systex | 6420a23d23b38962e2894de90758c98d4e88a35a8df579f2705bceaef3e6fe8e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260819-s2barsdm3s
SHA256 6420a23d23b38962e2894de90758c98d4e88a35a8df579f2705bceaef3e6fe8e
MD5 473b17cb4992ef045fe64b5bea0d5cbc
SHA1 3cb53eb5a0e9f0a446e4853864f9c62d8fa41113
SHA512 ce1f2b3d75835c45919597578e6092b6d3b35e2b6b8b65bd35b78af876bac807c6f259be7d5e2c12788cd3db1d4f80c592c271c7bb528bc78a471a8e2ecabcb9
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3508	usqkicauspkhfaxs.exe
2400	usqkicauspkhfaxs.sys
1428	CreateProcess.exe
5428	fzxspkhcau.exe
2996	CreateProcess.exe
4176	CreateProcess.exe
1984	i_fzxspkhcau.exe
1808	pjhfcxupmk.sys
2484	CreateProcess.exe
4224	hecaupjhfc.exe
2700	CreateProcess.exe
4892	CreateProcess.exe
1856	i_hecaupjhfc.exe
5308	wurmjecwuo.sys
4832	CreateProcess.exe
3416	zurmkecwuo.exe
756	CreateProcess.exe
2124	CreateProcess.exe
3844	i_zurmkecwuo.exe
4216	omjebwtrom.sys
4780	CreateProcess.exe
4372	rojgebwuom.exe
3396	CreateProcess.exe
2540	CreateProcess.exe
2260	i_rojgebwuom.exe
5640	ywtomgeywq.sys
3924	CreateProcess.exe
3776	ljdbvtnlgd.exe
5736	CreateProcess.exe
2128	CreateProcess.exe
5016	i_ljdbvtnlgd.exe
6032	igaywtnljg.sys
4484	CreateProcess.exe
472	ljdaywqolg.exe
3456	CreateProcess.exe
5300	CreateProcess.exe
4712	i_ljdaywqolg.exe
3388	ifdyvtnlfd.sys
1864	CreateProcess.exe
4648	yvqnigdyvs.exe
1972	CreateProcess.exe
5752	CreateProcess.exe
4232	i_yvqnigdyvs.exe
3512	fcavsqkica.sys
5056	CreateProcess.exe
2928	faxvsnkica.exe
2556	CreateProcess.exe
1052	CreateProcess.exe
5024	i_faxvsnkica.exe
6032	sqkifaxsqk.sys
4568	CreateProcess.exe
1324	axspkhcaus.exe
1904	CreateProcess.exe
3528	CreateProcess.exe
3844	i_axspkhcaus.exe
1092	hfzxupnkfc.sys
4684	CreateProcess.exe
4360	hfzxspjhcz.exe
5564	CreateProcess.exe
2012	CreateProcess.exe
2616	i_hfzxspjhcz.exe
2188	urmkecwusm.sys
4580	CreateProcess.exe
5988	wrpjhczusm.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1541858218\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1541858218\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_489853726\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_352208603\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_352208603\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1243958424\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1541858218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1541858218\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping860_1243958424\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdaywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpmhfzxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicauspkhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvsnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecaupjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdaywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigdyvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecaupjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmhfzxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigdyvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvsnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpnhfzxs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1748	ipconfig.exe
436	ipconfig.exe
5068	ipconfig.exe
2916	ipconfig.exe
4256	ipconfig.exe
6076	ipconfig.exe
5040	ipconfig.exe
1816	ipconfig.exe
1376	ipconfig.exe
5616	ipconfig.exe
1860	ipconfig.exe
5956	ipconfig.exe
1792	ipconfig.exe
6136	ipconfig.exe
6000	ipconfig.exe
5956	ipconfig.exe
4896	ipconfig.exe
1016	ipconfig.exe
4276	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316274198781886"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{CB589EFA-1FC8-4C14-BE17-33CCEABBF901}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe
3508	usqkicauspkhfaxs.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	i_fzxspkhcau.exe
Token: SeDebugPrivilege	1856	i_hecaupjhfc.exe
Token: SeDebugPrivilege	3844	i_zurmkecwuo.exe
Token: SeDebugPrivilege	2260	i_rojgebwuom.exe
Token: SeDebugPrivilege	5016	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	4712	i_ljdaywqolg.exe
Token: SeDebugPrivilege	4232	i_yvqnigdyvs.exe
Token: SeDebugPrivilege	5024	i_faxvsnkica.exe
Token: SeDebugPrivilege	3844	i_axspkhcaus.exe
Token: SeDebugPrivilege	2616	i_hfzxspjhcz.exe
Token: SeDebugPrivilege	5840	i_wrpjhczusm.exe
Token: SeDebugPrivilege	2372	i_hbztrljebw.exe
Token: SeDebugPrivilege	4364	i_tomgeywqoj.exe
Token: SeDebugPrivilege	240	i_bytqljdbwt.exe
Token: SeDebugPrivilege	3576	i_tqoigaysql.exe
Token: SeDebugPrivilege	5020	i_davtnifays.exe
Token: SeDebugPrivilege	240	i_uspkhfdxvp.exe
Token: SeDebugPrivilege	796	i_zxvpnhfzxs.exe
Token: SeDebugPrivilege	4912	i_urpmhfzxsm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3508	4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4836 wrote to memory of 3652	4836	2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3652 wrote to memory of 860	3652	iexplore.exe	90
PID 860 wrote to memory of 1148	860	msedge.exe	91
PID 860 wrote to memory of 5484	860	msedge.exe	92
PID 860 wrote to memory of 2100	860	msedge.exe	93
PID 860 wrote to memory of 2100	860	msedge.exe	93
PID 860 wrote to memory of 2100	860	msedge.exe	93
PID 860 wrote to memory of 1064	860	msedge.exe	94
PID 860 wrote to memory of 1064	860	msedge.exe	94
PID 860 wrote to memory of 4268	860	msedge.exe	95
PID 860 wrote to memory of 4268	860	msedge.exe	95
