systex | b90ad8c72750fb3bb441da8b9c8c554bef6936399fbc6f02f9575b0a37f845d0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260720-wkpcvab19z
SHA256 b90ad8c72750fb3bb441da8b9c8c554bef6936399fbc6f02f9575b0a37f845d0
MD5 2f59952477a6c2e22f824f6925e63c10
SHA1 98e82d7dea081bd25595cd862e30fd8932ce35fe
SHA512 f02aaad21a8efc1a9f3c907a960db9c10c8935658a753da8cf84f2c9d555326b0e615f0d2a9e96d5470325439e004d24ed13401fba85404744d804fe1d520a05
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5424	kecwusmkhczuspmh.exe
5400	kecwusmkhczuspmh.sys
1152	CreateProcess.exe
2432	pjhfzurmjh.exe
4784	CreateProcess.exe
2648	CreateProcess.exe
3528	i_pjhfzurmjh.exe
3712	hezxrpbztr.sys
2920	CreateProcess.exe
3760	cwupmgezwr.exe
4492	CreateProcess.exe
2916	CreateProcess.exe
5916	i_cwupmgezwr.exe
5336	ztomgezwuo.sys
2020	CreateProcess.exe
6028	rojherojgb.exe
5564	CreateProcess.exe
4808	CreateProcess.exe
2524	i_rojherojgb.exe
2580	ljebvtrljg.sys
4444	CreateProcess.exe
1516	ligywqomge.exe
3196	CreateProcess.exe
2888	CreateProcess.exe
2768	i_ligywqomge.exe
5572	jdyvtolgdy.sys
4192	CreateProcess.exe
1276	daytqligay.exe
5316	CreateProcess.exe
6116	CreateProcess.exe
5416	i_daytqligay.exe
1400	dyvtnlayvq.sys
2984	CreateProcess.exe
1436	vsqkfdxvsq.exe
2860	CreateProcess.exe
4360	CreateProcess.exe
5560	i_vsqkfdxvsq.exe
3528	avtnlfdxvq.sys
1768	CreateProcess.exe
5348	tnkfdankfc.exe
3764	CreateProcess.exe
5760	CreateProcess.exe
4844	i_tnkfdankfc.exe
4768	nkfcausqnh.sys
2172	CreateProcess.exe
1172	kifaxspnhf.exe
3028	CreateProcess.exe
1512	CreateProcess.exe
5176	i_kifaxspnhf.exe
5292	spkhczxrmk.sys
5152	CreateProcess.exe
556	mkecwupmhf.exe
876	CreateProcess.exe
920	CreateProcess.exe
3364	i_mkecwupmhf.exe
4804	fzxusmjhfr.sys
4216	CreateProcess.exe
1572	wurpmhezxr.exe
4704	CreateProcess.exe
1948	CreateProcess.exe
2692	i_wurpmhezxr.exe
1116	bzwrpjhbzu.sys
4580	CreateProcess.exe
5036	bwuomjecwu.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1070265828\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_2052428744\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1627424720\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1673857091\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1673857091\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_2052428744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1627424720\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1673857091\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping856_1673857091\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhfzurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgebzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojherojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkfdankfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkfdankfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtoljdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwusmkhczuspmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojherojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtoljdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daytqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkfdxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daytqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkfdxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhfzurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpjhbzu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4972	ipconfig.exe
5892	ipconfig.exe
3708	ipconfig.exe
4200	ipconfig.exe
2976	ipconfig.exe
5436	ipconfig.exe
4568	ipconfig.exe
3816	ipconfig.exe
3952	ipconfig.exe
992	ipconfig.exe
4528	ipconfig.exe
1428	ipconfig.exe
3816	ipconfig.exe
2996	ipconfig.exe
724	ipconfig.exe
2676	ipconfig.exe
3360	ipconfig.exe
796	ipconfig.exe
2440	ipconfig.exe
3008	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290439504145087"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{4DDDB229-1F1A-450D-B01B-F16EB94B79EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe
5424	kecwusmkhczuspmh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	i_pjhfzurmjh.exe
Token: SeDebugPrivilege	5916	i_cwupmgezwr.exe
Token: SeDebugPrivilege	2524	i_rojherojgb.exe
Token: SeDebugPrivilege	2768	i_ligywqomge.exe
Token: SeDebugPrivilege	5416	i_daytqligay.exe
Token: SeDebugPrivilege	5560	i_vsqkfdxvsq.exe
Token: SeDebugPrivilege	4844	i_tnkfdankfc.exe
Token: SeDebugPrivilege	5176	i_kifaxspnhf.exe
Token: SeDebugPrivilege	3364	i_mkecwupmhf.exe
Token: SeDebugPrivilege	2692	i_wurpmhezxr.exe
Token: SeDebugPrivilege	4664	i_bwuomjecwu.exe
Token: SeDebugPrivilege	260	i_ywtoljdbzw.exe
Token: SeDebugPrivilege	724	i_vtnlgdywqn.exe
Token: SeDebugPrivilege	2436	i_tnlfdayvqn.exe
Token: SeDebugPrivilege	5128	i_ysqnlfdyvq.exe
Token: SeDebugPrivilege	1312	i_qkicausnkf.exe
Token: SeDebugPrivilege	4420	i_causmkecxu.exe
Token: SeDebugPrivilege	3692	i_cwurmkecwu.exe
Token: SeDebugPrivilege	2424	i_czurpjhbzu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 5424	5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5460 wrote to memory of 4748	5460	2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4748 wrote to memory of 856	4748	iexplore.exe	91
PID 856 wrote to memory of 1188	856	msedge.exe	92
PID 856 wrote to memory of 1444	856	msedge.exe	94
PID 856 wrote to memory of 5076	856	msedge.exe	95
PID 856 wrote to memory of 1444	856	msedge.exe	94
PID 856 wrote to memory of 1444	856	msedge.exe	94
PID 856 wrote to memory of 5168	856	msedge.exe	96
PID 856 wrote to memory of 5168	856	msedge.exe	96
PID 856 wrote to memory of 2204	856	msedge.exe	97
PID 856 wrote to memory of 2204	856	msedge.exe	97
PID 856 wrote to memory of 2204	856	msedge.exe	97
PID 856 wrote to memory of 4116	856	msedge.exe	98
