systex | deb94490560e25870eb347d5401fecec16cababc832eaffdbc776a8bfb3cbcb6

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260816-cdtt7sysb1
SHA256 deb94490560e25870eb347d5401fecec16cababc832eaffdbc776a8bfb3cbcb6
MD5 a9a9c6165650da9b5f899982cea87b2b
SHA1 4933253a0cc7f24f712379aca3305a17de9f192e
SHA512 9399c908532455107db661b4cbb86fbd6a53bb3cb4bb9cd88aabb2ddc8be8d8028d19d2037eadb087ed7cd1920b7a083d76c3fc6e06ba95ef517a4b144a59d68
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1124	kfcxvpnhfzxspnhf.exe
1340	kfcxvpnhfzxspnhf.sys
1068	CreateProcess.exe
3564	nkfcxsmkfa.exe
920	CreateProcess.exe
3972	CreateProcess.exe
5408	i_nkfcxsmkfa.exe
5396	hecxrpmhfc.sys
2708	CreateProcess.exe
3960	fzxrpjhfzx.exe
268	CreateProcess.exe
4052	CreateProcess.exe
3320	i_fzxrpjhfzx.exe
4300	kecwuomhec.sys
4080	CreateProcess.exe
2848	kebztrpmhe.exe
5212	CreateProcess.exe
5980	CreateProcess.exe
2976	i_kebztrpmhe.exe
1376	eywuomjebw.sys
3560	CreateProcess.exe
1568	bwuomgebwu.exe
5880	CreateProcess.exe
2800	CreateProcess.exe
2156	i_bwuomgebwu.exe
2564	bytrojgeyw.sys
2720	CreateProcess.exe
2524	qljdbywtol.exe
2600	CreateProcess.exe
2292	CreateProcess.exe
2412	i_qljdbywtol.exe
1388	gbytqoigdy.sys
1144	CreateProcess.exe
5208	jdbvtolgdb.exe
3624	CreateProcess.exe
5836	CreateProcess.exe
236	i_jdbvtolgdb.exe
4152	fdbvtnigay.sys
4644	CreateProcess.exe
4576	vqoigaysqk.exe
4484	CreateProcess.exe
3956	CreateProcess.exe
5732	i_vqoigaysqk.exe
2432	xvpnhfdxvp.sys
2372	CreateProcess.exe
2356	xvpnifaxsq.exe
1340	CreateProcess.exe
3432	CreateProcess.exe
1400	i_xvpnifaxsq.exe
1556	faxsqkifax.sys
2096	CreateProcess.exe
5092	spnhfaxupm.exe
4844	CreateProcess.exe
2776	CreateProcess.exe
5736	i_spnhfaxupm.exe
6068	usmkhczxsp.sys
5652	CreateProcess.exe
3304	upmhfzxrpj.exe
4828	CreateProcess.exe
3644	CreateProcess.exe
5408	i_upmhfzxrpj.exe
2144	urmkecwuom.sys
3844	CreateProcess.exe
3896	uomhezwrpj.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_183961322\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_1552770449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_1552770449\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_408550987\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_491537050\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_491537050\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_491537050\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_408550987\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_491537050\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kebztrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kebztrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxsmkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqnifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeyvtroi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqnifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcauspnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxsmkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeyvtroi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcauspnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfzxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4664	ipconfig.exe
2316	ipconfig.exe
3704	ipconfig.exe
3984	ipconfig.exe
1400	ipconfig.exe
1656	ipconfig.exe
2700	ipconfig.exe
3236	ipconfig.exe
5684	ipconfig.exe
4424	ipconfig.exe
5488	ipconfig.exe
1656	ipconfig.exe
628	ipconfig.exe
3424	ipconfig.exe
4688	ipconfig.exe
4244	ipconfig.exe
5744	ipconfig.exe
5192	ipconfig.exe
3068	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313190940766858"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D22775F3-02B9-4A6F-90A3-2402B25FF833}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1124	kfcxvpnhfzxspnhf.exe
1124	kfcxvpnhfzxspnhf.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1124	kfcxvpnhfzxspnhf.exe
1124	kfcxvpnhfzxspnhf.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1124	kfcxvpnhfzxspnhf.exe
1124	kfcxvpnhfzxspnhf.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1124	kfcxvpnhfzxspnhf.exe
1124	kfcxvpnhfzxspnhf.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1124	kfcxvpnhfzxspnhf.exe
1124	kfcxvpnhfzxspnhf.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1124	kfcxvpnhfzxspnhf.exe
1124	kfcxvpnhfzxspnhf.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5408	i_nkfcxsmkfa.exe
Token: SeDebugPrivilege	3320	i_fzxrpjhfzx.exe
Token: SeDebugPrivilege	2976	i_kebztrpmhe.exe
Token: SeDebugPrivilege	2156	i_bwuomgebwu.exe
Token: SeDebugPrivilege	2412	i_qljdbywtol.exe
Token: SeDebugPrivilege	236	i_jdbvtolgdb.exe
Token: SeDebugPrivilege	5732	i_vqoigaysqk.exe
Token: SeDebugPrivilege	1400	i_xvpnifaxsq.exe
Token: SeDebugPrivilege	5736	i_spnhfaxupm.exe
Token: SeDebugPrivilege	5408	i_upmhfzxrpj.exe
Token: SeDebugPrivilege	4616	i_uomhezwrpj.exe
Token: SeDebugPrivilege	1556	i_mgebwuomge.exe
Token: SeDebugPrivilege	3316	i_jdbwtolgey.exe
Token: SeDebugPrivilege	3676	i_ljgeyvtroi.exe
Token: SeDebugPrivilege	2004	i_lfdyvqniga.exe
Token: SeDebugPrivilege	2860	i_avsqnifaxv.exe
Token: SeDebugPrivilege	2232	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	4648	i_hcauspnhfc.exe
Token: SeDebugPrivilege	1260	i_mhezxrpjhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1124	1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1324 wrote to memory of 4620	1324	2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4620 wrote to memory of 4124	4620	iexplore.exe	90
PID 4124 wrote to memory of 5776	4124	msedge.exe	91
PID 4124 wrote to memory of 3528	4124	msedge.exe	92
PID 4124 wrote to memory of 6092	4124	msedge.exe	94
PID 4124 wrote to memory of 3528	4124	msedge.exe	92
