systex | 93303ebbf35acb44fc6171d5447ab9659e82848a87453f412f19f508601e7eae

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260720-a7b55sc16w
SHA256 93303ebbf35acb44fc6171d5447ab9659e82848a87453f412f19f508601e7eae
MD5 a59eb5cf608ac68ac57ba23865f61de2
SHA1 9e29d8f133cd3b5c4e63bcec3b9f44df1bfd5fea
SHA512 922d88902d2a087abc3cc31c3db55b1c9249c11492c2fe31fab07cbd165c34de29c438c116dcbb42907a141097d28cc5707a5850009393bb47cd7e71c89c7fdf
SSDEEP 3072:OjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:AyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2944	kfcauspkhfzxvsnk.exe
5744	kfcauspkhfzxvsnk.sys
2928	CreateProcess.exe
4556	spnhfaxpmk.exe
4668	CreateProcess.exe
5732	CreateProcess.exe
2800	i_spnhfaxpmk.exe
3732	smkecwupmk.sys
4208	CreateProcess.exe
2064	nhfzxsmkhc.exe
4632	CreateProcess.exe
5112	CreateProcess.exe
4052	i_nhfzxsmkhc.exe
2780	mjecwuomke.sys
2796	CreateProcess.exe
5236	jhbwrpjhbz.exe
6036	CreateProcess.exe
4912	CreateProcess.exe
1560	i_jhbwrpjhbz.exe
1692	ywromgeywu.sys
3580	CreateProcess.exe
3748	trljebwtom.exe
2540	CreateProcess.exe
1104	CreateProcess.exe
3856	i_trljebwtom.exe
2536	trljebwuom.sys
4440	CreateProcess.exe
5684	dbvtnligdy.exe
3624	CreateProcess.exe
4364	CreateProcess.exe
1440	i_dbvtnligdy.exe
2460	igdyvtolgb.sys
5668	CreateProcess.exe
5356	idbvtnlgdy.exe
2276	CreateProcess.exe
4752	CreateProcess.exe
1664	i_idbvtnlgdy.exe
3296	vsqlifdxvq.sys
3096	CreateProcess.exe
3552	qkidbvtnlf.exe
2292	CreateProcess.exe
4736	CreateProcess.exe
3036	i_qkidbvtnlf.exe
5060	pnlicavsnl.sys
2036	CreateProcess.exe
5156	qkicausqnl.exe
1668	CreateProcess.exe
5144	CreateProcess.exe
5076	i_qkicausqnl.exe
3008	spkicausmk.sys
764	CreateProcess.exe
5092	hcauspnhca.exe
828	CreateProcess.exe
2524	CreateProcess.exe
5956	i_hcauspnhca.exe
1264	nkfcxusmhf.sys
4328	CreateProcess.exe
1788	hfcxupnhfz.exe
2880	CreateProcess.exe
4172	CreateProcess.exe
3036	i_hfcxupnhfz.exe
2824	cwusmkhezx.sys
4308	CreateProcess.exe
5796	urmjhecwuo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_452474408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1161985540\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_253020293\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_253020293\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_253020293\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_230708296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_452474408\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1161985540\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_253020293\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnkecxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcauspkhfzxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcauspnhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_auspkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxsmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaysqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnkecxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqomgdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaysqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auspkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxsmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqomgdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcauspnhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjebwuom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5688	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4664	ipconfig.exe
5300	ipconfig.exe
3244	ipconfig.exe
5484	ipconfig.exe
2752	ipconfig.exe
1528	ipconfig.exe
1624	ipconfig.exe
4300	ipconfig.exe
3560	ipconfig.exe
4424	ipconfig.exe
5300	ipconfig.exe
2832	ipconfig.exe
3508	ipconfig.exe
2524	ipconfig.exe
1740	ipconfig.exe
4944	ipconfig.exe
5960	ipconfig.exe
3768	ipconfig.exe
5860	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289822608681334"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{22833217-B5DC-487A-8010-E8C20A129042}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe
2944	kfcauspkhfzxvsnk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	i_spnhfaxpmk.exe
Token: SeDebugPrivilege	4052	i_nhfzxsmkhc.exe
Token: SeDebugPrivilege	1560	i_jhbwrpjhbz.exe
Token: SeDebugPrivilege	3856	i_trljebwtom.exe
Token: SeDebugPrivilege	1440	i_dbvtnligdy.exe
Token: SeDebugPrivilege	1664	i_idbvtnlgdy.exe
Token: SeDebugPrivilege	3036	i_qkidbvtnlf.exe
Token: SeDebugPrivilege	5076	i_qkicausqnl.exe
Token: SeDebugPrivilege	5956	i_hcauspnhca.exe
Token: SeDebugPrivilege	3036	i_hfcxupnhfz.exe
Token: SeDebugPrivilege	1060	i_urmjhecwuo.exe
Token: SeDebugPrivilege	4540	i_uomjebwuom.exe
Token: SeDebugPrivilege	5716	i_tqomgdbvtq.exe
Token: SeDebugPrivilege	4064	i_trljdbwtol.exe
Token: SeDebugPrivilege	804	i_tqlidayvtn.exe
Token: SeDebugPrivilege	1692	i_kicaysqkfd.exe
Token: SeDebugPrivilege	3004	i_auspkfcxvp.exe
Token: SeDebugPrivilege	4280	i_xspnkecxvp.exe
Token: SeDebugPrivilege	2652	i_urmkecwuom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 2944	1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1324 wrote to memory of 3364	1324	2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3364 wrote to memory of 4100	3364	iexplore.exe	90
PID 4100 wrote to memory of 3524	4100	msedge.exe	91
PID 4100 wrote to memory of 2784	4100	msedge.exe	92
PID 4100 wrote to memory of 2784	4100	msedge.exe	92
PID 4100 wrote to memory of 2784	4100	msedge.exe	92
PID 4100 wrote to memory of 5688	4100	msedge.exe	94
PID 4100 wrote to memory of 4384	4100	msedge.exe	95
PID 4100 wrote to memory of 4384	4100	msedge.exe	95