PID 856 wrote to memory of 4116	856	msedge.exe	98
PID 856 wrote to memory of 4116	856	msedge.exe	98
PID 856 wrote to memory of 4288	856	msedge.exe	99
PID 856 wrote to memory of 4288	856	msedge.exe	99
PID 856 wrote to memory of 4288	856	msedge.exe	99
PID 856 wrote to memory of 680	856	msedge.exe	100
PID 856 wrote to memory of 680	856	msedge.exe	100
PID 856 wrote to memory of 680	856	msedge.exe	100
PID 856 wrote to memory of 2996	856	msedge.exe	101
PID 856 wrote to memory of 2996	856	msedge.exe	101
PID 856 wrote to memory of 2492	856	msedge.exe	105
PID 856 wrote to memory of 3340	856	msedge.exe	106
PID 856 wrote to memory of 2492	856	msedge.exe	105
PID 856 wrote to memory of 3340	856	msedge.exe	106
PID 856 wrote to memory of 1508	856	msedge.exe	108
PID 5424 wrote to memory of 1152	5424	kecwusmkhczuspmh.exe	109
PID 856 wrote to memory of 6000	856	msedge.exe	111
PID 856 wrote to memory of 6000	856	msedge.exe	111
PID 2432 wrote to memory of 4784	2432	pjhfzurmjh.exe	114
PID 856 wrote to memory of 924	856	msedge.exe	118
PID 856 wrote to memory of 924	856	msedge.exe	118
PID 5424 wrote to memory of 2648	5424	kecwusmkhczuspmh.exe	119
PID 5424 wrote to memory of 2920	5424	kecwusmkhczuspmh.exe	123
PID 3760 wrote to memory of 4492	3760	cwupmgezwr.exe	125
PID 5424 wrote to memory of 2916	5424	kecwusmkhczuspmh.exe	128
PID 5424 wrote to memory of 2020	5424	kecwusmkhczuspmh.exe	132
PID 5424 wrote to memory of 4808	5424	kecwusmkhczuspmh.exe	137
PID 5424 wrote to memory of 4444	5424	kecwusmkhczuspmh.exe	142
PID 1516 wrote to memory of 3196	1516	ligywqomge.exe	144
PID 5424 wrote to memory of 2888	5424	kecwusmkhczuspmh.exe	147
PID 856 wrote to memory of 1692	856	msedge.exe	149
PID 856 wrote to memory of 4436	856	msedge.exe	150
PID 856 wrote to memory of 1304	856	msedge.exe	151
PID 5424 wrote to memory of 4192	5424	kecwusmkhczuspmh.exe	154
PID 1276 wrote to memory of 5316	1276	daytqligay.exe	156
PID 5424 wrote to memory of 6116	5424	kecwusmkhczuspmh.exe	159
PID 5424 wrote to memory of 2984	5424	kecwusmkhczuspmh.exe	163
PID 1436 wrote to memory of 2860	1436	vsqkfdxvsq.exe	165
PID 5424 wrote to memory of 4360	5424	kecwusmkhczuspmh.exe	168
PID 5424 wrote to memory of 1768	5424	kecwusmkhczuspmh.exe	172
PID 5348 wrote to memory of 3764	5348	tnkfdankfc.exe	174
PID 5424 wrote to memory of 5760	5424	kecwusmkhczuspmh.exe	177
PID 5424 wrote to memory of 2172	5424	kecwusmkhczuspmh.exe	181
PID 1172 wrote to memory of 3028	1172	kifaxspnhf.exe	183
PID 5424 wrote to memory of 1512	5424	kecwusmkhczuspmh.exe	186
PID 856 wrote to memory of 1772	856	msedge.exe	188
PID 856 wrote to memory of 1772	856	msedge.exe	188
PID 5424 wrote to memory of 5152	5424	kecwusmkhczuspmh.exe	194
PID 556 wrote to memory of 876	556	mkecwupmhf.exe	196
PID 5424 wrote to memory of 920	5424	kecwusmkhczuspmh.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2f59952477a6c2e22f824f6925e63c10_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Temp\kecwusmkhczuspmh.exe
  C:\Temp\kecwusmkhczuspmh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhfzurmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1152
  - - C:\Temp\pjhfzurmjh.exe
      C:\Temp\pjhfzurmjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhfzurmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2648
  - - C:\Temp\i_pjhfzurmjh.exe
      C:\Temp\i_pjhfzurmjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2920
  - - C:\Temp\cwupmgezwr.exe
      C:\Temp\cwupmgezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2916
  - - C:\Temp\i_cwupmgezwr.exe
      C:\Temp\i_cwupmgezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojherojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2020
  - - C:\Temp\rojherojgb.exe
      C:\Temp\rojherojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojherojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\i_rojherojgb.exe
      C:\Temp\i_rojherojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligywqomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4444
  - - C:\Temp\ligywqomge.exe
      C:\Temp\ligywqomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligywqomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2888
  - - C:\Temp\i_ligywqomge.exe
      C:\Temp\i_ligywqomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daytqligay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\daytqligay.exe
      C:\Temp\daytqligay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daytqligay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6116
  - - C:\Temp\i_daytqligay.exe
      C:\Temp\i_daytqligay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkfdxvsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\vsqkfdxvsq.exe
      C:\Temp\vsqkfdxvsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkfdxvsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\i_vsqkfdxvsq.exe
      C:\Temp\i_vsqkfdxvsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnkfdankfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Temp\tnkfdankfc.exe
      C:\Temp\tnkfdankfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnkfdankfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\i_tnkfdankfc.exe
      C:\Temp\i_tnkfdankfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxspnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2172
  - - C:\Temp\kifaxspnhf.exe
      C:\Temp\kifaxspnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxspnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1512
  - - C:\Temp\i_kifaxspnhf.exe
      C:\Temp\i_kifaxspnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\mkecwupmhf.exe
      C:\Temp\mkecwupmhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:920
  - - C:\Temp\i_mkecwupmhf.exe