PID 860 wrote to memory of 4268	860	msedge.exe	95
PID 860 wrote to memory of 3328	860	msedge.exe	96
PID 860 wrote to memory of 3328	860	msedge.exe	96
PID 860 wrote to memory of 3328	860	msedge.exe	96
PID 860 wrote to memory of 1276	860	msedge.exe	98
PID 860 wrote to memory of 3584	860	msedge.exe	99
PID 860 wrote to memory of 1276	860	msedge.exe	98
PID 860 wrote to memory of 1276	860	msedge.exe	98
PID 860 wrote to memory of 3584	860	msedge.exe	99
PID 860 wrote to memory of 3584	860	msedge.exe	99
PID 860 wrote to memory of 824	860	msedge.exe	101
PID 860 wrote to memory of 824	860	msedge.exe	101
PID 860 wrote to memory of 5872	860	msedge.exe	103
PID 860 wrote to memory of 6060	860	msedge.exe	104
PID 860 wrote to memory of 5872	860	msedge.exe	103
PID 860 wrote to memory of 6060	860	msedge.exe	104
PID 3508 wrote to memory of 1428	3508	usqkicauspkhfaxs.exe	106
PID 860 wrote to memory of 5252	860	msedge.exe	109
PID 5428 wrote to memory of 2996	5428	fzxspkhcau.exe	111
PID 860 wrote to memory of 3156	860	msedge.exe	116
PID 860 wrote to memory of 3156	860	msedge.exe	116
PID 860 wrote to memory of 796	860	msedge.exe	117
PID 860 wrote to memory of 796	860	msedge.exe	117
PID 3508 wrote to memory of 4176	3508	usqkicauspkhfaxs.exe	119
PID 3508 wrote to memory of 2484	3508	usqkicauspkhfaxs.exe	123
PID 4224 wrote to memory of 2700	4224	hecaupjhfc.exe	125
PID 3508 wrote to memory of 4892	3508	usqkicauspkhfaxs.exe	128
PID 3508 wrote to memory of 4832	3508	usqkicauspkhfaxs.exe	132
PID 3416 wrote to memory of 756	3416	zurmkecwuo.exe	134
PID 3508 wrote to memory of 2124	3508	usqkicauspkhfaxs.exe	137
PID 3508 wrote to memory of 4780	3508	usqkicauspkhfaxs.exe	141
PID 4372 wrote to memory of 3396	4372	rojgebwuom.exe	143
PID 3508 wrote to memory of 2540	3508	usqkicauspkhfaxs.exe	147
PID 860 wrote to memory of 4184	860	msedge.exe	149
PID 860 wrote to memory of 1804	860	msedge.exe	150
PID 860 wrote to memory of 4404	860	msedge.exe	151
PID 3508 wrote to memory of 3924	3508	usqkicauspkhfaxs.exe	154
PID 3776 wrote to memory of 5736	3776	ljdbvtnlgd.exe	156
PID 3508 wrote to memory of 2128	3508	usqkicauspkhfaxs.exe	159
PID 3508 wrote to memory of 4484	3508	usqkicauspkhfaxs.exe	163
PID 472 wrote to memory of 3456	472	ljdaywqolg.exe	165
PID 3508 wrote to memory of 5300	3508	usqkicauspkhfaxs.exe	168
PID 3508 wrote to memory of 1864	3508	usqkicauspkhfaxs.exe	172
PID 4648 wrote to memory of 1972	4648	yvqnigdyvs.exe	174
PID 3508 wrote to memory of 5752	3508	usqkicauspkhfaxs.exe	177
PID 3508 wrote to memory of 5056	3508	usqkicauspkhfaxs.exe	181
PID 2928 wrote to memory of 2556	2928	faxvsnkica.exe	183
PID 3508 wrote to memory of 1052	3508	usqkicauspkhfaxs.exe	186
PID 860 wrote to memory of 3564	860	msedge.exe	188
PID 860 wrote to memory of 3564	860	msedge.exe	188
PID 860 wrote to memory of 1712	860	msedge.exe	194
PID 860 wrote to memory of 1712	860	msedge.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_473b17cb4992ef045fe64b5bea0d5cbc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Temp\usqkicauspkhfaxs.exe
  C:\Temp\usqkicauspkhfaxs.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1428
  - - C:\Temp\fzxspkhcau.exe
      C:\Temp\fzxspkhcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\i_fzxspkhcau.exe
      C:\Temp\i_fzxspkhcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecaupjhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2484
  - - C:\Temp\hecaupjhfc.exe
      C:\Temp\hecaupjhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecaupjhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4892
  - - C:\Temp\i_hecaupjhfc.exe
      C:\Temp\i_hecaupjhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\zurmkecwuo.exe
      C:\Temp\zurmkecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmkecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2124
  - - C:\Temp\i_zurmkecwuo.exe
      C:\Temp\i_zurmkecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4780
  - - C:\Temp\rojgebwuom.exe
      C:\Temp\rojgebwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2540
  - - C:\Temp\i_rojgebwuom.exe
      C:\Temp\i_rojgebwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3924
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdaywqolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\ljdaywqolg.exe
      C:\Temp\ljdaywqolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdaywqolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\i_ljdaywqolg.exe
      C:\Temp\i_ljdaywqolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnigdyvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1864
  - - C:\Temp\yvqnigdyvs.exe
      C:\Temp\yvqnigdyvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnigdyvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5752
  - - C:\Temp\i_yvqnigdyvs.exe
      C:\Temp\i_yvqnigdyvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvsnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\faxvsnkica.exe
      C:\Temp\faxvsnkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvsnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1052
  - - C:\Temp\i_faxvsnkica.exe
      C:\Temp\i_faxvsnkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4568
  - - C:\Temp\axspkhcaus.exe
      C:\Temp\axspkhcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Temp\i_axspkhcaus.exe
      C:\Temp\i_axspkhcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxspjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4684