PID 4100 wrote to memory of 1328	4100	msedge.exe	96
PID 4100 wrote to memory of 1328	4100	msedge.exe	96
PID 4100 wrote to memory of 1328	4100	msedge.exe	96
PID 4100 wrote to memory of 4068	4100	msedge.exe	97
PID 4100 wrote to memory of 4068	4100	msedge.exe	97
PID 4100 wrote to memory of 4068	4100	msedge.exe	97
PID 4100 wrote to memory of 3608	4100	msedge.exe	98
PID 4100 wrote to memory of 3608	4100	msedge.exe	98
PID 4100 wrote to memory of 3608	4100	msedge.exe	98
PID 4100 wrote to memory of 2284	4100	msedge.exe	99
PID 4100 wrote to memory of 2284	4100	msedge.exe	99
PID 4100 wrote to memory of 2284	4100	msedge.exe	99
PID 4100 wrote to memory of 5732	4100	msedge.exe	119
PID 4100 wrote to memory of 5732	4100	msedge.exe	119
PID 4100 wrote to memory of 5248	4100	msedge.exe	104
PID 4100 wrote to memory of 4760	4100	msedge.exe	105
PID 4100 wrote to memory of 5248	4100	msedge.exe	104
PID 4100 wrote to memory of 4760	4100	msedge.exe	105
PID 2944 wrote to memory of 2928	2944	kfcauspkhfzxvsnk.exe	106
PID 4100 wrote to memory of 1144	4100	msedge.exe	109
PID 4556 wrote to memory of 4668	4556	spnhfaxpmk.exe	111
PID 4100 wrote to memory of 3720	4100	msedge.exe	114
PID 4100 wrote to memory of 3720	4100	msedge.exe	114
PID 4100 wrote to memory of 3296	4100	msedge.exe	115
PID 4100 wrote to memory of 3296	4100	msedge.exe	115
PID 2944 wrote to memory of 5732	2944	kfcauspkhfzxvsnk.exe	119
PID 2944 wrote to memory of 4208	2944	kfcauspkhfzxvsnk.exe	123
PID 2064 wrote to memory of 4632	2064	nhfzxsmkhc.exe	125
PID 2944 wrote to memory of 5112	2944	kfcauspkhfzxvsnk.exe	128
PID 2944 wrote to memory of 2796	2944	kfcauspkhfzxvsnk.exe	132
PID 5236 wrote to memory of 6036	5236	jhbwrpjhbz.exe	134
PID 2944 wrote to memory of 4912	2944	kfcauspkhfzxvsnk.exe	137
PID 2944 wrote to memory of 3580	2944	kfcauspkhfzxvsnk.exe	142
PID 3748 wrote to memory of 2540	3748	trljebwtom.exe	144
PID 2944 wrote to memory of 1104	2944	kfcauspkhfzxvsnk.exe	147
PID 4100 wrote to memory of 3432	4100	msedge.exe	149
PID 4100 wrote to memory of 1668	4100	msedge.exe	150
PID 4100 wrote to memory of 5144	4100	msedge.exe	151
PID 2944 wrote to memory of 4440	2944	kfcauspkhfzxvsnk.exe	154
PID 5684 wrote to memory of 3624	5684	dbvtnligdy.exe	156
PID 2944 wrote to memory of 4364	2944	kfcauspkhfzxvsnk.exe	159
PID 2944 wrote to memory of 5668	2944	kfcauspkhfzxvsnk.exe	163
PID 2944 wrote to memory of 4752	2944	kfcauspkhfzxvsnk.exe	168
PID 2944 wrote to memory of 3096	2944	kfcauspkhfzxvsnk.exe	172
PID 3552 wrote to memory of 2292	3552	qkidbvtnlf.exe	174
PID 2944 wrote to memory of 4736	2944	kfcauspkhfzxvsnk.exe	177
PID 2944 wrote to memory of 2036	2944	kfcauspkhfzxvsnk.exe	181
PID 5156 wrote to memory of 1668	5156	qkicausqnl.exe	183
PID 2944 wrote to memory of 5144	2944	kfcauspkhfzxvsnk.exe	186
PID 4100 wrote to memory of 1112	4100	msedge.exe	188
PID 4100 wrote to memory of 1112	4100	msedge.exe	188
PID 2944 wrote to memory of 764	2944	kfcauspkhfzxvsnk.exe	194
PID 5092 wrote to memory of 828	5092	hcauspnhca.exe	196
PID 2944 wrote to memory of 2524	2944	kfcauspkhfzxvsnk.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a59eb5cf608ac68ac57ba23865f61de2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Temp\kfcauspkhfzxvsnk.exe
  C:\Temp\kfcauspkhfzxvsnk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxpmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2928
  - - C:\Temp\spnhfaxpmk.exe
      C:\Temp\spnhfaxpmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxpmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5732
  - - C:\Temp\i_spnhfaxpmk.exe
      C:\Temp\i_spnhfaxpmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxsmkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4208
  - - C:\Temp\nhfzxsmkhc.exe
      C:\Temp\nhfzxsmkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxsmkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\i_nhfzxsmkhc.exe
      C:\Temp\i_nhfzxsmkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Temp\jhbwrpjhbz.exe
      C:\Temp\jhbwrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4912
  - - C:\Temp\i_jhbwrpjhbz.exe
      C:\Temp\i_jhbwrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3580
  - - C:\Temp\trljebwtom.exe
      C:\Temp\trljebwtom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1104
  - - C:\Temp\i_trljebwtom.exe
      C:\Temp\i_trljebwtom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnligdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4440
  - - C:\Temp\dbvtnligdy.exe
      C:\Temp\dbvtnligdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnligdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\i_dbvtnligdy.exe
      C:\Temp\i_dbvtnligdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Temp\idbvtnlgdy.exe
      C:\Temp\idbvtnlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4752
  - - C:\Temp\i_idbvtnlgdy.exe
      C:\Temp\i_idbvtnlgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidbvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3096
  - - C:\Temp\qkidbvtnlf.exe
      C:\Temp\qkidbvtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidbvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\i_qkidbvtnlf.exe
      C:\Temp\i_qkidbvtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\qkicausqnl.exe
      C:\Temp\qkicausqnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5144
  - - C:\Temp\i_qkicausqnl.exe
      C:\Temp\i_qkicausqnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcauspnhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:764
  - - C:\Temp\hcauspnhca.exe