      C:\Temp\i_mkecwupmhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\wurpmhezxr.exe
      C:\Temp\wurpmhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1948
  - - C:\Temp\i_wurpmhezxr.exe
      C:\Temp\i_wurpmhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4580
  - - C:\Temp\bwuomjecwu.exe
      C:\Temp\bwuomjecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomjecwu.exe ups_ins
    3⤵
    PID:3804
  - - C:\Temp\i_bwuomjecwu.exe
      C:\Temp\i_bwuomjecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtoljdbzw.exe ups_run
    3⤵
    PID:4916
  - - C:\Temp\ywtoljdbzw.exe
      C:\Temp\ywtoljdbzw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtoljdbzw.exe ups_ins
    3⤵
    PID:5884
  - - C:\Temp\i_ywtoljdbzw.exe
      C:\Temp\i_ywtoljdbzw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdywqn.exe ups_run
    3⤵
    PID:2964
  - - C:\Temp\vtnlgdywqn.exe
      C:\Temp\vtnlgdywqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdywqn.exe ups_ins
    3⤵
    PID:3840
  - - C:\Temp\i_vtnlgdywqn.exe
      C:\Temp\i_vtnlgdywqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdayvqn.exe ups_run
    3⤵
    PID:3480
  - - C:\Temp\tnlfdayvqn.exe
      C:\Temp\tnlfdayvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdayvqn.exe ups_ins
    3⤵
    PID:4436
  - - C:\Temp\i_tnlfdayvqn.exe
      C:\Temp\i_tnlfdayvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnlfdyvq.exe ups_run
    3⤵
    PID:4552
  - - C:\Temp\ysqnlfdyvq.exe
      C:\Temp\ysqnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnlfdyvq.exe ups_ins
    3⤵
    PID:5352
  - - C:\Temp\i_ysqnlfdyvq.exe
      C:\Temp\i_ysqnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausnkf.exe ups_run
    3⤵
    PID:5916
  - - C:\Temp\qkicausnkf.exe
      C:\Temp\qkicausnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    PID:2272
  - - C:\Temp\i_qkicausnkf.exe
      C:\Temp\i_qkicausnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run
    3⤵
    PID:2624
  - - C:\Temp\causmkecxu.exe
      C:\Temp\causmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    PID:3640
  - - C:\Temp\i_causmkecxu.exe
      C:\Temp\i_causmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurmkecwu.exe ups_run
    3⤵
    PID:4144
  - - C:\Temp\cwurmkecwu.exe
      C:\Temp\cwurmkecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurmkecwu.exe ups_ins
    3⤵
    PID:3900
  - - C:\Temp\i_cwurmkecwu.exe
      C:\Temp\i_cwurmkecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpjhbzu.exe ups_run
    3⤵
    PID:1848
  - - C:\Temp\czurpjhbzu.exe
      C:\Temp\czurpjhbzu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpjhbzu.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_czurpjhbzu.exe
      C:\Temp\i_czurpjhbzu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywuomgebzu.exe ups_run
    3⤵
    PID:680
  - - C:\Temp\ywuomgebzu.exe
      C:\Temp\ywuomgebzu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x144,0x148,0x14c,0x2cc,0x300,0x7ffab265c188,0x7ffab265c194,0x7ffab265c1a0
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,13965412843779404637,2927802032711049232,262144 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:2
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,12449879081777301660,5022359403298676581,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:11
      4⤵
      System Time Discovery
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,12792046199318191113,222454426431844804,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,8771519969811853881,16619576547836183992,2097152 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,7972869613447390895,1598089102049561131,2097152 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,9705317265019771828,7503502297153502578,2097152 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8987080052091225695,10866255648868076276,2097152 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,4819734205521594871,8982074064129464967,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,6011963493620955915,9846740760715824454,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13323091341389430299,2418697642540058370,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1353813804890963225,5204250085658764271,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1353813804890963225,5204250085658764271,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,16277226483743445426,14402188013887907304,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,7443456839778828727,3737714697248018634,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,17577029265448374694,5861686581362108714,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=1220 /prefetch:14
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,4675640096624033334,1621874590037081157,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,12742305508807974350,16399006330421423033,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1116,i,784550723184235914,10867231650921472529,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,8764539100290854825,12833087678431243679,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4284856591240364748,11800037826644137876,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,12323482678858997607,2636395149735203377,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3552,i,497291635241931128,17212136078193440806,262144 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:10
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9389655881609063324,7086626083936700106,524288 --field-trial-handle=3128,i,14891825398879512209,763513934361327893,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1652

