.exe	103
PID 3360 wrote to memory of 5852	3360	msedge.exe	104
PID 5560 wrote to memory of 2228	5560	usmkfcxvsnkhczxv.exe	105
PID 3360 wrote to memory of 5376	3360	msedge.exe	108
PID 4736 wrote to memory of 2264	4736	caxspcxsne.exe	110
PID 3360 wrote to memory of 2408	3360	msedge.exe	113
PID 3360 wrote to memory of 2408	3360	msedge.exe	113
PID 3360 wrote to memory of 3384	3360	msedge.exe	116
PID 3360 wrote to memory of 3384	3360	msedge.exe	116
PID 5560 wrote to memory of 2980	5560	usmkfcxvsnkhczxv.exe	118
PID 5560 wrote to memory of 3076	5560	usmkfcxvsnkhczxv.exe	122
PID 1004 wrote to memory of 4168	1004	khczxupmhe.exe	124
PID 5560 wrote to memory of 1720	5560	usmkfcxvsnkhczxv.exe	127
PID 5560 wrote to memory of 4028	5560	usmkfcxvsnkhczxv.exe	131
PID 1592 wrote to memory of 1952	1592	wuomgezwrp.exe	133
PID 5560 wrote to memory of 4484	5560	usmkfcxvsnkhczxv.exe	136
PID 5560 wrote to memory of 4048	5560	usmkfcxvsnkhczxv.exe	140
PID 5320 wrote to memory of 3520	5320	jgeywtomge.exe	142
PID 5560 wrote to memory of 5364	5560	usmkfcxvsnkhczxv.exe	146
PID 3360 wrote to memory of 1040	3360	msedge.exe	148
PID 3360 wrote to memory of 5028	3360	msedge.exe	149
PID 3360 wrote to memory of 4268	3360	msedge.exe	150
PID 5560 wrote to memory of 2256	5560	usmkfcxvsnkhczxv.exe	153
PID 5964 wrote to memory of 4440	5964	geywqojgay.exe	155
PID 5560 wrote to memory of 5756	5560	usmkfcxvsnkhczxv.exe	158
PID 5560 wrote to memory of 1804	5560	usmkfcxvsnkhczxv.exe	162
PID 3048 wrote to memory of 1152	3048	qoigeyvtnl.exe	164
PID 5560 wrote to memory of 1572	5560	usmkfcxvsnkhczxv.exe	167
PID 5560 wrote to memory of 3844	5560	usmkfcxvsnkhczxv.exe	171
PID 2956 wrote to memory of 4564	2956	tnkigaysqo.exe	173
PID 5560 wrote to memory of 804	5560	usmkfcxvsnkhczxv.exe	176
PID 5560 wrote to memory of 4036	5560	usmkfcxvsnkhczxv.exe	180
PID 3924 wrote to memory of 6140	3924	snlfdxvpnh.exe	182
PID 5560 wrote to memory of 4568	5560	usmkfcxvsnkhczxv.exe	185
PID 3360 wrote to memory of 4968	3360	msedge.exe	187
PID 3360 wrote to memory of 4968	3360	msedge.exe	187
PID 5560 wrote to memory of 5600	5560	usmkfcxvsnkhczxv.exe	193
PID 4848 wrote to memory of 4140	4848	mkecxupnhf.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1275f0a4f5882cc90a66a487674ad90f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Temp\usmkfcxvsnkhczxv.exe
  C:\Temp\usmkfcxvsnkhczxv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspcxsne.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2228
  - - C:\Temp\caxspcxsne.exe
      C:\Temp\caxspcxsne.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspcxsne.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2980
  - - C:\Temp\i_caxspcxsne.exe
      C:\Temp\i_caxspcxsne.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczxupmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3076
  - - C:\Temp\khczxupmhe.exe
      C:\Temp\khczxupmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczxupmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\i_khczxupmhe.exe
      C:\Temp\i_khczxupmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4028
  - - C:\Temp\wuomgezwrp.exe
      C:\Temp\wuomgezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\i_wuomgezwrp.exe
      C:\Temp\i_wuomgezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4048
  - - C:\Temp\jgeywtomge.exe
      C:\Temp\jgeywtomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_jgeywtomge.exe
      C:\Temp\i_jgeywtomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2256
  - - C:\Temp\geywqojgay.exe
      C:\Temp\geywqojgay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\i_geywqojgay.exe
      C:\Temp\i_geywqojgay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigeyvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1804
  - - C:\Temp\qoigeyvtnl.exe
      C:\Temp\qoigeyvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigeyvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Temp\i_qoigeyvtnl.exe
      C:\Temp\i_qoigeyvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnkigaysqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3844
  - - C:\Temp\tnkigaysqo.exe
      C:\Temp\tnkigaysqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnkigaysqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:804
  - - C:\Temp\i_tnkigaysqo.exe
      C:\Temp\i_tnkigaysqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4036
  - - C:\Temp\snlfdxvpnh.exe
      C:\Temp\snlfdxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4568
  - - C:\Temp\i_snlfdxvpnh.exe
      C:\Temp\i_snlfdxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5600
  - - C:\Temp\mkecxupnhf.exe
      C:\Temp\mkecxupnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5840
  - - C:\Temp\i_mkecxupnhf.exe
      C:\Temp\i_mkecxupnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecwuomkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\hecwuomkhf.exe
      C:\Temp\hecwuomkhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecwuomkhf.exe ups_ins
    3⤵
    PID:1324
  - - C:\Temp\i_hecwuomkhf.exe
      C:\Temp\i_hecwuomkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebzwrojh.exe ups_run