      C:\Temp\hcauspnhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcauspnhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2524
  - - C:\Temp\i_hcauspnhca.exe
      C:\Temp\i_hcauspnhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\hfcxupnhfz.exe
      C:\Temp\hfcxupnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\i_hfcxupnhfz.exe
      C:\Temp\i_hfcxupnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjhecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\urmjhecwuo.exe
      C:\Temp\urmjhecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjhecwuo.exe ups_ins
    3⤵
    PID:264
  - - C:\Temp\i_urmjhecwuo.exe
      C:\Temp\i_urmjhecwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjebwuom.exe ups_run
    3⤵
    PID:2888
  - - C:\Temp\uomjebwuom.exe
      C:\Temp\uomjebwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjebwuom.exe ups_ins
    3⤵
    PID:2340
  - - C:\Temp\i_uomjebwuom.exe
      C:\Temp\i_uomjebwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqomgdbvtq.exe ups_run
    3⤵
    PID:2532
  - - C:\Temp\tqomgdbvtq.exe
      C:\Temp\tqomgdbvtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqomgdbvtq.exe ups_ins
    3⤵
    PID:1924
  - - C:\Temp\i_tqomgdbvtq.exe
      C:\Temp\i_tqomgdbvtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwtol.exe ups_run
    3⤵
    PID:1776
  - - C:\Temp\trljdbwtol.exe
      C:\Temp\trljdbwtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    PID:5060
  - - C:\Temp\i_trljdbwtol.exe
      C:\Temp\i_trljdbwtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidayvtn.exe ups_run
    3⤵
    PID:2660
  - - C:\Temp\tqlidayvtn.exe
      C:\Temp\tqlidayvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidayvtn.exe ups_ins
    3⤵
    PID:5072
  - - C:\Temp\i_tqlidayvtn.exe
      C:\Temp\i_tqlidayvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaysqkfd.exe ups_run
    3⤵
    PID:4960
  - - C:\Temp\kicaysqkfd.exe
      C:\Temp\kicaysqkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaysqkfd.exe ups_ins
    3⤵
    PID:5864
  - - C:\Temp\i_kicaysqkfd.exe
      C:\Temp\i_kicaysqkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\auspkfcxvp.exe ups_run
    3⤵
    PID:240
  - - C:\Temp\auspkfcxvp.exe
      C:\Temp\auspkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_auspkfcxvp.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_auspkfcxvp.exe
      C:\Temp\i_auspkfcxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnkecxvp.exe ups_run
    3⤵
    PID:1004
  - - C:\Temp\xspnkecxvp.exe
      C:\Temp\xspnkecxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnkecxvp.exe ups_ins
    3⤵
    PID:448
  - - C:\Temp\i_xspnkecxvp.exe
      C:\Temp\i_xspnkecxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    PID:2856
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    PID:1388
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2652
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdbb2ac188,0x7ffdbb2ac194,0x7ffdbb2ac1a0
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15996479219835843988,7774109819025658767,262144 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,10309473872444619335,8283849139826638436,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,5187664709185941516,1440115966658380713,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:13
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,599307375841928845,7075671442565541778,2097152 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,2154085968827821109,17762068521278887433,2097152 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3248,i,7127226799252069868,17619572841995393462,2097152 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9181897460440202842,11257352590036965375,2097152 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,6346971893949611330,16015338479648087404,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11315314009415515981,8274545706394599580,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,5115186754718661356,17559367699509814141,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10780612440286534714,15382524483237837009,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10780612440286534714,15382524483237837009,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8252189637262339932,16632226175752188363,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,5001370082867559687,11403529503249902421,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,9922057490804043888,626342683288713327,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6589239037979103400,1337544618343550069,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,11210922506776152894,1326774395093698017,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,5696868199328425985,1000689308449290218,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,105157854481197680,7056457306509213429,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3860848213040361967,12991001919894471641,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,1132069799949876449,18170717336501698021,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,7042639898307693135,9638530880123727961,262144 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:10
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10137031686956141303,13974748926607617953,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17341595346251669589,2932879507633272070,524288 --field-trial-handle=2072,i,9032136028824507782,11243154773224661159,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4172