PID 4124 wrote to memory of 3528	4124	msedge.exe	92
PID 4124 wrote to memory of 5360	4124	msedge.exe	95
PID 4124 wrote to memory of 5360	4124	msedge.exe	95
PID 4124 wrote to memory of 4176	4124	msedge.exe	96
PID 4124 wrote to memory of 4176	4124	msedge.exe	96
PID 4124 wrote to memory of 4176	4124	msedge.exe	96
PID 4124 wrote to memory of 5752	4124	msedge.exe	97
PID 4124 wrote to memory of 5752	4124	msedge.exe	97
PID 4124 wrote to memory of 5752	4124	msedge.exe	97
PID 4124 wrote to memory of 3556	4124	msedge.exe	98
PID 4124 wrote to memory of 3556	4124	msedge.exe	98
PID 4124 wrote to memory of 3556	4124	msedge.exe	98
PID 4124 wrote to memory of 5008	4124	msedge.exe	99
PID 4124 wrote to memory of 5008	4124	msedge.exe	99
PID 4124 wrote to memory of 5008	4124	msedge.exe	99
PID 4124 wrote to memory of 5880	4124	msedge.exe	100
PID 4124 wrote to memory of 5880	4124	msedge.exe	100
PID 4124 wrote to memory of 2140	4124	msedge.exe	104
PID 4124 wrote to memory of 2140	4124	msedge.exe	104
PID 4124 wrote to memory of 2472	4124	msedge.exe	105
PID 4124 wrote to memory of 2472	4124	msedge.exe	105
PID 4124 wrote to memory of 2832	4124	msedge.exe	107
PID 1124 wrote to memory of 1068	1124	kfcxvpnhfzxspnhf.exe	108
PID 3564 wrote to memory of 920	3564	nkfcxsmkfa.exe	111
PID 4124 wrote to memory of 5216	4124	msedge.exe	114
PID 4124 wrote to memory of 5216	4124	msedge.exe	114
PID 4124 wrote to memory of 4472	4124	msedge.exe	117
PID 4124 wrote to memory of 4472	4124	msedge.exe	117
PID 1124 wrote to memory of 3972	1124	kfcxvpnhfzxspnhf.exe	119
PID 1124 wrote to memory of 2708	1124	kfcxvpnhfzxspnhf.exe	123
PID 3960 wrote to memory of 268	3960	fzxrpjhfzx.exe	125
PID 1124 wrote to memory of 4052	1124	kfcxvpnhfzxspnhf.exe	128
PID 1124 wrote to memory of 4080	1124	kfcxvpnhfzxspnhf.exe	132
PID 2848 wrote to memory of 5212	2848	kebztrpmhe.exe	134
PID 1124 wrote to memory of 5980	1124	kfcxvpnhfzxspnhf.exe	137
PID 1124 wrote to memory of 3560	1124	kfcxvpnhfzxspnhf.exe	142
PID 1568 wrote to memory of 5880	1568	bwuomgebwu.exe	144
PID 1124 wrote to memory of 2800	1124	kfcxvpnhfzxspnhf.exe	147
PID 4124 wrote to memory of 1944	4124	msedge.exe	149
PID 4124 wrote to memory of 5528	4124	msedge.exe	150
PID 4124 wrote to memory of 3432	4124	msedge.exe	151
PID 1124 wrote to memory of 2720	1124	kfcxvpnhfzxspnhf.exe	154
PID 2524 wrote to memory of 2600	2524	qljdbywtol.exe	156
PID 1124 wrote to memory of 2292	1124	kfcxvpnhfzxspnhf.exe	159
PID 1124 wrote to memory of 1144	1124	kfcxvpnhfzxspnhf.exe	163
PID 5208 wrote to memory of 3624	5208	jdbvtolgdb.exe	165
PID 1124 wrote to memory of 5836	1124	kfcxvpnhfzxspnhf.exe	168
PID 1124 wrote to memory of 4644	1124	kfcxvpnhfzxspnhf.exe	172
PID 4576 wrote to memory of 4484	4576	vqoigaysqk.exe	174
PID 1124 wrote to memory of 3956	1124	kfcxvpnhfzxspnhf.exe	177
PID 1124 wrote to memory of 2372	1124	kfcxvpnhfzxspnhf.exe	181
PID 2356 wrote to memory of 1340	2356	xvpnifaxsq.exe	183
PID 1124 wrote to memory of 3432	1124	kfcxvpnhfzxspnhf.exe	186
PID 4124 wrote to memory of 4680	4124	msedge.exe	188
PID 4124 wrote to memory of 4680	4124	msedge.exe	188
PID 1124 wrote to memory of 2096	1124	kfcxvpnhfzxspnhf.exe	194
PID 5092 wrote to memory of 4844	5092	spnhfaxupm.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a9a9c6165650da9b5f899982cea87b2b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Temp\kfcxvpnhfzxspnhf.exe
  C:\Temp\kfcxvpnhfzxspnhf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxsmkfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1068
  - - C:\Temp\nkfcxsmkfa.exe
      C:\Temp\nkfcxsmkfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxsmkfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3972
  - - C:\Temp\i_nkfcxsmkfa.exe
      C:\Temp\i_nkfcxsmkfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpjhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2708
  - - C:\Temp\fzxrpjhfzx.exe
      C:\Temp\fzxrpjhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4052
  - - C:\Temp\i_fzxrpjhfzx.exe
      C:\Temp\i_fzxrpjhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kebztrpmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4080
  - - C:\Temp\kebztrpmhe.exe
      C:\Temp\kebztrpmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kebztrpmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5980
  - - C:\Temp\i_kebztrpmhe.exe
      C:\Temp\i_kebztrpmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomgebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3560
  - - C:\Temp\bwuomgebwu.exe
      C:\Temp\bwuomgebwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomgebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\i_bwuomgebwu.exe
      C:\Temp\i_bwuomgebwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbywtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2720
  - - C:\Temp\qljdbywtol.exe
      C:\Temp\qljdbywtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbywtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2292
  - - C:\Temp\i_qljdbywtol.exe
      C:\Temp\i_qljdbywtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtolgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1144
  - - C:\Temp\jdbvtolgdb.exe
      C:\Temp\jdbvtolgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5836
  - - C:\Temp\i_jdbvtolgdb.exe
      C:\Temp\i_jdbvtolgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4644
  - - C:\Temp\vqoigaysqk.exe
      C:\Temp\vqoigaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqoigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3956
  - - C:\Temp\i_vqoigaysqk.exe
      C:\Temp\i_vqoigaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2372
  - - C:\Temp\xvpnifaxsq.exe