  - - C:\Temp\hfzxspjhcz.exe
      C:\Temp\hfzxspjhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxspjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\i_hfzxspjhcz.exe
      C:\Temp\i_hfzxspjhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4580
  - - C:\Temp\wrpjhczusm.exe
      C:\Temp\wrpjhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhczusm.exe ups_ins
    3⤵
    PID:4028
  - - C:\Temp\i_wrpjhczusm.exe
      C:\Temp\i_wrpjhczusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrljebw.exe ups_run
    3⤵
    PID:2652
  - - C:\Temp\hbztrljebw.exe
      C:\Temp\hbztrljebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    PID:1652
  - - C:\Temp\i_hbztrljebw.exe
      C:\Temp\i_hbztrljebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    PID:3560
  - - C:\Temp\tomgeywqoj.exe
      C:\Temp\tomgeywqoj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    PID:5824
  - - C:\Temp\i_tomgeywqoj.exe
      C:\Temp\i_tomgeywqoj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqljdbwt.exe ups_run
    3⤵
    PID:5272
  - - C:\Temp\bytqljdbwt.exe
      C:\Temp\bytqljdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqljdbwt.exe ups_ins
    3⤵
    PID:5992
  - - C:\Temp\i_bytqljdbwt.exe
      C:\Temp\i_bytqljdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigaysql.exe ups_run
    3⤵
    PID:4552
  - - C:\Temp\tqoigaysql.exe
      C:\Temp\tqoigaysql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigaysql.exe ups_ins
    3⤵
    PID:5312
  - - C:\Temp\i_tqoigaysql.exe
      C:\Temp\i_tqoigaysql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnifays.exe ups_run
    3⤵
    PID:3340
  - - C:\Temp\davtnifays.exe
      C:\Temp\davtnifays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnifays.exe ups_ins
    3⤵
    PID:3180
  - - C:\Temp\i_davtnifays.exe
      C:\Temp\i_davtnifays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfdxvp.exe ups_run
    3⤵
    PID:4560
  - - C:\Temp\uspkhfdxvp.exe
      C:\Temp\uspkhfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfdxvp.exe ups_ins
    3⤵
    PID:4300
  - - C:\Temp\i_uspkhfdxvp.exe
      C:\Temp\i_uspkhfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpnhfzxs.exe ups_run
    3⤵
    PID:3848
  - - C:\Temp\zxvpnhfzxs.exe
      C:\Temp\zxvpnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpnhfzxs.exe ups_ins
    3⤵
    PID:424
  - - C:\Temp\i_zxvpnhfzxs.exe
      C:\Temp\i_zxvpnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpmhfzxsm.exe ups_run
    3⤵
    PID:3228
  - - C:\Temp\urpmhfzxsm.exe
      C:\Temp\urpmhfzxsm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpmhfzxsm.exe ups_ins
    3⤵
    PID:4456
  - - C:\Temp\i_urpmhfzxsm.exe
      C:\Temp\i_urpmhfzxsm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffc12a0c188,0x7ffc12a0c194,0x7ffc12a0c1a0
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,1719786101560100815,8958513391572570946,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,8042713835682654485,1616852878101408505,262144 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,10967745196882967606,8157543293430185228,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,688871348152478393,17793848428139557720,2097152 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,11553570815498636438,17267655967985581720,2097152 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5489073903550541954,8261854200687987350,2097152 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,16355706251053896306,1157960162278419925,2097152 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,8291919898478419397,9157820365975289393,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,7130021862031006842,5924618495410245161,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8839823311077265267,13716601931584475777,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,3888505644336266820,12162034113182641785,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,3888505644336266820,12162034113182641785,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,11236416930503339374,11436532243415465174,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,17389548479269612773,14967780803683613497,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11021752490583065778,1937271178094380965,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,9728825139039317833,4635754227766434955,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,8068380933601025163,3552419167756920279,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,16902210006341550729,14078581795241195896,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,17843692806274352775,10194397195476940703,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,5556957278734573791,13987141700808074408,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,11875507279203807613,116058369147394569,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,9287315657340654165,10731712418229552152,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4856,i,6611482232555969872,8456694946540329229,262144 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:10
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,11399593479295410845,13421312183672118300,524288 --field-trial-handle=2300,i,4507307278325519038,8585553552824431342,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4084