C:\Temp\kfcauspkhfzxvsnk.sys
C:\Temp\kfcauspkhfzxvsnk.sys
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2976

C:\Temp\smkecwupmk.sys
C:\Temp\smkecwupmk.sys
1⤵
- Executes dropped EXE
PID:3732

C:\Temp\mjecwuomke.sys
C:\Temp\mjecwuomke.sys
1⤵
- Executes dropped EXE
PID:2780

C:\Temp\ywromgeywu.sys
C:\Temp\ywromgeywu.sys
1⤵
- Executes dropped EXE
PID:1692

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
- Executes dropped EXE
PID:2536

C:\Temp\igdyvtolgb.sys
C:\Temp\igdyvtolgb.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Temp\vsqlifdxvq.sys
C:\Temp\vsqlifdxvq.sys
1⤵
- Executes dropped EXE
PID:3296

C:\Temp\pnlicavsnl.sys
C:\Temp\pnlicavsnl.sys
1⤵
- Executes dropped EXE
PID:5060

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
- Executes dropped EXE
PID:3008

C:\Temp\nkfcxusmhf.sys
C:\Temp\nkfcxusmhf.sys
1⤵
- Executes dropped EXE
PID:1264

C:\Temp\cwusmkhezx.sys
C:\Temp\cwusmkhezx.sys
1⤵
- Executes dropped EXE
PID:2824

C:\Temp\wrojhezwrm.sys
C:\Temp\wrojhezwrm.sys
1⤵
PID:2096

C:\Temp\hbztromgey.sys
C:\Temp\hbztromgey.sys
1⤵
PID:5216

C:\Temp\trljdbytrl.sys
C:\Temp\trljdbytrl.sys
1⤵
PID:4452

C:\Temp\tqligayvqn.sys
C:\Temp\tqligayvqn.sys
1⤵
PID:3544

C:\Temp\qkidavsqki.sys
C:\Temp\qkidavsqki.sys
1⤵
PID:4164

C:\Temp\qkicaxsqkf.sys
C:\Temp\qkicaxsqkf.sys
1⤵
PID:4564

C:\Temp\czusmkhfzx.sys
C:\Temp\czusmkhfzx.sys
1⤵
PID:3252

C:\Temp\xusmkecxup.sys
C:\Temp\xusmkecxup.sys
1⤵
PID:4116

C:\Temp\rmkecwuomg.sys
C:\Temp\rmkecwuomg.sys
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtnligdy.exe

Path C:\Temp\dbvtnligdy.exe
Size 376KB
SHA256 b0795b4284e794bc74d9d00518a6336fc559e8f4a074265657902660112b7306
MD5 a79a64c19e27fda43b98937a7dc75b52
SHA1 6445247bbabc4324f0075bae2405476aa2fbf41a
SHA512 2e583cb548f80712b3ee4d93968abfeb4d0a463d245517181e33f75a8b9bc514be29e0e1c15d7fe31d49444e0de550e0381724e1b7c52d660f7ea1254fc62b9b
SSDEEP 3072:4jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:myLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnligdy.exe