C:\Temp\kecwusmkhczuspmh.sys
C:\Temp\kecwusmkhczuspmh.sys
1⤵
- Executes dropped EXE
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5300

C:\Temp\hezxrpbztr.sys
C:\Temp\hezxrpbztr.sys
1⤵
- Executes dropped EXE
PID:3712

C:\Temp\ztomgezwuo.sys
C:\Temp\ztomgezwuo.sys
1⤵
- Executes dropped EXE
PID:5336

C:\Temp\ljebvtrljg.sys
C:\Temp\ljebvtrljg.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\jdyvtolgdy.sys
C:\Temp\jdyvtolgdy.sys
1⤵
- Executes dropped EXE
PID:5572

C:\Temp\dyvtnlayvq.sys
C:\Temp\dyvtnlayvq.sys
1⤵
- Executes dropped EXE
PID:1400

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:3528

C:\Temp\nkfcausqnh.sys
C:\Temp\nkfcausqnh.sys
1⤵
- Executes dropped EXE
PID:4768

C:\Temp\spkhczxrmk.sys
C:\Temp\spkhczxrmk.sys
1⤵
- Executes dropped EXE
PID:5292

C:\Temp\fzxusmjhfr.sys
C:\Temp\fzxusmjhfr.sys
1⤵
- Executes dropped EXE
PID:4804

C:\Temp\bzwrpjhbzu.sys
C:\Temp\bzwrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:1116

C:\Temp\ywuomgeywt.sys
C:\Temp\ywuomgeywt.sys
1⤵
PID:1156

C:\Temp\bywqoigeyw.sys
C:\Temp\bywqoigeyw.sys
1⤵
PID:5304

C:\Temp\bvtnljdayw.sys
C:\Temp\bvtnljdayw.sys
1⤵
PID:6100

C:\Temp\vqnlfdyvqo.sys
C:\Temp\vqnlfdyvqo.sys
1⤵
PID:3748

C:\Temp\usnkfdausn.sys
C:\Temp\usnkfdausn.sys
1⤵
PID:5948

C:\Temp\kfcxuspkic.sys
C:\Temp\kfcxuspkic.sys
1⤵
PID:3328

C:\Temp\mkfcxupnhf.sys
C:\Temp\mkfcxupnhf.sys
1⤵
PID:6084

C:\Temp\ecwupmhecw.sys
C:\Temp\ecwupmhecw.sys
1⤵
PID:5436

C:\Temp\bztrojebzt.sys
C:\Temp\bztrojebzt.sys
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwupmgezwr.exe

Path C:\Temp\cwupmgezwr.exe
Size 376KB
SHA256 db4c7872113cf105793d458c7466559c10b02c151869811d827ca27dee458dd8
MD5 1f2a296d8bd03a4e234a789eca93097b
SHA1 bc90b477049f2457890f94e35b5222d0ba600807
SHA512 8cc3397a014d4e6ec4c3c8e1eca216d12d961814f988309e828d5c1650fc928c3426fe263d680e98da86efbcb78f0f1bdb1e594249c28001b58ae863b429084a
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daytqligay.exe

Path C:\Temp\daytqligay.exe
Size 376KB
SHA256 2ffe32daa390579c3af2b155c0d354658d254248eef33fffa677301c9d02b4f3
MD5 a99bc643c64e388c5e745d5ec1d8c317
SHA1 6b5f6b479c2ae5f8fa665e0a19ee6c3ac21132be
SHA512 06265448187a466a8cd78c9dda00bb1ec673614626a8dc4575152f17e51f6741e1f457d8a3de06cc85151cd7a7f7ccdb70ac346bf8a35d8ed6e0eb3ac0afdcfc
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtnlayvq.sys