    3⤵
    PID:5100
  - - C:\Temp\mjebzwrojh.exe
      C:\Temp\mjebzwrojh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebzwrojh.exe ups_ins
    3⤵
    PID:5460
  - - C:\Temp\i_mjebzwrojh.exe
      C:\Temp\i_mjebzwrojh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebol.exe ups_run
    3⤵
    PID:2224
  - - C:\Temp\bztrljebol.exe
      C:\Temp\bztrljebol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebol.exe ups_ins
    3⤵
    PID:3356
  - - C:\Temp\i_bztrljebol.exe
      C:\Temp\i_bztrljebol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljdbvtqo.exe ups_run
    3⤵
    PID:3664
  - - C:\Temp\qoljdbvtqo.exe
      C:\Temp\qoljdbvtqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoljdbvtqo.exe ups_ins
    3⤵
    PID:2280
  - - C:\Temp\i_qoljdbvtqo.exe
      C:\Temp\i_qoljdbvtqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqoigavtq.exe ups_run
    3⤵
    PID:1920
  - - C:\Temp\ysqoigavtq.exe
      C:\Temp\ysqoigavtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqoigavtq.exe ups_ins
    3⤵
    PID:4604
  - - C:\Temp\i_ysqoigavtq.exe
      C:\Temp\i_ysqoigavtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavtnlf.exe ups_run
    3⤵
    PID:4508
  - - C:\Temp\qkicavtnlf.exe
      C:\Temp\qkicavtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavtnlf.exe ups_ins
    3⤵
    PID:5608
  - - C:\Temp\i_qkicavtnlf.exe
      C:\Temp\i_qkicavtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicausnl.exe ups_run
    3⤵
    PID:3332
  - - C:\Temp\snkicausnl.exe
      C:\Temp\snkicausnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicausnl.exe ups_ins
    3⤵
    PID:4864
  - - C:\Temp\i_snkicausnl.exe
      C:\Temp\i_snkicausnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxusnkfcx.exe ups_run
    3⤵
    PID:2316
  - - C:\Temp\fcxusnkfcx.exe
      C:\Temp\fcxusnkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxusnkfcx.exe ups_ins
    3⤵
    PID:3056
  - - C:\Temp\i_fcxusnkfcx.exe
      C:\Temp\i_fcxusnkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhczus.exe ups_run
    3⤵
    PID:4092
  - - C:\Temp\wurmjhczus.exe
      C:\Temp\wurmjhczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhczus.exe ups_ins
    3⤵
    PID:2436
  - - C:\Temp\i_wurmjhczus.exe
      C:\Temp\i_wurmjhczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    PID:1072
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2116
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa0023c188,0x7ffa0023c194,0x7ffa0023c1a0
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,13109538568313532541,3975814342357655749,262144 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:2
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,2252472294594696043,3172315741709132651,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:11
      4⤵
      System Time Discovery
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,11324563307546862721,7392170792866614323,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,8891134488680906084,4079730526545201567,2097152 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,7301795692050691964,9064072845859818109,2097152 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,4003171187462560565,15647999239216809875,2097152 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,1465878878287016582,5803496387743031987,2097152 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4735307731274992731,6544564044922298088,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8972339525773818258,4159995804938111640,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,135277330634365899,15126666749560969887,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,14502456885523254861,8936320362193494916,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,14502456885523254861,8936320362193494916,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14866967477341600331,14658959033583763153,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,14271386495386113520,14426378584021024861,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,8506847838739285221,8773817737899727500,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,16509229890259201929,5993276501105481611,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,10327047328199386396,14294803510417550551,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,15905460490465479877,9594686752996222776,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,15967612224389887755,11869195528990364132,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,3717347518481494034,169610351848946359,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,5786953989105108158,16848069672886331203,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6636,i,5185811778325851931,8845774974534387807,262144 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:10
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13487003980399461235,13680139856490808072,524288 --field-trial-handle=3012,i,6411802157942652520,9611828189060027528,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:260