Path C:\Temp\i_dbvtnligdy.exe
Size 376KB
SHA256 794c91dc3b6e0e5a2c36a0291dbac1d6bbd66ecfe631d3657ee97716397c6a5e
MD5 22e223b8c79784cf69e3a8893fb09c46
SHA1 e89553c633cde5bf0accf034e2dbf10bc5454216
SHA512 0ba866e7459dd76c337a9b38eeee365b600129b4ab519b8f2f4a039d029e7c7f8a3d25b3c98146ee7af971fb9e9e80a3794dab10efec6a477823c30693c7264e
SSDEEP 3072:ljyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T194847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlgdy.exe

Path C:\Temp\i_idbvtnlgdy.exe
Size 376KB
SHA256 e3229abb37475e4fb675cdf14090bc8b4c0e265933ad20bb59d292e29e96b219
MD5 3d6fb6086aabed1792021454478a1d15
SHA1 0c1bc12b8351092e3858f2c7ffc5087066e7f936
SHA512 46f2d4296f87ba745cabcdc0ae759276fd8e87769135ae878f99f329fb73f5e1261f7d05113ed57064619da9687f75a61adb3f4e95f14399c6aa1f180ea42f23
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbwrpjhbz.exe

Path C:\Temp\i_jhbwrpjhbz.exe
Size 376KB
SHA256 898089ef6133a0b47ef167aba6c65fcbd7039cec46c556204f519578262fe443
MD5 7332ccf04188ea1c87dcc80c63cc8696
SHA1 a27eda1bf5cad8b2709799861a18c0a74b932ec4
SHA512 8f62176aa26536b8177cac2e8214c55d04fc1ef0d09a4da024163c84be49831f3cc1e5864bee70a23faff9b250bbe1e27e6297744dc2075898686d69570dc772
SSDEEP 3072:QjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxsmkhc.exe

Path C:\Temp\i_nhfzxsmkhc.exe
Size 376KB
SHA256 367665c6b666a7042964f944739de7500e98fd4d56fb46acaaaf138a2518d756
MD5 21d83f43d7462d3e02ab8dc642a2ba18
SHA1 c7f646296c0d8acd82384c68bde514520ee4ec1d
SHA512 7484e82d3f8408e5fb604800818041fbc8ef86a45e3c70f4f6f55c73bdc3c21ffd623fd1ff09acd9787cdd061c48654d8d318f5034c1fa327a46ec68d32b2093
SSDEEP 3072:XjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfaxpmk.exe

Path C:\Temp\i_spnhfaxpmk.exe
Size 376KB
SHA256 060620f6834a20e3492d92c4b621987ebeda12abd851c50c5bfd5b47a33308b1
MD5 b9866b58ed03b4824475c4f1f6f43959
SHA1 9556e5794929c67e24865da623b0771eb543c057
SHA512 e09e1888903742d99d49f930e4d165cbff5e290099a79f97d8b5fc9d1801f4caa0d7e7dfe26ed1fe6c3bd486c6307895c4f5edf91bae0bf35c3fb787d4c970cd
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11A847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljebwtom.exe

Path C:\Temp\i_trljebwtom.exe
Size 376KB
SHA256 584b52b1f75db243d1c57d25a9c3ff87f618ae2696e7c29e949d69fe48e1b8aa
MD5 b1f16abdf0283f6086e7370f1861cffa
SHA1 bf9bf2bef2de5e181b0d331e89256d25850f47df
SHA512 a6d4cede2df61ed0df8fb766d93e79287580b68ccd9b199fe4179ae4bdb94216328739b19c0d4d6397db6b29a5262272cb352ac2ffa910bea719c15273d13d3d
SSDEEP 3072:QjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgdy.exe

Path C:\Temp\idbvtnlgdy.exe
Size 376KB
SHA256 56ca575ebef62aae8303ee831414ba3134082ccc89d48da43393dbdda3cc439d
MD5 1885b1564afb8f0459b0d95a1cbf58c6
SHA1 6cf5029875d49f4f91f4ef127ebd453ab50fa710
SHA512 377f7900be1c0d8515d700ea94e38855e59439fcf7b4bca274e296b9d3e7ce0bdd2d4f018881db3b81c9dcba952652335d76bcd32995a6379d1cb12c6f5d9bd0
SSDEEP 3072:fjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EC847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvtolgb.sys

Path C:\Temp\igdyvtolgb.sys
Size 293KB
SHA256 6f7a56159862a210b6b925c1f3b0d5e8cdca2fea3c05a38cd85d3b5175a743e8
MD5 57108c055ad073690623c213c1ade109
SHA1 0648803e2647e4c09f5b353c2c96cf5bed09a43b
SHA512 66eb35dd4740b9c22ed09a32a430f8f89bcacf3cf9c4257af0df0822202293da25cb2df190657483ed053006f0357c5c72949a8ae23d583cdc64a17a90e95ffe
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbwrpjhbz.exe