Path C:\Temp\dyvtnlayvq.sys
Size 293KB
SHA256 13f01e54f7d95d9b501f878a53a5a8c4053569306215164932fcd79d91ad2681
MD5 cb906b06148b0dc064d9f055aeebde7d
SHA1 441e5e07a502ed3b6ea75eb0d34ca0710aba759c
SHA512 21b7fdc634f55f4015357e43ef0540cc6f95076f6951b1399ef93969bb22c78d39b758afd548c0d84bf2a4540faef04b3276bd14c5d99d492b6ef894f97fa0c4
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpbztr.sys

Path C:\Temp\hezxrpbztr.sys
Size 293KB
SHA256 ce44a1968ea45189c75d30bb21da06f8f21cf9256bbd515eceddc4b3e4cb8b8c
MD5 1b9077b880cf0d61a3357189838ff371
SHA1 0cd612b15df70b04bdb51c703875927391e01061
SHA512 8bb16bbceb56a4b3bc27deb9d3bd43fefc47ac7446bda175305f9adcfb5968c91e7b94b509a5db1ca89a2c24a474da444e1c7bf132ae6bff4281488a5c75c606
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T19D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmgezwr.exe

Path C:\Temp\i_cwupmgezwr.exe
Size 376KB
SHA256 78c386ea0fd82fd7e73c2fb7d93645477e73606855285ae1e69c1cfd734194a3
MD5 b21179dc6996c1b8064d97e392f339c6
SHA1 f09352c219ba1ddeec4bd3208a2a4434d3823642
SHA512 f4710011684de305d221d982985387c168ea7e72c2fa6b07f0c61a0337af6eaaa2471dc3e53950e1f26331be1209576ac13bdf7395e51a7b85ff386a06c898ea
SSDEEP 3072:7FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_daytqligay.exe

Path C:\Temp\i_daytqligay.exe
Size 376KB
SHA256 2660b415c3fe0d31a2e525f3513a281911f945be65ecff1c2922c11e446fbbbf
MD5 bcf4bd4a82113426249f7acd667fb9ae
SHA1 66831b193a012c07e168f90ac076400656b1c8e2
SHA512 537efdaf7db1c00734731c1a0450c2a5c105865726f145ddb871d6a117cc5abe7ef9d1b0af7be4c1ee4df5f336c4fd82c8c69a3d931b44a26b19954191452de3
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ligywqomge.exe

Path C:\Temp\i_ligywqomge.exe
Size 376KB
SHA256 6d2cbd246e07434089c30c7019bef99fae1fa440989ae188d84ccb731532eaa0
MD5 9af3d7582f17ca69d41aae0693d68179
SHA1 7b0a8508feb6c15bd09682e30deb1c0304ab0927
SHA512 ddaf6f8da9b7530200d6d876ebb60c496b890997100609428e2d00991e278e0ebba2036388c9e3a0a88b8a45a1e4517569b7bb9f1e49c6346a5c48144bf2f495
SSDEEP 3072:zFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhfzurmjh.exe

Path C:\Temp\i_pjhfzurmjh.exe
Size 376KB
SHA256 24c3e54be2ca941a25ad69b7d8ac817c2152b64a933ba529f69b19f5484399b5
MD5 23cb13e5f2d5616bbf27fe1b062effb1
SHA1 baa6b47deca134bf5330887576086f147c706aea
SHA512 becd620b0072dd17116089ef273d342b4005a069ee50c2ff0e2bb131a88cdd5d1693bd7186a74f53779ab47323eba662a585e551a840e26e796c4f8f5918aa54
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojherojgb.exe

Path C:\Temp\i_rojherojgb.exe
Size 376KB
SHA256 546fd105b783b5b8d4b48dad3794b4a04b68452470a04dedbfc22eece533af28
MD5 22a075efc11de216f818ca103728e2d6
SHA1 c48272c9ae7b00ad721f458a4399bc6554d34adb
SHA512 d633e7e239717d41a78bfd1f19ea091b818ecd23f1793995f4074262b7582cd8790a3257b8fa22a261b7fe13d0661d7f7e23eb455bde392034ea7ca742d7a7b4
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkfdxvsq.exe

Path C:\Temp\i_vsqkfdxvsq.exe
Size 376KB
SHA256 4c55586cd2dd00e90b9d7226312d2ffd1c24c6825710ee1dc445f7029d36e1a1
MD5 b55cab5900900c6ce9b01f66bc901050
SHA1 1872fa1aaa014e88793594ab16e67f133eb2addc
SHA512 87e3c25bb42f26386d1b3c2a431dd553e91941e320797c81ac39bdce82629084805ba30dd23c8028c350a4355e09045681e05f5e1c59998786b79f64f98549b5
SSDEEP 3072:9FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdyvtolgdy.sys

