systex | 8ee4f7955c16e309fbd033cce683505ca8c97e447b1b90f6fcf2e902febe76d1

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260820-bf16macp6w
SHA256 8ee4f7955c16e309fbd033cce683505ca8c97e447b1b90f6fcf2e902febe76d1
MD5 a90f04190974dd117986d75f33abe0f7
SHA1 d5bdb8421346ccb4e5a25b9256ebde54089f9233
SHA512 26ab58930dbe08b064030c936a4e08f3e4f2fa99391add314475813b182d1d83a70f112be94a3404a6ab0476960b17bf80bc49588859bfedad611b1a6698426f
SSDEEP 6144:dflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:dflfAsiVGjSGecvX
TLSH
T1CF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5680	axsqkhczxvsnkica.exe
2436	axsqkhczxvsnkica.sys
4388	CreateProcess.exe
4592	cxupmkeczu.exe
3124	CreateProcess.exe
2056	CreateProcess.exe
4492	i_cxupmkeczu.exe
1052	xupnhfzxrp.sys
924	CreateProcess.exe
960	upmheuomhe.exe
4832	CreateProcess.exe
4596	CreateProcess.exe
2412	i_upmheuomhe.exe
3960	wuomgebztr.sys
4252	CreateProcess.exe
4880	urojhbztrp.exe
4064	CreateProcess.exe
2260	CreateProcess.exe
6020	i_urojhbztrp.exe
2684	mgeywrojgb.sys
1720	CreateProcess.exe
3416	jhbwtomgey.exe
2000	CreateProcess.exe
3188	CreateProcess.exe
3120	i_jhbwtomgey.exe
3816	toljytqolg.sys
4872	CreateProcess.exe
3060	gdywtrljdb.exe
1600	CreateProcess.exe
1252	CreateProcess.exe
1896	i_gdywtrljdb.exe
1756	lgdywqoiga.sys
3328	CreateProcess.exe
5224	igaykigays.exe
5632	CreateProcess.exe
5328	CreateProcess.exe
6020	i_igaykigays.exe
2020	idavtnlfdy.sys
1452	CreateProcess.exe
1700	ayvqnliday.exe
5092	CreateProcess.exe
4336	CreateProcess.exe
5820	i_ayvqnliday.exe
5108	xvsnlfdxvp.sys
3344	CreateProcess.exe
4760	xvpnhfaxsp.exe
5432	CreateProcess.exe
3736	CreateProcess.exe
1808	i_xvpnhfaxsp.exe
4488	xvsnkicspk.sys
2716	CreateProcess.exe
4016	mkfzxvpnhf.exe
5164	CreateProcess.exe
4896	CreateProcess.exe
5712	i_mkfzxvpnhf.exe
5900	hecxupnhfz.sys
4328	CreateProcess.exe
4084	caukecxupm.exe
3676	CreateProcess.exe
5024	CreateProcess.exe
2564	i_caukecxupm.exe
5692	zusmkecwur.sys
2308	CreateProcess.exe
2196	wuomhezxrp.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1259525750\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1090851131\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1090851131\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1090851131\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1045827101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_171225602\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_171225602\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1259525750\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2904_1090851131\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfzxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caukecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaykigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caukecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_auspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmheuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnliday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfzxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqgayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkhczxvsnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmheuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urojhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaykigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqgayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urojhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnliday.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2376	ipconfig.exe
4520	ipconfig.exe
1272	ipconfig.exe
5360	ipconfig.exe
352	ipconfig.exe
4868	ipconfig.exe
3224	ipconfig.exe
2696	ipconfig.exe
2196	ipconfig.exe
1536	ipconfig.exe
2704	ipconfig.exe
4140	ipconfig.exe
4696	ipconfig.exe
6064	ipconfig.exe
5296	ipconfig.exe
4468	ipconfig.exe
700	ipconfig.exe
1892	ipconfig.exe
3040	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316615713928257"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{26E5FD53-1EEB-4D9A-A039-9AC6C7A2E44D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe
5680	axsqkhczxvsnkica.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	i_cxupmkeczu.exe
Token: SeDebugPrivilege	2412	i_upmheuomhe.exe
Token: SeDebugPrivilege	6020	i_urojhbztrp.exe
Token: SeDebugPrivilege	3120	i_jhbwtomgey.exe
Token: SeDebugPrivilege	1896	i_gdywtrljdb.exe
Token: SeDebugPrivilege	6020	i_igaykigays.exe
Token: SeDebugPrivilege	5820	i_ayvqnliday.exe
Token: SeDebugPrivilege	1808	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	5712	i_mkfzxvpnhf.exe