C:\Temp\usqkicauspkhfaxs.sys
C:\Temp\usqkicauspkhfaxs.sys
1⤵
- Executes dropped EXE
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3880

C:\Temp\pjhfcxupmk.sys
C:\Temp\pjhfcxupmk.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\wurmjecwuo.sys
C:\Temp\wurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:5308

C:\Temp\omjebwtrom.sys
C:\Temp\omjebwtrom.sys
1⤵
- Executes dropped EXE
PID:4216

C:\Temp\ywtomgeywq.sys
C:\Temp\ywtomgeywq.sys
1⤵
- Executes dropped EXE
PID:5640

C:\Temp\igaywtnljg.sys
C:\Temp\igaywtnljg.sys
1⤵
- Executes dropped EXE
PID:6032

C:\Temp\ifdyvtnlfd.sys
C:\Temp\ifdyvtnlfd.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\fcavsqkica.sys
C:\Temp\fcavsqkica.sys
1⤵
- Executes dropped EXE
PID:3512

C:\Temp\sqkifaxsqk.sys
C:\Temp\sqkifaxsqk.sys
1⤵
- Executes dropped EXE
PID:6032

C:\Temp\hfzxupnkfc.sys
C:\Temp\hfzxupnkfc.sys
1⤵
- Executes dropped EXE
PID:1092

C:\Temp\urmkecwusm.sys
C:\Temp\urmkecwusm.sys
1⤵
- Executes dropped EXE
PID:2188

C:\Temp\jhbztrojhe.sys
C:\Temp\jhbztrojhe.sys
1⤵
PID:4472

C:\Temp\ebztrljdbw.sys
C:\Temp\ebztrljdbw.sys
1⤵
PID:1224

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
PID:5900

C:\Temp\tqlidaysqn.sys
C:\Temp\tqlidaysqn.sys
1⤵
PID:4492

C:\Temp\ifdxvqniga.sys
C:\Temp\ifdxvqniga.sys
1⤵
PID:2648

C:\Temp\idauspnifd.sys
C:\Temp\idauspnifd.sys
1⤵
PID:2188

C:\Temp\hcausmkeca.sys
C:\Temp\hcausmkeca.sys
1⤵
PID:800

C:\Temp\aurpjhfzxu.sys
C:\Temp\aurpjhfzxu.sys
1⤵
PID:3092

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fzxspkhcau.exe

Path C:\Temp\fzxspkhcau.exe
Size 376KB
SHA256 23374367f17e2a85aad226b551469f630f46723e5a879c522e9357e7a262018b
MD5 49bba7e6300599881fea3169ae33444c
SHA1 c10b93be744464dbe073bbe4e25232e9fa0910d7
SHA512 5639853acf04e55137dfdfa514f8f11f559ed1b95f102820848fe0026c497e512da960b07be748739a5d4377cb0fbe3013d15b1f2dccf924d7dda69c671a919c
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecaupjhfc.exe

Path C:\Temp\hecaupjhfc.exe
Size 376KB
SHA256 d21d489a3bc2347f1d9873278a5c033273aadd18979a1e96823a200b62ccc1f5
MD5 52e71a3a97c36f5e1b4e6f792ba81020
SHA1 12b85c9246280ce985513b1022f0f00c7535a14c
SHA512 8393c42c2f2954af7e5bab2a19bff681cb354c5e60a5df7d3b72c1f1f194ccf989c35464fa0d2b01a2357e6afcd384d59ce0714c39224596189212ded4411b0a
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkhcau.exe