      C:\Temp\xvpnifaxsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\i_xvpnifaxsq.exe
      C:\Temp\i_xvpnifaxsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2096
  - - C:\Temp\spnhfaxupm.exe
      C:\Temp\spnhfaxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\i_spnhfaxupm.exe
      C:\Temp\i_spnhfaxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5652
  - - C:\Temp\upmhfzxrpj.exe
      C:\Temp\upmhfzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3644
  - - C:\Temp\i_upmhfzxrpj.exe
      C:\Temp\i_upmhfzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3844
  - - C:\Temp\uomhezwrpj.exe
      C:\Temp\uomhezwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezwrpj.exe ups_ins
    3⤵
    PID:3168
  - - C:\Temp\i_uomhezwrpj.exe
      C:\Temp\i_uomhezwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebwuomge.exe ups_run
    3⤵
    PID:3284
  - - C:\Temp\mgebwuomge.exe
      C:\Temp\mgebwuomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebwuomge.exe ups_ins
    3⤵
    PID:2128
  - - C:\Temp\i_mgebwuomge.exe
      C:\Temp\i_mgebwuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtolgey.exe ups_run
    3⤵
    PID:6052
  - - C:\Temp\jdbwtolgey.exe
      C:\Temp\jdbwtolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtolgey.exe ups_ins
    3⤵
    PID:4152
  - - C:\Temp\i_jdbwtolgey.exe
      C:\Temp\i_jdbwtolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgeyvtroi.exe ups_run
    3⤵
    PID:4404
  - - C:\Temp\ljgeyvtroi.exe
      C:\Temp\ljgeyvtroi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgeyvtroi.exe ups_ins
    3⤵
    PID:4988
  - - C:\Temp\i_ljgeyvtroi.exe
      C:\Temp\i_ljgeyvtroi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdyvqniga.exe ups_run
    3⤵
    PID:3700
  - - C:\Temp\lfdyvqniga.exe
      C:\Temp\lfdyvqniga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqniga.exe ups_ins
    3⤵
    PID:3732
  - - C:\Temp\i_lfdyvqniga.exe
      C:\Temp\i_lfdyvqniga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqnifaxv.exe ups_run
    3⤵
    PID:2340
  - - C:\Temp\avsqnifaxv.exe
      C:\Temp\avsqnifaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqnifaxv.exe ups_ins
    3⤵
    PID:1512
  - - C:\Temp\i_avsqnifaxv.exe
      C:\Temp\i_avsqnifaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    PID:4092
  - - C:\Temp\kfcxvpnhfz.exe
      C:\Temp\kfcxvpnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    PID:2880
  - - C:\Temp\i_kfcxvpnhfz.exe
      C:\Temp\i_kfcxvpnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcauspnhfc.exe ups_run
    3⤵
    PID:1104
  - - C:\Temp\hcauspnhfc.exe
      C:\Temp\hcauspnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcauspnhfc.exe ups_ins
    3⤵
    PID:4812
  - - C:\Temp\i_hcauspnhfc.exe
      C:\Temp\i_hcauspnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    PID:3380
  - - C:\Temp\mhezxrpjhb.exe
      C:\Temp\mhezxrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    PID:2020
  - - C:\Temp\i_mhezxrpjhb.exe
      C:\Temp\i_mhezxrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffdbb2ac188,0x7ffdbb2ac194,0x7ffdbb2ac1a0
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15140916968608430499,12345540277113877924,262144 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,5105447286108021868,14802083312792529830,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
      4⤵
      System Time Discovery
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,10477881719850986982,14351613051623671299,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,1961457176659629442,16889708448068102264,2097152 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,2635291774298016112,6889809788289852068,2097152 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,7931887439828452276,7202626484014241057,2097152 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16649668957078705602,16143113938880741534,2097152 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,17549681896682400911,712068499978193478,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,3471858712985724520,7075366360508730361,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7933427087152959731,8538428514512672217,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,3812780078655080064,1772872281550128566,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,3812780078655080064,1772872281550128566,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16217496009261020380,11835255090401543977,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,7759215842875636838,982625413674298045,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,386400157529744967,11329248803370380498,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,2159688982616727467,11436837786978819580,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13912950082738548779,2742349100148796081,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,2093387703519698555,17835207573656367109,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,14278404354295450439,4349938626098454606,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,11623990541620544884,13238071169080551743,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,2501434611596579117,1448576998722063056,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5388,i,17173574588102666861,5086180689664906058,262144 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:10
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5056378494451018745,17638077572608935172,524288 --field-trial-handle=2308,i,8872930505845219306,10471412817829840409,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3436