Path C:\Temp\jhbwrpjhbz.exe
Size 376KB
SHA256 8176aa7c5ebda8237cf71e106a20d912c7e98dda6d9090525250a3ffc1acdac7
MD5 23d3fa70fd26c11d14c3c452e82c4f0f
SHA1 a141a6981cafb2e5cbea83c8c35df17224cf834c
SHA512 13132f7b28ccf83df7740c89d8d377bdafc1d8d435a7f815608d3ab56011e6e32935185194bf7f7ffab2b6003c460288ae9666ed50c52fda369e4717d60a4b20
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcauspkhfzxvsnk.exe

Path C:\Temp\kfcauspkhfzxvsnk.exe
Size 376KB
SHA256 dc3a041f8e7c54e6371f0bff48c4ade48831a00ffaefbdad5e62603ab59b1ccd
MD5 dfb2e804e13fc44ad46e6cfe3bc1e072
SHA1 07f4927cda0d0c8bde474b23829188cbb38ab30a
SHA512 3fdbbd333ea2cb074bff6f5bb1adde64ab8a2996d1cce8efe8b7dff342da6dc0d6b1bd811ff954a47c1562b62ae37eee01d577c157a115f8b0b67b5a56dc7d05
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcauspkhfzxvsnk.sys

Path C:\Temp\kfcauspkhfzxvsnk.sys
Size 293KB
SHA256 6ea6e5f1664661fc72a5270b1f41871940eaf8f6522182d3f1138d1f2147e3d5
MD5 f6226345ef66daeb08badfb533fe38cf
SHA1 f16ad89e240d25b7f08ddcf2a9a0c6cdd62beb59
SHA512 f9bb6abd7f2dbacaa7ff71a0ec50e28f3d6225330feeb3ada8a80ba8aa343fe048d568cd88ce54d72aba79d42df051343c01b71a6c4e441994c2d9b89efaa167
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T184545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomke.sys

Path C:\Temp\mjecwuomke.sys
Size 293KB
SHA256 8189736fe743aae9183497ad161f98e20e83503b94a3de8c887ed37a534b7c57
MD5 203266a1d2f9449038e20fddd3c08e5d
SHA1 8f4e047db0e3323392618ea16690cf52cb346615
SHA512 4bff9cb3418973f113b581ecb6cf0ef06b20e9e283ce01ff045f775f516a63ce68545269ca965065c3cc7e04bcf0a00340c61990a181309c686831ce9b9d87f3
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T134545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxsmkhc.exe

Path C:\Temp\nhfzxsmkhc.exe
Size 376KB
SHA256 55459696012257272319be38663f12df7428b60fa97552b57d3cae27241b1100
MD5 2c1696176194690b6f6213433e38bf98
SHA1 1b5da11f6db49af5ea93972b87f91dbdaecc4d93
SHA512 27240e51dcc4d67200ae5578d667f245031b2318074f922d70b58442646c2e334b01c22d7a4a1f5b0151478ba3875c99d555f25d5e3270ca10882b001f27237d
SSDEEP 3072:8jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwupmk.sys

Path C:\Temp\smkecwupmk.sys
Size 293KB
SHA256 d3b1c0d61ad7710aa5551672f0151c023828e349edd8ca526674e75583ee3ff5
MD5 4acb1596a116da1311659badfe6708fe
SHA1 d4ddbf335754b44d45df18fe482e6cf571fa3287
SHA512 99ba8646da345de8a78215fafafedbac3c72f89ee92353cac32e172914e746ea63c37afabae09c77b31735c421c05e85975b3cd9d0a8635f205c42992942cb4e
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T12C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfaxpmk.exe

Path C:\Temp\spnhfaxpmk.exe
Size 376KB
SHA256 145dd7c28b110a4588bb7b07b76e2ee68005112c1f2b0104c36bc973b140a62d
MD5 10c469a87ab9464f868a6d0ad88c68b3
SHA1 79c478cc1e7bd5b2e24d9d1e658649541b63df93
SHA512 ba7819c4c07b876f4d302586c50231f0cdb0f153dc5fee2e241b12edc2eb8e3040ce014ebf999d7eeebe595bf9b1671c363a0c5d5436a5030758568d087ea6c6
SSDEEP 3072:jjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwtom.exe

Path C:\Temp\trljebwtom.exe
Size 376KB
SHA256 036a19706c312c76b8e0055685876c3118a84b83e5a4f2965ca1bd6883619aa1
MD5 4d0797304cb360fa3ba557f1a8397ebf
SHA1 e4393ba6bb84a979bd0247ba341587e1813f9b71
SHA512 369136e29390d30b32055afba5174dbce64ee7255a160d4d27bb794ff5840ad534abe7fd9bdaebc84e2b1ca0f9bde5abdb7ee2721488bb7f1b955db5bbe77e3f
SSDEEP 3072:OjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:AyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwuom.sys

Path C:\Temp\trljebwuom.sys
Size 293KB
SHA256 328a56d60a806c6aec6880c8da5ba944231b528e3e876e9641458d8bb96c6438
MD5 976030c8f4ad9790fb74d381480bb4f5
SHA1 0abe313fc44be1aa6b8a40ecddaa7f85d4e5ba8a
SHA512 ff578f39f4bc3a8ed238057b148790a8dec1ec45f97a4f5e7775710ac8de940f0da33bc8c81f044d32c21206f1b97a098c3342265c37555f16fcfcedb96f4874
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywromgeywu.sys