Path C:\Temp\i_fzxspkhcau.exe
Size 376KB
SHA256 b482fff2e198f34b05dc7fae4ffbb4553e0aea50db59c88e5f24081185c240bc
MD5 da0a67a555aa93864d43ac3f68d16193
SHA1 975c7535630279fea3754e4d5c30c18b05941213
SHA512 cc7bbfb88687d26b3ecc8ff4534a28f2905e1366c7d904e9bfe8a2d6c97f7d8c60f0874a9fd09062c1e428db0b201aeec84e564fa68f95bcb9a31e67a520380e
SSDEEP 3072:fFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecaupjhfc.exe

Path C:\Temp\i_hecaupjhfc.exe
Size 376KB
SHA256 ce7b20ef9a50e115a7269fd741dd2090b83f170c396a4fc054a7afd985c4cd2a
MD5 1b110a577a00232b6bcd622240310af0
SHA1 253371db12e796a19dc4364d5a4a4450f3bb338a
SHA512 7e47334803d9c4ce3d4f9afc257e434b440c2798a1baaf3344a97b44334d69e0faf9d3dbb83fe2b1f909112ebe6df3f87b62719b0f341859dc32aa3c4fd011e7
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 376KB
SHA256 959eb149f2016313e5f36864cecfc5ab6411576517d26972fafe28e9a5aada7f
MD5 7ae033fa0e9d298104ab3ba2d011514b
SHA1 ff86d842cb48c007c2234da72bc012af0e4d1989
SHA512 e495bfa98bfcc3df9fe01c287a4fa8ffbbe87b9bff24f4fb8a56926c51c477b192b7f3cd50b9b7e59cb237b52b50f2875d80f6cc094a2a887e5d1a9cf52fe6b3
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojgebwuom.exe

Path C:\Temp\i_rojgebwuom.exe
Size 376KB
SHA256 4111d848d2c4fa6706052c9ffec25afc56d0410ff2654d53cfe9b08e7bab43e0
MD5 aabb3f98fefe4ce4142cf5d1d60d0428
SHA1 31584c6f7ead7096cdc8a781e18aed5fdeb31556
SHA512 24e0d577fc8ad1405f933c301be2529f3646bafb6e8adf1043f1cec9c60c0b10e0bbc4c5e119c1c78d4c168626c700522d85cb38c3aec8487dc3ea4d1591e19f
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwuo.exe

Path C:\Temp\i_zurmkecwuo.exe
Size 376KB
SHA256 7b4c1d94b246b10830f96c9d9fb622657eb2ecbf313267b6b4f122440ff2aa56
MD5 776570a34a1095e7f017898c14136df4
SHA1 3ef647e7f8fa5bd044c163ffcc8b6299ab4c2dde
SHA512 88fb9261ff2a6999946e87d7a8eb3c3070d9c2cc3f79e55296470af9dccc6844e01a47f2d21d0bf3a6af369dc214f600e245c6fe13596147bf54b3c85076aab4
SSDEEP 3072:NFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaywtnljg.sys

Path C:\Temp\igaywtnljg.sys
Size 293KB
SHA256 380d5bc855b406b46f862344c43212af3943aecd686b7f321db0f0179c560e2c
MD5 141f606a2953dc65e0de849adb43f360
SHA1 ff3ff9777b82dbd1d2e9174ed74ea1083d783388
SHA512 c2a2ee75a46a7a2a1f82616c2dc141125920029d54d3c9e18b08e33b18179b1237141c694b59f703267df1b9bd917148dea6b3c86e34bb55761d1453a2d72dc0
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdaywqolg.exe

Path C:\Temp\ljdaywqolg.exe
Size 376KB
SHA256 d112827308170ea583da5d860309538b9fd6d6df926520e3870ed744f1b14086
MD5 5e5b4de5e2ee10a32ebd10b8e98e5e01
SHA1 6b9c33bd5191db17b05e2c9f8c841bd992b1a86a
SHA512 d81afded71f5f74267639daa2c2cfdb7a06e3d6500a5c6801a3e5bd507f45ac1e117bd6303977e18b357146f6a27665564a6fe27056406fe7c7916a5aa23cc3c
SSDEEP 3072:TFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 376KB
SHA256 f0d6b11ac3823384762c9f6ea979d6f92fd1faf35f06d0c2b40c03653ce767b2
MD5 fb7a97b53f5194d5f928023fda108dac
SHA1 d2a73cabfab2b69e56c83894869594e7e2a38e4b
SHA512 4adc7b8e5deaa02a85fd4ccc9c9d909e81a085d63c7d69cc3bc6598e8334a87a31f3b71489be342bf39daafe5ad8a436ec63b7d97eea3076af482d64e66d9b21
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T151847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebwtrom.sys