Path C:\Temp\jdyvtolgdy.sys
Size 293KB
SHA256 ca5abe5a673d9ac2b7cf6eba4d63ea958fecd4ea869c44e2499d5a6435bd0df5
MD5 ed4ba489b1b396f662f4c360a0b416b5
SHA1 28c9c434c6fdf3bb868cc3e04147917a7d48b790
SHA512 6b2567136d18c26913da8989098aa81aff0ed93f9a5dd36048e1628bd1a2cb991601171b120a99f5445339fef4cac999996c1beacb51bb3372259c2a9cf0af5c
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed1:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T19D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkhczuspmh.exe

Path C:\Temp\kecwusmkhczuspmh.exe
Size 376KB
SHA256 3f6aa74c7330c637fe4f0ca3642dfacf66f5659294f1aeeb14f480e2cb735b8a
MD5 48c386cf55b78fff13ebba0aed09ced4
SHA1 35d5020cb0ee68404d049eb0fd9d330f72a80145
SHA512 88f42b15c704ef09feceb94ba53a10b67a3d237acdbefb6e22db3bc51dcbd9b56bb7ffaa47964f52079be3ec88b1b502f9c34f3c52e3313f6b2fb100da881787
SSDEEP 3072:3FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkhczuspmh.sys

Path C:\Temp\kecwusmkhczuspmh.sys
Size 293KB
SHA256 de27533dd2b91a06416fca9f3caa306f9f9ac4c1178d422efddea751530c897d
MD5 cafc0919738d733d96a977258a3ed593
SHA1 f84b05d57985c039437bf52299e724281d0daa4b
SHA512 0165246813e5136319e78736bb74aae7e8fb163da803b7bfbcb24f0ef24037db1ef8fe41fc45b11f17a3bb27b008dae1cc29c7ba998c0f7be5688b4921ba9d32
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligywqomge.exe

Path C:\Temp\ligywqomge.exe
Size 376KB
SHA256 53961b4689b041ad4eacf23ee6dead689664980ec933899ed918ed4e6d505e9f
MD5 3b214786642d53c76ca4d2762800e726
SHA1 d5e480c6d69c8e25c9293b4debdf4c074eee9c75
SHA512 d014f417999bd36da29ad9739add215e8e398c9a88a8e16f58d0df0e8c21aa710e604fcb283181e06ee519f15c1325b205504b67e78c932ccace00b6fc205067
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebvtrljg.sys

Path C:\Temp\ljebvtrljg.sys
Size 293KB
SHA256 60067b51badc295f76bfcd5dab47491a2a49d6638ee982b23ba553f30ec564a3
MD5 b91d28b0bb8ecd69cc30a52142fbf53f
SHA1 e3cb1dc98f07dda6c315af36baaf4fa8f0289729
SHA512 982e37377caddbf99d10ca0aba9ecc6221458dfff740a5ac8ee23c631f911c67a7c475835af3c8d386c91bb0a50c5bd93cd75c672c2b449c3d117b5111137669
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfzurmjh.exe

Path C:\Temp\pjhfzurmjh.exe
Size 376KB
SHA256 61c5a86583437502c27b32d0c69dd5d961e56a250e056c110791d8ce8992c51a
MD5 f6b6f8e2d59b02b53e42dad7d92f9285
SHA1 74ca1e7cbcd74657a8f661acc2c9531086288f17
SHA512 3d481a0dea369f39ad335b6e98c6b0a1a9b034e3269ad65376fab2f472fdce6663b9491b6090654e8678e79ab507eb0c8a4799c362b6614773ba92afae0515e3
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojherojgb.exe

Path C:\Temp\rojherojgb.exe
Size 376KB
SHA256 5cb9b695cdda3809567c953ba3a9330714ddc60871c3612c8d27930f1abc2357
MD5 3500e8d4b769241b33f6bc8bf8b4abe9
SHA1 52c7f354b8bb4951863f0c236ca68f6ab977768d
SHA512 20c43ff892390910c0ea15bd820ec1ad2936414fa9ff495d612fdb5ce25baa7bf7c2d252264a8eea5b945b98dce1d4a0f6993c1e74fd5431353ec63f85e96207
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkfdxvsq.exe

Path C:\Temp\vsqkfdxvsq.exe
Size 376KB
SHA256 22d75468ea6cc9af44572eda06b4bc3c5a7f4ff465774fe691f59992938a1000
MD5 e3db2ccd7ea03bcf8968b91360e9ab7c
SHA1 88373144d4831a45afeca1487fa2e939b021bd1e
SHA512 8449133b5ee26e76b8414f6a417167725e68a97ec3ec4e779526d99686d6660da893b827bbeab23286d9692e909bffebbed3d3c7cfaeca31de8721186421de2c
SSDEEP 3072:gFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztomgezwuo.sys