C:\Temp\kfcxvpnhfzxspnhf.sys
C:\Temp\kfcxvpnhfzxspnhf.sys
1⤵
- Executes dropped EXE
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3132

C:\Temp\hecxrpmhfc.sys
C:\Temp\hecxrpmhfc.sys
1⤵
- Executes dropped EXE
PID:5396

C:\Temp\kecwuomhec.sys
C:\Temp\kecwuomhec.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\eywuomjebw.sys
C:\Temp\eywuomjebw.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\bytrojgeyw.sys
C:\Temp\bytrojgeyw.sys
1⤵
- Executes dropped EXE
PID:2564

C:\Temp\gbytqoigdy.sys
C:\Temp\gbytqoigdy.sys
1⤵
- Executes dropped EXE
PID:1388

C:\Temp\fdbvtnigay.sys
C:\Temp\fdbvtnigay.sys
1⤵
- Executes dropped EXE
PID:4152

C:\Temp\xvpnhfdxvp.sys
C:\Temp\xvpnhfdxvp.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\faxsqkifax.sys
C:\Temp\faxsqkifax.sys
1⤵
- Executes dropped EXE
PID:1556

C:\Temp\usmkhczxsp.sys
C:\Temp\usmkhczxsp.sys
1⤵
- Executes dropped EXE
PID:6068

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\jgeywtrpjh.sys
C:\Temp\jgeywtrpjh.sys
1⤵
PID:1488

C:\Temp\wtrojhbztr.sys
C:\Temp\wtrojhbztr.sys
1⤵
PID:4560

C:\Temp\jgbywqoljd.sys
C:\Temp\jgbywqoljd.sys
1⤵
PID:2456

C:\Temp\lfdyvqolfd.sys
C:\Temp\lfdyvqolfd.sys
1⤵
PID:4120

C:\Temp\oigsqkidav.sys
C:\Temp\oigsqkidav.sys
1⤵
PID:5988

C:\Temp\avsnkfcavs.sys
C:\Temp\avsnkfcavs.sys
1⤵
PID:4196

C:\Temp\kfcauspkhc.sys
C:\Temp\kfcauspkhc.sys
1⤵
PID:4120

C:\Temp\hfzwupmkec.sys
C:\Temp\hfzwupmkec.sys
1⤵
PID:3712

C:\Temp\pmhfzpjhbz.sys
C:\Temp\pmhfzpjhbz.sys
1⤵
PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwuomgebwu.exe

Path C:\Temp\bwuomgebwu.exe
Size 376KB
SHA256 1f98069905011a8b2a8be9b47ea9ca29dad4de218dddd6184cb3e9069fd75747
MD5 9acc3eeee74108e39151e0363d0a1bf7
SHA1 4d8a8160c0608e5b57d3ee48b70ead9770259ba1
SHA512 8ee097be7ede49b7d92548cf567a9e03aa8eac7e5f93d27eaf4cf6cacf5cd6a95085a13c7f15ab4ae0a33128a927ee7263c58eb8e2dea62cf2fbb713147c84da
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrojgeyw.sys