Path C:\Temp\omjebwtrom.sys
Size 293KB
SHA256 88fa3ac534b73e49ed9520dfcd3f41e92cc931d363a4a875bbce6a89827a0de3
MD5 2c3a9954c12932cd60e6a4363e66ac8a
SHA1 bf747149c1a0f523c853b504380f53283ea340bf
SHA512 348fdc4b56f109bf27bb161b3141442213fde14a50467bd227793f8f1ea640e4cd3953bbbd8c6e1fb28c58e7912f40de22347f14a28616deb889b1c30761d871
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfcxupmk.sys

Path C:\Temp\pjhfcxupmk.sys
Size 293KB
SHA256 668ef794b1e1fb403727193565f871ab87eb811e1c1463dc38b9dda0fa6efdda
MD5 74b67bbf190b5a0e5d024d154a784805
SHA1 688337287760576a2044089b6f64b0119759bd5c
SHA512 d706d2b9954e3afe8131d6823646e9929c131c0d63cb162ccdd156cbd366f6057a53cfe7255332bd9a504fb7a577fb4cd14cf2ab059b730e3c623e763851907f
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgebwuom.exe

Path C:\Temp\rojgebwuom.exe
Size 376KB
SHA256 24ba3f37c2e9ee375c79091262ea28f9b10212e2b4d294ebbb3c1a182dd6d098
MD5 a237d3c9398b82f8f14da4822d76e18e
SHA1 2a3b3c5c55c6a4e30577ccf3a44a8cd6eef1dec9
SHA512 12c136ac8eea5194bfabe88adc4057f18dc6aa0b5334c9286f0225ca1cd61f818e0ea64775f14f5bcbac5a77d68b0e0c1535bf2510c6c3f70bf387d8a9dfd288
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkicauspkhfaxs.exe

Path C:\Temp\usqkicauspkhfaxs.exe
Size 376KB
SHA256 df8d281132a381771f4b43dc2eaea2d25a42611ce7c2a153dcd9552c2e1bced8
MD5 14e4a155c38006f928947a8703a5af0d
SHA1 67f797d1a64f36afcdf9836ec624379aee3b3a5f
SHA512 815f151c0761c91b13de5fe457a0efc85bcea829fb955d1df596dbec7002edf5d6d8751ca1bebe7cd4a1410ba821666effa7c0247ed70fafa402644a4c6e6ed4
SSDEEP 3072:pFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkicauspkhfaxs.sys

Path C:\Temp\usqkicauspkhfaxs.sys
Size 293KB
SHA256 5b86175bce90fed5c8d7f1bbc07ebef0ba2317db7882ced904d3157c555bcc0e
MD5 7ed6890f36ee0c7f2a66231d7bf983eb
SHA1 97f88a65561e48a0b5263973c919b78d6a9bbac8
SHA512 bdb787b79ebc7ea690ba81aa6be302b6b110461b39f2e73ecb1f75b5b35176f6733ffca58898edbe842064d592e8dc7a68e1ea625954a60098e2f43d724e7e90
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurmjecwuo.sys

Path C:\Temp\wurmjecwuo.sys
Size 293KB
SHA256 18343dbf9bb56ecd0f165897cfadd7b2aef1026d8dce7f57fcdb4c2eb2f1842c
MD5 2e0337075276eb9ab14cbf4c3c9208f0
SHA1 eeed59a7e2530f36e6d23b725fcc50029a07e26b
SHA512 1fdc5f7d7a9a99027e9d3ec85ea681c40fc6a627585bfb4460515c375dcb373c3e60ecc0920bfb870beadf5c7b2782dc8ef2bf0b514c5b93431ed6b90c671535
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtomgeywq.sys

Path C:\Temp\ywtomgeywq.sys
Size 293KB
SHA256 281c0962deb8e35c73152dabaceef6285123b93753038050ed63f6276e0b2b37
MD5 0f737ed4ba873ef8ced419c4d4551da4
SHA1 026ba479bee80ed81e3db399a473a6c073fbad95
SHA512 f2f0c8bb4ff2583e4ebdffcb3593b27488c626ee6e7462800c377ac22050d96c8b1066bf51a8305ec54af41d2d401259ac6dba79303c93ff0f5478e79ec8eb24
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T16E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuo.exe