C:\Temp\usmkfcxvsnkhczxv.sys
C:\Temp\usmkfcxvsnkhczxv.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4976

C:\Temp\smkecwusmk.sys
C:\Temp\smkecwusmk.sys
1⤵
- Executes dropped EXE
PID:1320

C:\Temp\cwuomhezxr.sys
C:\Temp\cwuomhezxr.sys
1⤵
- Executes dropped EXE
PID:2332

C:\Temp\hbzwrojgeb.sys
C:\Temp\hbzwrojgeb.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\uoljdbwtom.sys
C:\Temp\uoljdbwtom.sys
1⤵
- Executes dropped EXE
PID:4060

C:\Temp\qolgeywqoi.sys
C:\Temp\qolgeywqoi.sys
1⤵
- Executes dropped EXE
PID:460

C:\Temp\qnlidayvqn.sys
C:\Temp\qnlidayvqn.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\vsnlfdxvqn.sys
C:\Temp\vsnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\xvpnkfcaxs.sys
C:\Temp\xvpnkfcaxs.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\khfcxvpnhf.sys
C:\Temp\khfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:1600

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
- Executes dropped EXE
PID:4024

C:\Temp\rmjzwuomge.sys
C:\Temp\rmjzwuomge.sys
1⤵
PID:5332

C:\Temp\bztrljdbwu.sys
C:\Temp\bztrljdbwu.sys
1⤵
PID:1660

C:\Temp\wtrljdbvtr.sys
C:\Temp\wtrljdbvtr.sys
1⤵
PID:5392

C:\Temp\ayvtnlgdyv.sys
C:\Temp\ayvtnlgdyv.sys
1⤵
PID:4528

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
PID:5312

C:\Temp\pnkidausnk.sys
C:\Temp\pnkidausnk.sys
1⤵
PID:4304

C:\Temp\kicxusnkfd.sys
C:\Temp\kicxusnkfd.sys
1⤵
PID:2344

C:\Temp\zxrpmkecwu.sys
C:\Temp\zxrpmkecwu.sys
1⤵
PID:360

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caxspcxsne.exe

Path C:\Temp\caxspcxsne.exe
Size 376KB
SHA256 9ff49bddf79d7e2242acf7d983a2c272b21f21f51e3f5312c7f2b6a25c6b2ebd
MD5 510b3f9fe75c73c156374f0b9356ecd6
SHA1 2c70f8166aba4e6e606a86ae359278b11d2d47a0
SHA512 8252bb26e463de045e83702ba76d0e03ad93146f58a22d0b6dd8c1b8e7d2630bc0c14571b8a32d3fcb13881cf0023706ffd6b7abc0d1a7f27f3b1a7df2e8189f
SSDEEP 3072:yViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomhezxr.sys