Path C:\Temp\bytrojgeyw.sys
Size 293KB
SHA256 41be505f37ffab8bab226559553b9c5a6e32f5111c69ae531f83b5a9f84755fd
MD5 0500788850be869280c0227e9100c697
SHA1 40f1fb0a70de33137d1794d41a46bb1785d11c34
SHA512 863f4d04f5b87d599556cb32f45487a0dbc683af5154b6a72322236c8d5ed2c4718e207488b4a290359a02fbba40aefd914e4b99746498aec179ac3753203498
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywuomjebw.sys

Path C:\Temp\eywuomjebw.sys
Size 293KB
SHA256 fe9e0b1e9a25e0eda50a23337fb6b4df5507c252736cab2ff3fbfae87c970f14
MD5 207c4c942cf979510bbbe1ebce05ab16
SHA1 609a29a972f0c33434fb576bcaa1053b28d02c35
SHA512 0107fbeb69c283e0741bb728995b86a952b727815ac59f3313cd7ad1a828404c082fcfc03cff5eab615d988ad9576ec800428b102ad0720dec8f04d6319f15f1
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjhfzx.exe

Path C:\Temp\fzxrpjhfzx.exe
Size 376KB
SHA256 351798a02b90a95c20c7e67e3d732edf06cb6f583362fc79eefd7f13a2cc7e5d
MD5 69547f1de770ffd847c53db184ce6f84
SHA1 f9cd92c6b2af7cff8836cdd7b6abf73fae0b91a3
SHA512 04b84ea8f88a32bb367ca3a5d0c2a47a1dbee4c7d3b22c68ac7c5da851ef3155fed63a71f3ebe877c9e28a13779cbc841892b8cebd91711a6aca6026b1b0bf80
SSDEEP 3072:VFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqoigdy.sys

Path C:\Temp\gbytqoigdy.sys
Size 293KB
SHA256 83afa013b2fc638ad24456ba2d63af08d9b9a6133ccbad0a52258b86dcf69405
MD5 868dafe8541df4354174b8c35642cdde
SHA1 b95fc9e5fb97cac2f8d62b061d228bb3deb08fe3
SHA512 4269a119b8007c5673241001d574529ecc99c1744f1cfe7ca7ba0abec7351202e1b5b157e5811fb704cd85f602583a62eb85b5cf27cc9b26ecb858f54db0b7cc
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecxrpmhfc.sys

Path C:\Temp\hecxrpmhfc.sys
Size 293KB
SHA256 9721bb6e3adab763095f3882a809ee7577b4bdb82d0693c94e3c21157b867efb
MD5 efaa28c09340838e0374f9a1f68a8b35
SHA1 3e0c63d83f22b2749623c4aa2f12ec05f5116dd0
SHA512 7bf7c0452566bec79c9eddb23397141bb9e31aa1abc26d5f1ac759efe816f101178f03a35e41d66af06d66e5330df8eb1e1993940dc82baa53f50a443b441cbb
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwuomgebwu.exe

Path C:\Temp\i_bwuomgebwu.exe
Size 376KB
SHA256 8385e56fae34888c29ba2394b44a3d6d3e0c5fc08e575495b05753da8d5ff3a5
MD5 4e62026f4b5102e8a42f066e1af8fd3b
SHA1 f4a062cafd0ec3c2ed7ebad6b4cfcf49fd92ef3e
SHA512 135d59838ebd8ff8ccecef0a15d9901e33a1bd660cc43ec673a37f83fa50cff47908f9f2b9075228f6003f4268619c2cef296e4fb0c60e6977ec395b3f221cfb
SSDEEP 3072:eFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpjhfzx.exe

Path C:\Temp\i_fzxrpjhfzx.exe
Size 376KB
SHA256 f6564c84917bc0b3dd89409c59ef1127296653f10b6a1b85db6626bb82dbb1cc
MD5 c44631ed9f868c0d850c023e2e32e787
SHA1 1a9ad33b64678d27b0c970b5cf719bbbc03da52e
SHA512 ff55f51be446353065c9f46a43934e85bd99a736eccb692eafc7f424e5868b1814783eb82c223ac35e59c81d15013fbdaa3b437a26976bcc40f48f8b0a80674d
SSDEEP 3072:rFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kebztrpmhe.exe

Path C:\Temp\i_kebztrpmhe.exe
Size 376KB
SHA256 e268bee31aa4ba68971a44949bd5b3dd24008df2eb3c7afc65c382d98549ded5
MD5 420847ba785dcffbfe5af07509446302
SHA1 f002a19e0c84653910c73b9ad838976989a5fb3c
SHA512 7ed48cf5a0a08b8a815686356c5caf9da160ab236c7bbfa660e5606bfd72f6b1fb4403551d93186dc02feb05f2f7edae68205f360fb93b52c1f381d2aff0c6d6
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T111847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxsmkfa.exe