Path C:\Temp\zurmkecwuo.exe
Size 376KB
SHA256 bb23131fcbd7fe1ce96345d3bfdea4155b6c74aee55442cfaf317b51faec2999
MD5 a88614e4805b1671e31438bad90d1717
SHA1 3beac0a0bcadd9f987e82808762a7442b7dcc920
SHA512 add4aa25a0073edfce0ac37ecae42e77d77bd030d4d14153df832e9297e0f96461f26542f6701107d525c3c52a74d61a34d4a1b53cbf96a47f04e3221b9613fc
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8da4ad581aa3546f0e6d62bdf79f2fb09c1dae0fbc6f4089c86b2c8e3d121fa8
MD5 3184d86e452244466cef3a2bd2cf298d
SHA1 ad3c5298d7bc1bdcb47186eeb6f92cedcf7fe57e
SHA512 e0a7321924bf06dde6dd6d29b9164f0136778c99b067d807b378473f61c82e788154c5ca225d91c240e8ac5502fd9dba3f8c0f607bb00e1421a7c1c0839a81d1
TLSH
T13B51CD97432379C3D77AA5B225E30C96BEBC848E05CFAFDF4811B1768A4B3946050631
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3d78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3d78.TMP
Size 2KB
SHA256 0d4d9262cba85b391cc8ab891cdd4d2bd88e93778e9943098a5dce565e9dfdd8
MD5 d040285621b4b5ebc6cd213c2d1ec539
SHA1 02f9da5b801f3fbe4a4ab4ffb873f0f59a681d30
SHA512 9a877c213679e5f9f42b1a4c920b2264fd624d7a2a8d7e887afbb514584062ebbdd9621611ce0af69e2538dd19394820bbc6303cb87e565baf8a737764dbb8df
TLSH
T17B51CD97472379C3D77AA5B225E30C9ABEBC848E05CFAFDF4811B1768E4B3946050631
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ba6004b86e10011a74351cb8b10f6d8e9f36083d5ac621111cf5b401d3706d69
MD5 6c35d01049d90c30336f562d3bad929e
SHA1 84b376956df61ae6be48627f654c58b85284115e
SHA512 b47cce651c7371ed903639e3b980bd7b2b5bafc4e2b6442a164dc7352e20b205e7b9162919f22e61864580e6cf9154643cef179edd5fe5a71cd5d4274df07f83
TLSH
T13A41ABF383F4856E8A0196F0AA146E1BCE2D0911832C7D5AC9E0AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cba1752e4708af5f2c6c844059015cefba6e906bd26220de9cbe41054b78b0f4
MD5 0f8d92f9bafa00ea8e0ff8aeebbcace3
SHA1 914982cc1cd68e671fbf01d7e7d8edc35b354c0b
SHA512 b1d7f7540a4902e373f077792d22809116cd0a7dbab6ec71aaca9e69c4838c506affe087232e425a7db9295a68e279d0ca5108fcc0c9c9dc48cfdf0b714cb212
SSDEEP 192:sxRRRTCH/fBsqS0Z+gEzzoA8p96/g6+WNCFq/YoWrCYdGsIgVKJ:sxRRkH/fBsqSKsio/5j/XY0
TLSH
T12142B8166E28A93B4CC7E21DBA55BF53D7F91032A1D06E48AAFC8A0C14E66DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a79455b1ae9b5dee444a2b09a8527bff63bd2c303ea2357c7dbb1be07c187cc6
MD5 820ad9363744bf0aa4dc2d0ba159a3f4
SHA1 5468de7ce0ac35326293b8795245c38529c0bf8d
SHA512 fb23e4327f4f606ea63e34c15531ed11a1b3b367d46d993d46b7b34de3f611186d50a6d1d17d1779c065fb425432cdb4ede2b139cfc5ceec47ec1ccc598d3bfa
SSDEEP 192:sxRyRTCH/fBsoS0Z+gEzzoA8p96/g6+WNCFq/YoWrCYdGsIgDdKJ:sxRykH/fBsoSKsio/5j/XYo
TLSH
T1A642B8166E28AD7B4CC7E21DFA55BF53D7F91032A1D12E48AAFC8A0C14E66DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7b181093f5067e8fd541ef0fec8920960bf73201951f5c3cc6e217d7a75ea63e
MD5 f0f11bfb0f177bb45654067cd3f67656
SHA1 4164fe9c9de8f78ae6290568904dc4745d597edd
SHA512 5d8dc02c24db9063031300eb95d4d883c01b08a73db642636bfd643fe75c6320cacbf654010536d869b1b6279d8c3c085423d24f3c4c15c1a33dcdd9224b2161
SSDEEP 192:sxRyRTCH/fBso70Z+gEzzoA8p96/g6+WNCFq/YoLzCYdGsIgDHKJ:sxRykH/fBso7Ksio/5j/iYi
TLSH
T13742B8156E286D7B5CC7E20DBA55BF53D3F91032A1952E48AAFCCA0C14E76CD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d4cf538c868f4b0839551249c694a77a2d56d1044299f9d208e2fc6f1659b2c5
MD5 50345c430f964bf95f884cc066be5f35
SHA1 49ee782ad75fa30edaa1e123bcd1dbedd77e799f
SHA512 9666ab90880801ea31d1af628802de8ae20aea79a10b9b8d8f7180d110f987ef6334353b41f3d78479d210233a19b8291f3032d8f401158970206a032a439cc6
SSDEEP 768:j26HEo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVbkyBVuwKro9Aea:j26HEUE7MRWgs2f02u1jakjB4whXw
TLSH
T16DD2DB7B640DCABF4F800ADDDC19BE9F6D6802CB9698CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fc2bae9-0aa1-4d50-82f1-bfaaf104d676.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6fc2bae9-0aa1-4d50-82f1-bfaaf104d676.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c80638c3ebe684950067cce6873c71bdde73243ca93b673c2824d8cfe7a05138