Path C:\Temp\cwuomhezxr.sys
Size 293KB
SHA256 5ac5bf9440666b038b789ff47128f6d80202541865a78a1e0d2caa59eedc0fd8
MD5 2af8bad40210baef49fcc8cc54593336
SHA1 92fa5ec3fd0c4da14ad59ef2b2a0ccb18dcc7e59
SHA512 7f99573ef239e53682ff0e299228beb1987795beaf6d967ad7890b923f2aca6b0b7b8f88727483e7cea2c4866507d8d54573fadcbc0b71eccb291d446da87d94
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgay.exe

Path C:\Temp\geywqojgay.exe
Size 376KB
SHA256 7d281fba48932401e1dc602e2f57fe8b2f65e6b59881c9ead949cf0f1943145d
MD5 5851a463772b05aa748ab784577da75a
SHA1 396b0e36c24b09028fcefb008f1759337b47169d
SHA512 2512f797a9555d2a9a0893a1a6f13777589671e572ad9e445a70fa949e0eaa56119fe21e38480de8fdb2d5aa9e62d8e64f22b469d00845254c41056833ab9399
SSDEEP 3072:BViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzwrojgeb.sys

Path C:\Temp\hbzwrojgeb.sys
Size 293KB
SHA256 158dfdf957b9440d86c0ef57627d77fcd222215a341a7306d7f11200b411d22b
MD5 4677549e64d182d3569aeff18afeac6d
SHA1 b061908114d638d00cd066dd64af6838891d1ed9
SHA512 65e2e7eea1aa9aa5f1d7a44e9fb2a6f3649f77ed969cccd0481ea72fe6d44aac5dcb1c18e20516110965bb862aab96299f2bbeed2eb382ffe068d30f5eb2e3f8
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caxspcxsne.exe

Path C:\Temp\i_caxspcxsne.exe
Size 376KB
SHA256 d6546c9fa77d4c69293b4b5faa52eec361b94c9b8f66841bfe7698952bca1edc
MD5 0f95db2493593f4bbe49a049c5e1e581
SHA1 d2470db447f81b52b6232792134e2664f6248ae0
SHA512 b26ff8e356cb4ce1939b18e35c0704ec6512bffff79fe3382d4ec8662b4deeb486cde4e8d1349014b0b56895eb991e2dfdbb4a0a3c14ad42578bdac389201f83
SSDEEP 3072:dViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqojgay.exe

Path C:\Temp\i_geywqojgay.exe
Size 376KB
SHA256 f55aa65226560872fe7c3851d514f80d559a130f0cb5307798e54ac4dfef207d
MD5 071d6defcb2a181e0e9ea15d3a44ea0d
SHA1 7f87745cb305ec01dab0466c23d937fb4fdd43bd
SHA512 17587d02d5e53f839815410038acf70fa1b00269a24c67f16d736b6f9a0fe7861a11f1af6590e00382be49a22c9a81a5c0dc4f7beec8335b04c1649ba36aae6c
SSDEEP 3072:2ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeywtomge.exe

Path C:\Temp\i_jgeywtomge.exe
Size 376KB
SHA256 ed7b0fddd4beafcb3af94c7a8a4b59e44a3f7c96740ff8a0e8c9b24207d61dfb
MD5 2c3277a39f37173d73fff57d28960226
SHA1 9ed9a15ff49b359e3bf5c9cde2d26e3b5bbcde4a
SHA512 1fb97242bf689b7ae3991f65fda331f6dccb07803d49abcc2ef4947d617934c087799644202857f22f9a1f610e8c1b1c358f73686f4317b65618d3ae38ceba7c
SSDEEP 3072:7ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E5847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khczxupmhe.exe

Path C:\Temp\i_khczxupmhe.exe
Size 376KB
SHA256 97456717607956c4ead3fd8449b02698409b79703dc98382189e68af4c22379c
MD5 d4f82581e9dae63cc0d43f25cc0fe7ad
SHA1 0453ba2a6788429ee5adf0d564860807dc3d1fbd
SHA512 0f8aa58efa925386a218940e182b2cfec71cb91a23f9846bf32072b16be4a4ba2252cb9ceae5fbe5b5ef5886dcc3bded0e6948e3178b0d699e300adb96e12dc2
SSDEEP 3072:rViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwrp.exe