Path C:\Temp\i_nkfcxsmkfa.exe
Size 376KB
SHA256 f4ecf117f194d62eddcbe92a1d5111f6a4c3e92643002ca05bf5f4c265017792
MD5 40fb5406496d86402450f4810404cfeb
SHA1 a8f8bc468506e2ad7de531cd5027608ce1d0dd67
SHA512 b1cd21fc343187317ea6dc920a7a31514d15d1c02b02d9b39b9837ddc892f96d7ae0cbca6c63fa2f8dd595a0db5a63469d9bce31cddfc73ce7b2628218aad816
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbywtol.exe

Path C:\Temp\i_qljdbywtol.exe
Size 376KB
SHA256 87e7466b9dfb677acd193ccbba239ae446cfe79689142bde42229c04e6f8bacd
MD5 920760a3d5ae557f074a6d3e9c24bc32
SHA1 141aeb1fc60e6f8b7c5793fd8cf4eb6248a37a9b
SHA512 66106a99b789a980418f3fc37ed12f6a1e7307265f37413ffe3b47ab4d9b7a94832b90b8258f1a5bad80035043c373fbed5a76e2f59d3bd5c6505dc4c14c991c
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgdb.exe

Path C:\Temp\jdbvtolgdb.exe
Size 376KB
SHA256 80c9c565f3c987703415755587fc3343695546e296b1bb7560bdf73b2707574a
MD5 b6f6269fbf5824b81449f852d7aa45a3
SHA1 feddc001c6543ade9a207ad9980c4b9ab161ebb4
SHA512 2592a61d8c265b8f8682a40a105c63ba3133d3725e4c730d6457178364be0468e7dee3c6b9ff2b5b5471299b8865a792440f128a7894b5d2de9427a146da74d6
SSDEEP 3072:ZFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kebztrpmhe.exe

Path C:\Temp\kebztrpmhe.exe
Size 376KB
SHA256 0d66a47262e66126b248b73d5f009791c841e74a0d49e6751bf13a70860366a1
MD5 9b9351732ff91c1463247b656901afff
SHA1 210b01e3dca9ce0fa78ec5654390a7000b7e6efe
SHA512 f585b3125210ad9006a855ab57a8fe08812041362f5acf8e472f2a5e15c0a746539cbaba0da8c0373c6c870ce5b738ebd97e3f985d357faec2e206af65918c3c
SSDEEP 3072:7FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T146847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhec.sys

Path C:\Temp\kecwuomhec.sys
Size 293KB
SHA256 809e4e9b9212e2d0669ee4342b51e15766739ee1a096cb1ac6b1d56ca09f7afa
MD5 a8e62da9ca68ca0be2850c817b47448d
SHA1 9e0905ad900f561856fae60ed32495fc1b1ddd78
SHA512 d732b5d50bd3bcb6ad22ff6c17cd2b061b7452e3322ec9f70e4190137f90dd01dcb1a6b50ffb9082c32d7bbeb43b229f304a4f91267dba0a413afd1ad25747df
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfzxspnhf.exe

Path C:\Temp\kfcxvpnhfzxspnhf.exe
Size 376KB
SHA256 f0f85554131c763f56c9673cafec8fc61940d078c0ea8d724496e148a6a1d465
MD5 677f9fe994dbeec88dbc23a0a2f280d0
SHA1 199fad38f519fa2a7c016fa02d78c74e766fad22
SHA512 f4584a9722a17bb9baa11d13738fdbb0df7b13b9e4bf368e0b814fe4191ec27e0949817cbfb5f5de6e39754a434bdc629896d0f7a735e89f22b81d876ac0fc0d
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfzxspnhf.sys

Path C:\Temp\kfcxvpnhfzxspnhf.sys
Size 293KB
SHA256 3d08ecb8cd2f08e1fc94cc0156ddabedffde9e6773a197ca85154d8d19a4bc3b
MD5 ca95c6530aab9c848de6437986b3d398
SHA1 212c8fc9e78e049f9eef3ca679dfb12ebb8ef3f1
SHA512 c52550b8a73940ccd0cc0dd09aab246b73388ce9bf8590f4977123c65fc04845fe51faabaf3840af6f23d55f40aaf6a3bc85d86e52a287cf91bea0b8a972e307
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxsmkfa.exe

Path C:\Temp\nkfcxsmkfa.exe
Size 376KB
SHA256 80c51f218c8591119ebaf291722f8991b77bc5bd4e13ce6766d3da449c201aa8
MD5 7b18e673df287ceaf8b7fe87c931a8fa
SHA1 2c50527109838b63bf045b46a1b88b41a050d85c
SHA512 f29750166419387b64839d4eac59d35d60ceed81ae1b4001b865b2af7e1326fa76674bbb72b49e7823963b7b06d002ef680ab254cd79045f521bcd45b315b6c2
SSDEEP 3072:TFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbywtol.exe