Path C:\Temp\ztomgezwuo.sys
Size 293KB
SHA256 88f9afdf4923a55e89dd6a86c7653f7112225c67f9e78a2a9f33a1e2919e9818
MD5 8182612accf7323499c629e9cfc52e62
SHA1 bb5f69d51f2d03eb23c55f262854fd857acbe134
SHA512 b036467cb79668ddee8f9ae150c6a18431e0ce29972e89d2e9ffa8a05e55be5c868213d050ff45b1dccc0e309ce97986f91cfdc9ccbe1e638817f76734ed42c3
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 53230338cdb4c49677861532f1323648541f06155d703329dca90078370e73d0
MD5 bf27342b0e70eec232e595ba9311124a
SHA1 fb652fe63f83359f5ddfe9318d141ea527de976b
SHA512 551db6ab0b168b1451ef6d63f8e41d89ebadc489d885dcd3ce88c2ccf252cf7990db088e62da94d6aae883d4b0791dc8af00bbc4da587bc6c39233b89a42ab74
TLSH
T12151848003662AD1EBA395FE13EB525877F78411813F6E411EE09E309486F1BE5DA36F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596289.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596289.TMP
Size 3KB
SHA256 3e3ea2b3d1448117b8fc06cb5fd5c87d99de8437d1a978b586d3335cf67029a9
MD5 7201db8f141084f330c6ab7f73746bdd
SHA1 9b412b8f118c391efe78355353025e580f80a4a2
SHA512 90d654c6597176190dd27c2de2b5c0ce191d00c8a8e5b09a4d4c1873c7d43981e1ec7baabbcd77ef6175ba30c57291e9d2eaa3b431cb28d50835914f6d393128
TLSH
T12B51948103662AD1EBA395FA13EB125877F78411813F6E410EE09E309486F1BE5DA36F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 49406194b54cd42dbf5cd2e412dd64863f0387fa9042b09702e5a395185a7e14
MD5 57f0b2d8bece61a6fb9e9e23121bb074
SHA1 80fba023f147ed4b022f8499e69058c0a52717d0
SHA512 67e674f77e955ebb44b03c968b433e013807cee8955c29a7ba9b440761abff2c540559804b7a72857bfa629ab9071b6ddef6bd7baab91f5d7c6fa6c19eabd52b
TLSH
T10441BBF7C2E8866E890156F0AB186E2BCE2D0915832C3D5AC8E4AF1F93F2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 67e30525f8915e2b11ae72a27af4697bb86144105b4ac7c6f7137df318251a93
MD5 67d1fc6f3069fde17fb2c43e28bbd039
SHA1 65658cab9c1258ecfe692741169fd97122dc99ac
SHA512 b2e84b129334163807a4f074211aeb653e3030ea1acbad9647856c4a1f84867a98bf8b7ebc34f5bca8e25cba4a18c27a63287f45c3ada261e5f8184d2dd92e24
SSDEEP 192:sxRIxRskRLyCbBf/frsmsnxtwGcYAzoA8p9Ia/g6+WNCIdoK/YoVdSCYQyGD4ZIq:sxRYXlf/f1snxtpdl/5f/V+3
TLSH
T14932B51A6A68AD3B4CC7D21DBB65BF53E6F91132A1D42F48A6FC860C04E67DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 78512afb93d37b9e0ef0795ba6b16e2984be8594330df8974ea14a1b29353d57
MD5 bedd56e01a87febbab29ab82bdd2d542
SHA1 540365bcdc5e341e0e414d7a8ee547480b726f1a
SHA512 d4b6dfeb108d23b1ec2e10e20b6626acb6687ce57dcf40698cf6acc587cddeda50ea67a1916ce672cdcc90b766cb03a6d106e79816ea87dfc2a363100e5ac983
SSDEEP 192:sxRIxKskRLyCbBf/frsmsb1xtwGcYAzoA8p9Ia/g6+WNCIdoK/YoVdSCYQyGD4ZH:sxRjXlf/f1sRxtpdl/5f/V+H
TLSH
T15742A41A6A689D3B4CC7D21DBB65BF53E6F91032A1D42F48A6FC8A0C04E67DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3ee70061d62fa23417670a0620f86191f355f918ee485a3828ecc6e853e5557f
MD5 2ebdbc7b49a8f06a80a0aa660e2a92fd
SHA1 5985126fd5a61a381fcdbc23339abba8b3b43cd0
SHA512 6a667c442195eb13ec54cc6df99175925fc2d4185ed300961b290eb064eb0189eb1066e4480155fd2db8bdaaf69ceb00f03da2b3730526428f2ca37f5cb8e890
SSDEEP 192:sxRIxKskRLyCbBf/frsmsb1xNzgZiXNgpYAzoA8p9Ia/g6+WNCIdoK/YoVdpCYQS:sxRjXlf/f1sRx1+iX1l/5f/w+h
TLSH
T13C42A41A6D68AD3B4CC7D219BB65BF53E6F91032A1951F48A6FC8A0C00E66DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 fd99d541d00b69bf9b7fe8dc6fff57f0b649d49d77d1f5f8c703dbdf6cc983fe
MD5 155cbdf855bb5c5a6bfadfe8e36d858d
SHA1 66004cabfe7c0fe4c572706d90ea3ad640969e34
SHA512 6edc53f87646c5ca32bbc47503c0ed0cb11eeb69909ec955af2ef9e583d4a778407780c330395808c27fc2701ae8ee501726b93da12bfaaf9018d3435bb916a0
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVQGBVuwUro9cfet:j26HRUE7MRWgs2f02u1jaLGB4w/lj
TLSH
T1D1D2EB7B740DCABE4F804ADDED197E9F6D6802CB9698CD8047FE841C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fec9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fec9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c9f6c1d814d7b36abcee323d63f1bfad9ff0b75cfa89af79a210a8b4fbae729b