Path C:\Temp\i_wuomgezwrp.exe
Size 376KB
SHA256 5df9e9a7a7ed4219ec5845d90f8c871c153bd301b0821385e88913de5a5c57b1
MD5 51e6ac52cde28a8d4b123a19aeae21d2
SHA1 7f53256e62e5cb45f601651e7f1c9a590e547de1
SHA512 28b7250c0bd3c255259b07a53ba83f81c68c488f47430a1cfb605fe8c168b9484879b8c66478ddf1bd4eedfa42965118a0ac9d0d0bffef76ccfc0e339cdd400e
SSDEEP 3072:KViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywtomge.exe

Path C:\Temp\jgeywtomge.exe
Size 376KB
SHA256 ad1faac8caf0296de0b6f51dad032a4b6592ee1725954c49c7ffc76f5c3046bc
MD5 18052276931046845517caf9ae24cd5e
SHA1 009654cc5bc7675388c89c6b0f56bf9b68ac4157
SHA512 741800c1fcf9525390a8b6f8fcfeadb2bad538b46b6ff406a1de9d557d612d7673d8424bed59c904b2628520898bc539859142618afe31d1bbd742e9ad6a1524
SSDEEP 3072:0ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczxupmhe.exe

Path C:\Temp\khczxupmhe.exe
Size 376KB
SHA256 9f98d01c3159be9f02ca1b6cc3f5013471f93c35745e738874cfe0da4b8f5cd2
MD5 728f29b33619f2022d359ca26b198f18
SHA1 2267db926f5ba43bd9f74c1f809458c6a87b653f
SHA512 5256704a2e6575c618cc69547a25aaad81c27cbc42fa31e0c920bf8214ec47a44e61197df719f4d30527c07796018f05f4b3746759977b843c88779c0a06a372
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigeyvtnl.exe

Path C:\Temp\qoigeyvtnl.exe
Size 376KB
SHA256 cdb75e2ff5464097076750fb85cefdc6019e81f2d3174503da780de503503bee
MD5 20e6cb8b7d036b714192e7095235a732
SHA1 25881cf8f08803f348db9e307c595d009b917407
SHA512 1ff4b34ad0c9cf07e217aa4ba1b5288c2730b6c90716d0a86f31fad5deec2ef3302f87a18a0f012e83f574e343da7d7ab21fad21decd4bba04fbbee84b0f2fc7
SSDEEP 3072:WViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgeywqoi.sys

Path C:\Temp\qolgeywqoi.sys
Size 293KB
SHA256 a9711ad722f263a4c1c802f30cfc49c9e1d3bb3c64e05fb491995cb9b217e5f1
MD5 d90d46cff8e25363d9b013c036b8b857
SHA1 44e97e907035474ed09b9ebe4152d968c3dc1afd
SHA512 04377ffc921de5507f1494b88da472cf2b8367306cbbb8da3529d86718c3b224a5528133046b68f3cb18bc1daa7fc57ac434191f90a190b8e566432c193fb020
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwusmk.sys

Path C:\Temp\smkecwusmk.sys
Size 293KB
SHA256 c87f4d0e6769447f3dbfe7507a2015d93d06fef2ca8ec3316c0bed32b4059b99
MD5 f0f5d6d8fc951698d013d1d703c243e3
SHA1 49891e2f16137f76294b36a04c061a5b01cfe9e7
SHA512 465a5efaa3bd4846ace1f257aff35b956c4883c81944859c38d964ffd3be0c06bc7cf77b685bc6d3b2795bc6dfc764e7440b1b65c24e07793a0958b104b815cc
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uoljdbwtom.sys

Path C:\Temp\uoljdbwtom.sys
Size 293KB
SHA256 f68f4c9a485c266180820f05992e494032d2ba5ad68544233f7da833e95e4052
MD5 2edf5528d773ea271ca78f7f91a86252
SHA1 d8192cfe68e4b4a9fcd69cef781b78375ed33507
SHA512 6938a2fced19e1a50803958b3f272aac6a145e3ccf531351e923598b508074e68e1c2a93516b213e2719b28d516732969c099ff51e5ce03a6715b58958c00524
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxvsnkhczxv.exe