Path C:\Temp\qljdbywtol.exe
Size 376KB
SHA256 6d9cb8b7331e2ca3bfcdc0f13deea6589f498bd74cf4d0d99e0b20d7df274829
MD5 2ba56a4bb37cec146dd477b947cfc2c2
SHA1 7bcc4ce00fb56d2993fce5473b6fb23cdd020734
SHA512 225bd60aa1166ca0cbeef0dfc3a31df3765fa5fc5662c301e397425787e8e682bbd415f4377231f1ae50b8a479b3814853b161f32e805c3e257e88ff18c3b239
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5c4d5c5c5671b734a9e50c23081428186eca9ff660e73e8f6d1cfa86c88573b4
MD5 bdbf8b29442dcfd2a1443d1dc97b2828
SHA1 3f0f575cdd9558f232ba71e075f1c01b720b798b
SHA512 2098abaa45e9de4e22120da78e57e7c5eb91b6b04c0b1cb8979630218046ad22af17a4dab9e7d669e407a4aacb3830d2c4b48260cbe9f088b56bae10cee2212a
TLSH
T13851D89E03321AC0E79760B664E4158933F6970A0A075E335750AF337A47F19E1FE103
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3a1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3a1c.TMP
Size 3KB
SHA256 54e7a6990e666939e569dbf09105104250779abdb6ef61dd5cae66a90e58203a
MD5 dad82c6100016d72ee0982b605e85e9e
SHA1 97d0af7a97b0522eee222dab6502c08751e0725a
SHA512 9f369e3178ca37a8fc6fb3ac86630eb37a80f450736b5e1e2d23136c335690614b5dfe8691c65e0f2806621541b704e637e48d9ce97b84c3444027f5aee67de7
TLSH
T1CF51BA9E03211AC0E79760B664E4554937F6960A0A075E335754AF337A4BF15E1FE113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f01d1944ca13c3749939d8f14ebb474c2becabd618f69705f42b80c4c95cbc41
MD5 92f41b288ed6638b2c5c08a62decfdec
SHA1 61a719f48b9e73f5dbe0263c040636d7f5d8d3e3
SHA512 d4ef90affed4fd5d6249f5cf61d29e0069dffc835c85ca7706cf454bc8cc882b2a5adc20c6702ce070281c3d1fd8af22d9fd68b82382b161e6755f0be0b3ab38
TLSH
T1DA51ADF387E4956D8A0156F0AA146E2FDE1D0515432C3D6AC9E0EE2BD3E3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 69db93cfd69f07a10c9143e2e2c4a39572f754c7ebe24254e5667ec245d1c2bf
MD5 3c9d0918ed03a22157abaad6553e20f5
SHA1 2a33d3b7791b9f8828b451bf98d85b97f89c93ae
SHA512 eecbaff6dff88f875ad344edbcfb77ed57dac0340d5c8e407bce54a837553e5fe11c517f22954686e3f06395487d665704cf194426f83023d08689182c6813b3
SSDEEP 192:sxRZRZCr/fGsJUIoDde5lSZzoD8p9p/g6+WNCGM/YC3MuORGV+oIgVUJ:sxRZir/fGsJUIoc5lYP/5o/KA+km
TLSH
T1AA42A7166D28A93B8CC7E21DBA55BF53D7F92032A1911E48AAFCD61C04E66DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f910515beff6114b70febcf824a9b60cbb5212ec0c6c500ab433eb71a96a90a6
MD5 38961c3f2dabd04e66df6837008be211
SHA1 a003000e4557b87f60a988c1ff53ed94c01bf6ad
SHA512 2d0f6749a786ea12872ca4a499a55abe9bad9fc2b353ec05ff6d0044a7b741017afd8a08f37c2beefa749e443f6e84305ee2379fb04dc8997ea8088b9b91abd8
SSDEEP 192:sxRaRZCr/fGsLUIl8ZSyzoD8p9p/g6+WNCGM/YCGcuORGV+oIgDEUJ:sxRair/fGsLUIlCSuP/5o/FA+kN
TLSH
T10C42C81669286D3B9CC7E21DBB55BF53D7F96032A1911E48EAFCCA1C00E76DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7f3d1942206cbc16dc2ca694f80eedb60d3bed61526c2b3f8efee567db216015
MD5 c6c34052539dbd55c2e119ea0e87ab94
SHA1 edc623205f2c89356b2e2bf70ec4294ed0900993
SHA512 e5c6c63cdc42fba04ddc41241ac44060b62fe4bd8d3e4621806000fd6af59dd481523cfcefcb54260f74c2e5e8ab99c63c2ffed8a69c1fa601d6ef8c902fa272
SSDEEP 192:sxRaRZCr/fGsLUIoDde5lSZzoD8p9p/g6+WNCGM/YC3MuORGV+oIgDeUJ:sxRair/fGsLUIoc5lYP/5o/KA+kP
TLSH
T1B742B8166E28AD3B8CC7E21DBA55BF53D7F92032A1911E48AAFCD61C04E66DD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 97296e889bfc78d79850450c345718e1520dbdff8005b87d0d39a91dd1efd360
MD5 6ff427013a68c187c89d09b2378fe2f2
SHA1 8bb2bc4be2c2f2f65fa289d7ff7f8a9c8d51b10b
SHA512 7141b53f49ffb1645bb6cf9358d2e120585143ddb78dd93842d834188bc07379bda690535a33ad0b7a97e6a15b246465b717af0ae5aa4b2823f9100eac90188a
SSDEEP 768:jC+v9N7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVti0QqcProZq:jC+v97E7JQWgQ+f4+u1jaai0VccQ
TLSH