MD5 cace3c5bf05f4964aee9857c766d168a
SHA1 ba56d37772b095b7d2c43a2cf0c1786b056d900c
SHA512 5088f1fe1bc0f8b833d3e67ac34c1408925eb036dbd6e5e2cc059adf94286a9aa5ff5139582222199a9618269243a4e3af30e3a01957caa5c99e55321796ba06
SSDEEP 768:hrv+4UNbdz3O7+/TBOW39ONXyer1IRCzniB7eVH1SK7:hbsbV3DnSIqnIEH1l
TLSH
T12703BF32A4A89E338DE2A3C5B14776137FF86057D6840B90EDDE2F4E069B59D130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f8beafec6ca36509e55787e4f4ede34c7189623b234c53bedb0219aa2c34e8a2
MD5 b33aece41e409bc675b14d1be4de2882
SHA1 a52d462ef312e931838ec0cd9ed9e015dde6874b
SHA512 a1b4197437444d6569ad0c620c9f2b0726bfd310d524282549caa62a57bc1d38aab78535d23ffc6553940e8c25e891e2253dbc0e697883d8db3c231fab752c6c
SSDEEP 768:7rv+4UNbdz3LR+/TBOW3v9/ONXyer1IRCzniwZeVH1SK7:7bsbV3IP/SIqn9EH1l
TLSH
T13203BF31A0A8DE334DE6B395B14BB2437FB82067D9800B90EDDA1F4D069759E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 481e0455e7e6b6591dafa371f087e68c2867308942f84ed0b60c847ff2b64321
MD5 c3f19cb9e383de8b4873461292242fa3
SHA1 a6bd5340cfd4f1b4b868339ec86db8cbe10d2f18
SHA512 cda7d6fa1407ef6c5662b10d811b7700b542927f88451f9d7d35d6271140165700f0c2afd5325bba09d29d882478e904abb5963ea40acb0b91499cd92f688d05
SSDEEP 768:grv+4UNbdK3ERM/TBOW3v9zONXyer1IRCzni9ZfUuM:gbsbg3VPzSIqnOfUr
TLSH
T16C03BF30E868AD234CE6F2D5B10B6753BFB8206798C50B50EED95F9D058B59E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 525fa5d5ace6a87fbee0fd34683bc6582638a69e8a58f9eeda25853de3c09468
MD5 d05dbe77d7dee764d37b6c0b6e1b7814
SHA1 3e01e9f4b3ebc29ec8814feb78a10637cb219034
SHA512 9cb1796395927369bb14520f68a1d50f2dd8e7f6597734087f271c1b6ed49a0e70277b435c6bf72238e3565dd4e90826e48777468ba3721b1a00c51b91b0014c
SSDEEP 768:krv+4UNbdK3iRM/TBOW3v94ONXyer1IRCzni9ZMMO:kbsbg3PP4SIqnOa
TLSH
T1F303BE31E868AE334CE6B295B14B67437FB8216798C00B90EEEA5F4D058755E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 00798e596c1b4a269967c25bf0cf8c12352bf2900e9327ba17c13206d71735fb
MD5 c2e71d8df21813dc5819c6df16ddd3bc
SHA1 e9babbd93a7e4dd937d7e875b1934da4259e9e63
SHA512 fc1176f40906387a860f793ed8d881c2a22e78b72c769ec8d34208b0199f98c1e4c9446259f3b6b5f38d6ecd5c0aa8b99355dee71e33fa5ac4ecd0e328be73fa
SSDEEP 768:FF0rv+4UNbd33JwguR/psOW3v9cONXyer1IRCzni9ZfUuM:Ibsb530EcSIqnOfUr
TLSH
T12D233AF594D79937C89E9387A33E6E42AEBCD053B5844990BBC55E4CCC864BFD30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir860_1725947579\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 de5bf827025e9d5762d4cdea3a5c283df37b1d07d9547cc8e3c1ca0124cb65d3
MD5 7598dc860f0b090c514425810f58063e
SHA1 5b1fcf1435923654b9cb7eb1cfc39650ea53db6b
SHA512 f73150e991809e24129b2a00e42274e6adf9e7e8e8a369b68aab31614529554abbded9cde3be3c5e06bf8e291568dee9a53b81d27c5ff2806c7bd52f87b6c06e
TLSH
T14971238357ADCAF3C1DA5BF102835748F5FB227C072330204B525986AB34B3A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1092-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1224-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2188-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2188-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2400-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2648-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3092-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3388-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4216-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4692-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5308-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5640-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6032-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6032-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download