Path C:\Temp\ywromgeywu.sys
Size 293KB
SHA256 6050045b1279d76226fae3acd303b55a55adf956e4b5b4d38df7f2cc06569a42
MD5 a05c8eedd6f85c2356d2c4855658b8ba
SHA1 1509b428cffc403ac5c53775893ff3f72cf9baa3
SHA512 ad287d169f2ba96657bc5015c12f8590292eb52528a774e606700e1fa00fbbdd7478a6bd08c39a936cb08dd88fbab9361139482861daf9d92e283aa3a333234e
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 950a0d242a2bb64f21c344e9628078c0ccdc39109cd6673fb041d501d9e8b417
MD5 526bba6ee9edb00df0223e349c005d87
SHA1 e707c6bbdc3758a5020e0ea4024a87b387c9e3de
SHA512 a8c7096ca92cb801a86de42552307407e126cae19ad7e17105a00e3f0531749c3bdec8cfd50f0e79f2c3e5a1735f5d9cc2951888b633e6e49b62ffdb7b3e0e97
TLSH
T14451D69E03321AC0E79760B664E4158933F6A60A0A0B5E335750AF337A4BF19E1FE103
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3ab8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3ab8.TMP
Size 3KB
SHA256 72f361b46164467e1db13db20b67ed042daa85fb436d180662e8d6c2a83c89b0
MD5 6fe8e8476904783a2bbde5bf8e3ad2da
SHA1 5acc0b3fb02d18419eee8f860db019fdb1609e6f
SHA512 50a56682d138d82b597d14e1b9b94b0fe1af6f822fd09a5626735a2cc24ee82b861ca7857536af20b3996d913d2c05607da6b6cd280f290ef2243fbe7297c9c7
TLSH
T1F851D69E03321AC0E79760B664E5158933F6A60A0A0B5E335754AF337A4BF19E1FE113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 94bf76e893cd37ae38b16dff8a67b2e93cafb5cc0eae7d535b7b8cc79f7d5f56
MD5 aa466d35c69ae8764418ec50ae06d04b
SHA1 a553a61938632d4b342fe2f2028853bbc4a26c4e
SHA512 595dacb501bfaf2f04387c2851f38a18ee9f6cc61c907711046df9665a99b650e7d91ef440166b29b3d2cd9b1549e1d96e9772445ee54777b11769e0c2dc6530
TLSH
T13B418CF3C7E88A2D8A0156F4AB186E2BCE1D0914432C3D5AC9E4AF1BA7E2871D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7a3ff7bc47a87fcce82fbb278c8b908513d2d76e937f886e32d5651b2e7ae1d3
MD5 4041cdf190c5f6e16cfda1d12575e3a8
SHA1 273d8baddf4767c556032eaf8bb4259c099a2cce
SHA512 c729e99e01b51d7f307ca633cf38e58c61704faf63c4627756b5651ba58d86e97b7a8aee5d6c78f5fbb5851daab62dee95e14f32475386656bfa68f7ccf99681
SSDEEP 192:sxR3R9CP/fjsngOiZra0zoD8p9A/g6+WNCwp/YC6uOmGsIgtJ:sxR3aP/fjsngOkmcW/5v/ki3
TLSH
T1B132B8166E289D3B9CCBD219BB55BF53D2F96032A1D41E48EBFC871C04E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2c0e47679318b6bc3a3d2d9fa70b12d03da2460b8b1ff01b9e916eb6e171218a
MD5 99f438d73c23e6d536718cd67d7f8c67
SHA1 77ba71beefa624f4e91700db5652033142e92b93
SHA512 8504ff76d90febaedae76ad9664c47343c4492480cf41f238187e60d3883678d8553d7088bfa837d164315b586e9bcf7f23f17aa843fa9a438b71512945cd118
SSDEEP 192:sxRUR9CP/fjsPgViZra0zoD8p9A/g6+WNCwp/YC9uOmGsIgD0J:sxRUaP/fjsPgVkmcW/5v/hic
TLSH
T18942B8166A289D3B9CCBE249BB55BF53D2F96032A1D11E48A7FC870C04E67DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4c943c5df555454fa20e2c8257e439751ccb0258556485d40abe8f9f60747e10
MD5 7b56aae196db44afcf769ab4f29f6850
SHA1 6d823ecc20569129b9c6407f2748c46ce47e37b6
SHA512 077e8e2b06325f15b8ffd249d36a751c7acb271cdc4044a895d68a277ca26b3bd95a120ede14b6c5a63859fe1c5ca165a12a2e22fdae89c9faf7a98ad8cfadee
SSDEEP 192:sxRUR9CP/fjsPgOiZra0zoD8p9A/g6+WNCwp/YC6uOmGsIgDCJ:sxRUaP/fjsPgOkmcW/5v/kiC
TLSH
T10542B8166E289D3B9CCBD219BB55BF53D2F96032A1D01E48ABFC871C04E67DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ee4c064fa5f6d3fd51186e3ac3a7534a6274f9519b85b133969e99bee424f7e9
MD5 7bf156bb54f9b43a7caad3057ec0f193
SHA1 1835f1c89a9f0e5417b8fd2a1fad4f17866634f6
SHA512 111c4e2a7116dc9b007045a56569c4c98dc4a763621874469c65a56609df0addf92525e2e13e44bede4d216e49de2d07beaeae348e76d6808273a917f9299d91
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMv0QqcmroZU:jC+vf7E7JQWgQ+f4+u1jaHv0Vcd+
TLSH