T1DED2EA7B640DCB7F4F804ADDAC197E9E6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5811fdef-79ed-423a-b6e8-9d7569dfcff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5811fdef-79ed-423a-b6e8-9d7569dfcff8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6a1f003d1b802689bc275782fda47bd44726eee89362540c4555e0dc9cd379d4
MD5 71cf45358f7e5a126c31ba404e1ba7b5
SHA1 8a647b30749b2e3161e377397c8ed49747583b89
SHA512 cf23fc744a5779bde895ca196149e167aaa3245e9fc07ea54f55f953e77783de66d0a53ccb127e3ddda755943189b014db3a9e0ed91368c0a3366f75f1770428
SSDEEP 768:ZFQJ3GwgooOm/p8+p3bd66j+4BRv86aLIWePi9Ph3:YJ37QR8+p3Z6n4y8P6
TLSH
T1ED1318F194D79976E8AE9783A37D2E429EFCD063B5845894B7C89E0CCC821BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 93bd3f37ceb9c0833bc37590ae1d421d51fd2bd80bf35506d3d1c1a720738f66
MD5 7dce732ef387409e4595d36cbef1a5ea
SHA1 d92f1a9ad21a97b7873a7f2242a7a3f18918c87c
SHA512 16b00dd187eb111dea73fe2f04ad59cc25f3f9e1719708703a15c3f8fb760ea375d4d5a35e8ba731e23802165c14cb1c2e8b3f8400343f4cdd5ba742993edda7
SSDEEP 768:Irv+4UNbdD3CceNp8+p3bd66j+4BRv86aLIiB2bwCl1:Ibsbp3QL8+p3Z6n4yD0ww
TLSH
T1A703CE73F8A899739CF6C644B2467A437FF821A396C10EC4D5DD2B4E419A19E230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a3a95745dfe7e3b14cebdeaf9783e8046c6c7d35c8d8f56d82bfc0b274684e26
MD5 e2f79d205104f2477160f639c9a78142
SHA1 06d4d57181afb2d855cc5c2a0639653a37399f96
SHA512 b8a545c1f44214afbf3e1049d702e83fc205f1c940dfa20adb5913b5e7a9df00dab8b4cddd363796b4286541de1a6affc5f479b355b18a568350ce260a3d81de
SSDEEP 768:/p3EChHw/p8+p3bd66j+4BRv86aLIWePi9Ph3:/p3EKwR8+p3Z6n4y8P6
TLSH
T1C3F2AFB1F8A99D635CE9D744B29637436FF825A3E5C01E98D4DCEB0D008225E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 878df4a4571124986778ad05c0be5b810c2d2cfceefd9c62b463e246caa15b7c
MD5 dda0cc3ca5bd6ba4ccc01454b5d09891
SHA1 148d68d32c037165b3f14fb759e5085722064c60
SHA512 36d61d0cbd83cb501bcb1b45e85c50a659085955fe4e70bf727e1ebe1623a6a79dc03453dbb2ad579aaa500a21f5fcae887baf20dddcfe71672f7e80722dcf4b
SSDEEP 768:hrv+4UNbdD347HwNp8+p3bd66j+4BRv86aLITe2bwCl1:hbsbp32wL8+p3Z6n4y70ww
TLSH
T17703BE72F498E9739CEAD644B14676837FF821A399C10EC4D9D96B4E004A29F270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2a492554aa453072b16a9803c7fe8eadfb2714c6a49457cc472d9e070ab52b5a
MD5 d37f0750fe3db645a70c52a290a48cc4
SHA1 3e4d1a781752bed1ff96afea31f5749507bd9a82
SHA512 e410bb26a18f066ce278d6c11edb7a067012eb72577c6582258b410c237a85238c042ba8ee2a233e7796b78b5eb5270fe1e6282b314b00fb34f8ac0aee801c82
SSDEEP 768:Yp39ShHwDp8+p3bd66j+4BRv86aLIWePi9Ph3:Yp396wV8+p3Z6n4y8P6
TLSH
T115F2AFB1F8A99D639CE9D744B29637436FF82563E5C01D98D4DDEB0D008625E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ffa44841-eeb7-46f1-8d92-213db0d86470.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ffa44841-eeb7-46f1-8d92-213db0d86470.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4124_2051523248\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a480166af4fd9869599119e19d16316bc85c246743182b4b234fcb48ebf83358
MD5 12f858bd93528e725fc5a529e6c688cf
SHA1 ca5da7cdadd0f70625576e3c09871e1287788804
SHA512 79fa8fd8340f897a1c491b64993d7ef7d879bca82c33ce6ffc49642871aa26bc1388573b3b6de6b92d8176e7b73c9608900435cc2a93c8852a841893f006606e
TLSH
T1DE71008357AADAF3C2DA5BF402835644F1BB22380B2320205B515986AA30A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-312-0x0000000000520000-0x000000000057F000-memory.dmp

Download

memory/1340-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1388-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1488-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1556-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2564-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4152-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4300-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5396-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6068-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download