Path C:\Temp\usmkfcxvsnkhczxv.exe
Size 376KB
SHA256 895bd52ef45102c71d009b03e36873f188210b3ed828d1d9792b717b8dcf164f
MD5 76e6b46ec6ce7b7ccfd595492922d960
SHA1 e9e20626e5cd5f9c8154cefcd0d250938d8cdfce
SHA512 a305ccbbb5a249f2c959b3c073813c931df86945f00fd647a93dc5129d9aaf0a9ad577c584b51ba79464896da574002792a337b1de944f4cc6bbb242faf4369e
SSDEEP 3072:7ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T177847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxvsnkhczxv.sys

Path C:\Temp\usmkfcxvsnkhczxv.sys
Size 293KB
SHA256 2d1fd0667f1017d07dc33f82bab3f86d8d58cd8fbeef91849e441a1363157f6e
MD5 31c18621e33f982768a00ce324a84f93
SHA1 292bbe51c50aa811fc1e4ecd6c52378f1b36c61d
SHA512 8caeae4c37112a50d809e5c371a0eb6a8d9bef1148cd1f1f06ed87dea3fcfd3e21044e854d02ed15457432e2aa4acb7857a0104627500b7e47abc977b2ca076b
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.exe

Path C:\Temp\wuomgezwrp.exe
Size 376KB
SHA256 edc044f5b1fdde1c4fcf3c90b40d0ed5d2f529e3f67c6c5745cb690a8a9b423b
MD5 f7f096231bfcd32a47ae5b3d2ead5ce2
SHA1 76d403133b9c035507b9dd6abfb485986fd8a002
SHA512 9e15155a0cd61019872162c7f011007ce43ad6f606ae9f8ddbfa52ae20cf64e7f49b86aa55abb5a83a047f1b9c539d93d8aad0ee7e78287cf6ce257b51df7ce6
SSDEEP 3072:uViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bdb0dab63aedbe8577139bee071966690d66bfb342aebd40e2c35ed1cd8e37e
MD5 fb0ccaad806e2bacd9cb027f9bf7a19f
SHA1 193ce010732b0745fbd6728777dc5e03212198c3
SHA512 34f8ec741effa7bd348b36ec0be5ff1e2223a0f138d57ac1a4d1bcaf17cff6208b1b2936a4c1dd6d79c05ce3c6a9ffd9a0332bae4b090eafe3d3978de73fc8d9
TLSH
T149613D81632649EAD363C87E50D34FD837F0CE69122B0B0445386FF68836FA255E1B63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3f5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3f5c.TMP
Size 3KB
SHA256 704d29e7ed49a2c331985359633caa076eb083950fa7dfabbc620a742cd59b56
MD5 3f3a9a85e521b713ebb23b6691d8c59f
SHA1 c04f193eecbe148d397eb8e6360d27e6096ead8a
SHA512 24abcf5c953f63b33c3dea1beebc2c9e1cc538f2801c85f90fa23d036ea10f0f85673367b37ec03ec34d9c228a0cf6a1541f54c3172effabe674d849dc3cc497
TLSH
T190613D81632609FAD763C87E50D24FD837F0CE69122B4B0444386FF68836FA255D1B63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dabd8687bf8f1b988e705b5670d19097523583c2dd4884080bda5cab516ef8e5
MD5 9cb80929aa0bd71c0ea12e9d2417fb9e
SHA1 2cc024e86dd6ad6764015e601123d134326d8500
SHA512 0bf20b393271b73f16c4f3a80595e9612aa4191fcb79e685e4c6565ed54179ce99968b9feada4c48400a6b38f036ae372bfb09f50e40eb1e03790a3f9a4a9b31
TLSH
T1AC41ACF3C3E4856E891196F0AA187E1BCE2D0915432C3D5A89E4EE5BA3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3d5af3dd1076a90de47a648393d59b49a8ff69f3a7c014329c133b5bfce05710
MD5 3fbbdd98ec31972a80b8f886153c6004
SHA1 3001b5ab8ae480073208d7f0f582ed599bf9cabe
SHA512 e19bd75d3d5cd9c19e9a0bb8643e810a243d8a6c81bded9b9273948aa2f1fa84f80a957d3e59ea26d97f3a0b689573ba209f92007f2f6aa9306efa9489a51530
SSDEEP 192:sxRORRyM/jK1Ml8wC//fysy5oJZKAenjzoD8p9//g6+WNCwY/Y3/La+GtlIgtJ:sxROl8//fyseoHKl7p/5G/g+R3
TLSH
T12F62EC165A345D7BDCCBD209FA55BF93D6F81573A2901E04AAFC8A0C00E6AED6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 809a204f52a739dfbaf5e3b5c2eb9bcb89eae8f929232b9b908d847c9aed905d