T13AD2EA7B640DCB7F4F804ADDEC197A9A6DA802CB9698CD4047FEC41C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad5fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad5fe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0046f5f41c13f00007440ef73193a458349d25b67d7ae4ecfd6e2343846bed21
MD5 d905ac26530aa1014f1b837f1edec603
SHA1 75cf20054c86195c627924cab595f7a5f3a1f529
SHA512 323aa0aaf79f6b7bbadd1cbcd0d9c4ff06a3d46f66c9f55d26e033e3016f6a59b21d108c20e0e9b05b25499b734af1dd43d219769f1aa60adbedc5a539a88011
SSDEEP 768:xj+9N3K6Hbxp8+p3bd66j+4BRv86aLIWNb9M3:s9N3Xbv8+p3Z6n4yDb+3
TLSH
T12CF2AE32E8A9DD734CE5C784B2563B83AFF421A796C01DC8D9DDAF0D048729D5B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b6822ecc4aa71f80dea902c0d3458f60a2234e4bb957e9cb5fa06a0929d8ea7e
MD5 81003a423847bb2660a8be75f9f0fa16
SHA1 acd4274ee6027fed01435642b8796c77eb4c77a1
SHA512 381e502678e7d86510344ddc4f2c34bda1fbd6f211355bf2627b38fb021a8362490880c11ebadb5bdbe8e6b238806d0e0bb4f80b0c009414b976607700df21d3
SSDEEP 768:Irv+4UNbdD3TceNp8+p3bd66j+4BRv86aLIiA2bwCl1:Ibsbp3/L8+p3Z6n4yK0ww
TLSH
T12203CF73F8A899739CF6C644B2467A437FF821A396C10EC4D5DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 801c7684afbc918785651637c1d0365ac501a685a72eeb6fa59b394e66aaa670
MD5 6361f4c29460c3c40fc237052ee50764
SHA1 e2e8a24217f83a79b34dc2a1bd959a2ec073a6c3
SHA512 5e296b5bf5628c6b30b5a0e684d8a16b70fb46f16c5d44fc4d5ca9c11678be132a4549af45c5e4277dfe2bca3869604c60e1fca80895e596994dfe46be0ad73f
SSDEEP 768:Ej+9N376Hbxp8+p3bd66j+4BRv86aLIWNb9M3:T9N30bv8+p3Z6n4yDb+3
TLSH
T1F3F2AE32F8A9DD734CE5C784B2563783AFF421A796C01D88D9DDAF0D04872AD5B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4d1a661c8de636fbc9747e0ba7acff45b6eae0ca8f31ebc9311331bd10193752
MD5 12b015c3abc7002a776faed87df21483
SHA1 3cdc8d5c88451bf70547a4606af08ff7257b3f24
SHA512 f67c662c98980746a0c111dc311e1269e2e6be0a010cb5e890eb394b34a04a5dee2dd41aad4674bbc19d7d6aec6865abb9722aad8929097a0e80001ac31a14b2
SSDEEP 768:tF1j+9D3Zwgv0mxp8+p3bd66j+4BRv86aLIWNb9M3:k9D3tv8+p3Z6n4yDb+3
TLSH
T1581317F298D78976D8AE8787A37D2E469EFCD163B5841884B7C85E4CCC821BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

b6cc63c5-ce84-40c6-b30b-c7e24d3ab33e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b6cc63c5-ce84-40c6-b30b-c7e24d3ab33e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4100_1420204040\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8dac8bdee46b302a3077cd2f45cf4a718133687626ce50bf9461e1c3b14bec20
MD5 1cd3beabed24221aaef7c2d361510cdc
SHA1 3cc3f89e950897468ad7686795afad5702f1dad9
SHA512 0e55548405c676695c68e9b5a98150e750590a815216b9dcee93371eff6033bf29ddf09a39de0f859550d686d1401b57f4838f73484fe6c47bc1118bee8bae03
TLSH
T12C71008366ADC9B3C1DA5BF402835684F1FB22780B3320600B525587AB30A3A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1264-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1692-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2096-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2460-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2536-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2780-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2824-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3008-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3252-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3296-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3732-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4116-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4164-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5060-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5216-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5744-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download