MD5 b84b5392766e8c62edc73fe3154ad0f6
SHA1 64793268b250ce14043bd843de247093acdd3d45
SHA512 f95ae0d5725c61a1efe3500ffb1317c4cd4ff8ff8c1b15033eddb39ebd24ce1807d75f9a1474d69e1f44583159b304f02f63603a69fe3a944967ba80e61f5b0f
SSDEEP 768:hrv+4UNbdz3+P/TBOWdYNtI6ONXyer1IRCzniBVeVH1SK7:hbsbV32nV6SIqnGEH1l
TLSH
T19203BF36A4A89E338DE2A3D6B14772037FB86057C6840790EDEA1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d2240c1c7ef7103f7a8a360168996dddda986ea986836d7ba7b869d5e38fa333
MD5 55ffd8a7d8265ec4f12e64a3fc1390e5
SHA1 3c55e090ae32ee4e5df9e2cb32d6b5471e53d713
SHA512 3c6c72ad90b8050cf4a6a25c17394f4f44dce4239712c8042ebcafbd1134c37691b39b9383731cbd0134d8ac23d5a8e5f9b9e287e73da2de633fb2381e4b6043
SSDEEP 768:mrv+4UNbdz3444L/TBOWdYNtAYDtKONXyer1IRCzni9mb9Mm:mbsbV344UnPbSIqn9b+m
TLSH
T16113CF31E5599E338DF2A2A6B14777937FB820ABC5C40B40EAE65F8D059799E130B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 19fced0a13e0ff77fb21e16a1bbfc8797ffdda5d576b3168f276f323b3604c5e
MD5 c535ae6b5598cdb25f98d56b46d40357
SHA1 99adee87b13521cdaa78c1aa736663fe8c865b3a
SHA512 38d8e56401e7127cdb508942c7ecaf8ee19e34a2edb4f76db3f6dbecbbd4f0a7eaa989eb6427f97b05492cc27a660032365e2541f064a793405523fe51609672
SSDEEP 768:ij+9R3r4GL/TBOWdYNtAYDtuONXyer1IRCzni9mb9MS:R9R3r4KnPFSIqn9b+S
TLSH
T1EEF2BE35A9569E238CE1A3E6B2473797BEF420BBC5C40B44EEEA5F4E0593A5D030B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d1188eac5c02e64b55c5b5b459f1ce3b6a883bc0aa46351a5e93922a4a3a9ac0
MD5 d9d91c990b797cc2fc118d55722a0809
SHA1 b6c956cd124456307d77134d7a4f8ed2ae9fa1d2
SHA512 0398b64cf5aea2069b183fd2dcca1c6a9b812b4187f98012f88a07139924299d6df54a059e231097e3a5823e56856964d5a93b18508804c1c2c83cada33c453c
SSDEEP 768:bj+9R364GL/TBOWdYNtAYDtuONXyer1IRCzni9mb9MS:O9R364KnPFSIqn9b+S
TLSH
T174F2BE35E9959E238CE1A3E6B2473797BEF420BBC5C40B44EEEA5F4D0593A5D130B406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 d0acf874c9b3b2962b170d7c6560b0db457122a982ada0d537283770306583fd
MD5 1b9a337c5649385eda5932a168695a08
SHA1 e51b3ddd21a33d3e957f16af5aeead4277ea6505
SHA512 a1199de1e8c63fd7bdebdf63c9bae85dbd6889ae3c857711f2e85d9fe5e6090f875aeea2ffd7c9078696702225183bdee599effa52653b247a410385779e1d7a
SSDEEP 768:2F1j+9434wgo4LspsOWdYNtAYDtlONXyer1IRCzni9mb9MS:D943B4owPaSIqn9b+S
TLSH
T17B1317F694D38A36C8AD5397B33D2E46AEBCD067B5844980BBD55E4DCC8257FC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65eaad0f-6320-45fa-91cd-2a22be5c7aeb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\65eaad0f-6320-45fa-91cd-2a22be5c7aeb.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

40765b98-ec62-4c49-a271-e29e9390d76c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\40765b98-ec62-4c49-a271-e29e9390d76c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir856_1413589355\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 4301539d7d053a00bcff16579674f05597f52a4068ebf62dad997985b48b6458
MD5 9acfa0a72e7837d620f8ddea46959fb6
SHA1 a00e09ef4217af0450f4bd35c092299d712775d1
SHA512 57d4bf29cbe394df4818154de94e0565a7678418fe30a5c982a1d18c8e2a335b79e5e5d2c24356ba41539db64650b1e2982c0f4a7ae1c1d90dfba70e42f33003
TLSH
T1F371238357A9C9F3C5DE5BF002835648F1FF2238072370204B555546AB34B7E68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1116-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1156-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1384-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1400-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3528-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4804-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5292-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5304-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5400-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5436-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5572-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5948-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download