MD5 5925364b4bba286f33cebb35139636e9
SHA1 963c81f55fac1cf94126e09e0d4f0d40b3a22b46
SHA512 35b78b34254c5d8c4cd30cae3222236a893270245cebcb214ced13cbe5d35dd946375c8db9b12963da51f62741b2840561baa994431dd43dace8d5150cd1dbb0
SSDEEP 192:sxRhRRyM/jK1Ml8wC//fysR5oJZKAenjzoD8p9//g6+WNCwY/Y3/La+GtlIgDGJ:sxRhl8//fys/oHKl7p/5G/g+RO
TLSH
T18362EC169A345D7BDCCBD209FA91BF93D6F81573A2901E04AAFC8A0C00E66DD6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 97dace7d999c7b3e633c8636811ad2cc714ddf9fdf69aa97dba99c19ce1a0309
MD5 179a54875c62e62fc886aa8223d10f0d
SHA1 ccbb5778d9a038d5453cb54a643bef390498d1cc
SHA512 623a73e876d10edee8c4acac133807eb8b9c7f4ccdd6c3d8d8e53c9e7084bf1552cc9737b6d35441d7594edd66a00f8ff942c90431fb271010dc19e970037d92
SSDEEP 192:sxRhRRyM/jK1Ml8UQLC//fysR5QJZKAenjzoD8pr//g6+WNCwY/Y3tPZa+GtlIgo:sxRhlq+//fys/QHKl7D/5G/w8Ro
TLSH
T15562CA1699345D7BDCDBD209FA91BF93D6F85563A2901E04AAFCCB0C00E66DD611381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bb10877d46ed0c298a93ab9552f2e3a378e19b685c1f5247a7a97f9a5f35c73b
MD5 da1cc4a196bc7f182eff60a54932d573
SHA1 f7b7468b396cfd7b8bcee0c18a4d4e4116029b34
SHA512 ab08423aa75a64100568040023743559adfc57bf6b4f815ddb34cf0f785af8da4d9f24c7ae2630e16a0083194b5d8f5c4db9ac30ef0f8bd371936e5471e380b8
SSDEEP 768:Giqbbo7pLuL7hkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgU1oMW6Uro4ai+:GiqbbUE7hkWg0CfDsu1jafU1oF6/4t+
TLSH
T15BE20C3B680CCB7E4F80499CEC29BEDB6DA801CB56D8C95447EA881C03C6BFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 92ae026899d56017a871c2d7ef43ba777f9676661ab9725a7cceded52aad5a01
MD5 bda492995b4507927f3fa01baad7d5a4
SHA1 05d3bcb4d25782ab805b472d6a7078f5ef00da7e
SHA512 0433dab9ee62b1a5bcf6bb82a5bcf1ed28defa65a2bb0c0f3469d5f87b9a5c7289e75978254c49cc0e33daa6b192e951a9bd0e6c5699d939918f3ad0c7ae1dac
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHWLa2Q44eWIdFgWeK4rgEec+W10m/H2r6V:C1i7PF/DWrwfX9mgpct1o7zsHWLa2Q46
TLSH
T1C091F006723A0250387EAD0C91F9982FD6C17867715CA82F3FE815A25B2BE039DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5adb7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5adb7d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ae43d72b47e0f08828a4c9b94f98439f4def496fb48fea5016d473c71a70c553
MD5 e966e2f384679a0fa3f9b63ea1a4c780
SHA1 077a601aec33c51097df20f40d2e202c89a42cd4
SHA512 da9e31339769637b770990b660ba20b1a455b0dbd3eb0a2c7821de455ed39436484a91e0c9fe9fbc3d79c477367be42b11f76f80aad58722e21f9798b78a4161
SSDEEP 768:yrv+4UNbdQ3Kccc+wfZOGf7df7MvShCQRxvMjt:ybsb23KVwfFfZfYvSF2
TLSH
T14113C032E8746A739EF29245B647BB53BFA46163C4C40794DED94B0C02C75EE231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2d1efd7ac7f5b008f32f6e1f8d7a8a4c404f7d5453837661f33f4bde1d6ba48f
MD5 49faa7d431ea6fe13cae5bd8a5f7102c
SHA1 48bfad4c1a1ebe2d3bc178c4736aa8c791c79dc6
SHA512 fe28ec6cb48e875bd07adeb483635cd5741aff87d85e36f22c7f21dbb6d6aa4840028d3c9a5f6bf157f1d1dd1ad787cb4b7e773ae6712f4235d318236b6f6431
SSDEEP 768:Rrv+4UNbd435+kc+wfZOGf7avShCQtp2bwWV:RbsbO35jwfFfmvSl0wO
TLSH
T10F03CF32E86899339DE792487646BB637EB86173C8C54744DACD0B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d6e21d10f1726a51c1e7edae94a15082aec134e882617ae28145401db3dd7a1b
MD5 14e45fc7f2c767bb5ae5ce0f95458790
SHA1 5a4279f885da9eeab14478769a9b2b0472726289
SHA512 b438f09274aea56b4650ac92a0d21210ca8f23be99a9da8eeb8b63235519621b8dfc0dc4cf3c3716db4cc456243280d7c20ed19a5fc7e855944ca8ab008c8d3c
SSDEEP 768:ej+9S34Ccc+wfZOGf7df7xvShCQRxvMjk:d9S34LwfFfZfVvSFX
TLSH
T101F2AF32EC716A639EE28389B7067B52FFA46163C5C40B54DEDD4F0C02C36AD131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f26a3ae5e73a3f7562f722f68d04aac2bbb64ccddf5168204ba0e3eef0f25c0a
MD5 d51171bb85990b5964e38ea247923e25
SHA1 bdc9d7895ff234b68c23aba7d80fbace6f08d7d4
SHA512 86a3cb819744f84c4b50992e608b1c359363ebcf80f2f0f08e4ac7b1340103bebc8bcb06310462500950779b284ab4f22183850ae0b4b9d7f58b6089c8c69935
SSDEEP 768:Pj+9S3xCcc+wfZOGf7df7xvShCQRxvMjk:i9S3xLwfFfZfVvSFX
TLSH
T1DDF2AF72EC716A639EE28389B7067B52FFA46163C5C40B54DEDD5F0D02C36AD131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 84b2859482a4373572f34ac514a9f9d06792a655635fc8d53caae65271e7023b
MD5 13f6961744500136e6757cbc93c226c9
SHA1 c3419e8f7f898b431c0dd80237b3ad6a7ec18f1c
SHA512 be1be23fc160ad7f6da50f82da0541fad43d098cb8b623c78d0f961c592e7068c194c0a9300d441724dc39a07357ab73f8b3d0605631494d548fc209eade3b03
SSDEEP 768:PF1j+9C3zwgs4ogtfZOGf7df7OvShCQRxvMjk:m9C3CAfFfZfSvSFX
TLSH
T18C133AF298E39976D9EE4787673D6E429EBCD163B5844984FB890D0CCC821BFC306855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

bbb74e70-5495-4938-b637-9c5406c490ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bbb74e70-5495-4938-b637-9c5406c490ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_1725039926\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 11139923a5445f6ebfc426e12bc0c3e5df8f82f5c411b646ceba4c2773ceafdd
MD5 0d431d5e2599229ef817cb596eec48cc
SHA1 657e2b2c0fd551a35918e579b8f6b856363ae920
SHA512 65f5951e2d052b3f424dd6daa2e76d9ce0af665d2256a8238916476a72bbc435b9919a4c860c242b6e41d66f310f9bffec8faccf8b98b326c8b9b3b9465f19f2
TLSH
T1CD71C09366ADC5B3C2DA5BF502835644F6FB227C0B63702447565986AB34A3A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/360-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/360-511-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/460-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/460-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1320-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1600-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1660-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2332-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2344-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4024-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4060-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4060-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4304-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4528-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5312-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5332-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5332-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5392-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download