Token: SeDebugPrivilege	2564	i_caukecxupm.exe
Token: SeDebugPrivilege	5108	i_wuomhezxrp.exe
Token: SeDebugPrivilege	4488	i_ljebwtomge.exe
Token: SeDebugPrivilege	3792	i_geywqojgby.exe
Token: SeDebugPrivilege	4344	i_lgeywqgayw.exe
Token: SeDebugPrivilege	5464	i_idavsqoiga.exe
Token: SeDebugPrivilege	6056	i_davsqkifay.exe
Token: SeDebugPrivilege	2600	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	3260	i_auspkhcaus.exe
Token: SeDebugPrivilege	3048	i_wupmhfzxrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5680	4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4340 wrote to memory of 4788	4340	2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4788 wrote to memory of 2904	4788	iexplore.exe	90
PID 2904 wrote to memory of 1140	2904	msedge.exe	91
PID 2904 wrote to memory of 696	2904	msedge.exe	92
PID 2904 wrote to memory of 3864	2904	msedge.exe	94
PID 2904 wrote to memory of 696	2904	msedge.exe	92
PID 2904 wrote to memory of 696	2904	msedge.exe	92
PID 2904 wrote to memory of 3400	2904	msedge.exe	95
PID 2904 wrote to memory of 3400	2904	msedge.exe	95
PID 2904 wrote to memory of 4044	2904	msedge.exe	96
PID 2904 wrote to memory of 6004	2904	msedge.exe	97
PID 2904 wrote to memory of 4044	2904	msedge.exe	96
PID 2904 wrote to memory of 4044	2904	msedge.exe	96
PID 2904 wrote to memory of 6004	2904	msedge.exe	97
PID 2904 wrote to memory of 6004	2904	msedge.exe	97
PID 2904 wrote to memory of 3476	2904	msedge.exe	98
PID 2904 wrote to memory of 3476	2904	msedge.exe	98
PID 2904 wrote to memory of 3476	2904	msedge.exe	98
PID 2904 wrote to memory of 6092	2904	msedge.exe	99
PID 2904 wrote to memory of 6092	2904	msedge.exe	99
PID 2904 wrote to memory of 6092	2904	msedge.exe	99
PID 2904 wrote to memory of 4612	2904	msedge.exe	100
PID 2904 wrote to memory of 4612	2904	msedge.exe	100
PID 2904 wrote to memory of 200	2904	msedge.exe	104
PID 2904 wrote to memory of 4140	2904	msedge.exe	105
PID 2904 wrote to memory of 200	2904	msedge.exe	104
PID 2904 wrote to memory of 4140	2904	msedge.exe	105
PID 5680 wrote to memory of 4388	5680	axsqkhczxvsnkica.exe	106
PID 2904 wrote to memory of 3532	2904	msedge.exe	109
PID 4592 wrote to memory of 3124	4592	cxupmkeczu.exe	111
PID 2904 wrote to memory of 5900	2904	msedge.exe	114
PID 2904 wrote to memory of 5900	2904	msedge.exe	114
PID 2904 wrote to memory of 1720	2904	msedge.exe	117
PID 2904 wrote to memory of 1720	2904	msedge.exe	117
PID 5680 wrote to memory of 2056	5680	axsqkhczxvsnkica.exe	119
PID 5680 wrote to memory of 924	5680	axsqkhczxvsnkica.exe	123
PID 960 wrote to memory of 4832	960	upmheuomhe.exe	125
PID 5680 wrote to memory of 4596	5680	axsqkhczxvsnkica.exe	128
PID 5680 wrote to memory of 4252	5680	axsqkhczxvsnkica.exe	132
PID 4880 wrote to memory of 4064	4880	urojhbztrp.exe	134
PID 5680 wrote to memory of 2260	5680	axsqkhczxvsnkica.exe	137
PID 5680 wrote to memory of 1720	5680	axsqkhczxvsnkica.exe	142
PID 3416 wrote to memory of 2000	3416	jhbwtomgey.exe	144
PID 5680 wrote to memory of 3188	5680	axsqkhczxvsnkica.exe	147
PID 2904 wrote to memory of 256	2904	msedge.exe	149
PID 2904 wrote to memory of 3692	2904	msedge.exe	150
PID 2904 wrote to memory of 1052	2904	msedge.exe	151
PID 5680 wrote to memory of 4872	5680	axsqkhczxvsnkica.exe	154
PID 3060 wrote to memory of 1600	3060	gdywtrljdb.exe	156
PID 5680 wrote to memory of 1252	5680	axsqkhczxvsnkica.exe	159
PID 5680 wrote to memory of 3328	5680	axsqkhczxvsnkica.exe	163
PID 5224 wrote to memory of 5632	5224	igaykigays.exe	165
PID 5680 wrote to memory of 5328	5680	axsqkhczxvsnkica.exe	168
PID 5680 wrote to memory of 1452	5680	axsqkhczxvsnkica.exe	172
PID 1700 wrote to memory of 5092	1700	ayvqnliday.exe	174
PID 5680 wrote to memory of 4336	5680	axsqkhczxvsnkica.exe	177
PID 5680 wrote to memory of 3344	5680	axsqkhczxvsnkica.exe	181
PID 4760 wrote to memory of 5432	4760	xvpnhfaxsp.exe	183
PID 5680 wrote to memory of 3736	5680	axsqkhczxvsnkica.exe	186
PID 2904 wrote to memory of 4492	2904	msedge.exe	188
PID 2904 wrote to memory of 4492	2904	msedge.exe	188
PID 5680 wrote to memory of 2716	5680	axsqkhczxvsnkica.exe	194
PID 4016 wrote to memory of 5164	4016	mkfzxvpnhf.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a90f04190974dd117986d75f33abe0f7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Temp\axsqkhczxvsnkica.exe
  C:\Temp\axsqkhczxvsnkica.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupmkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\Temp\cxupmkeczu.exe
      C:\Temp\cxupmkeczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupmkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2056
  - - C:\Temp\i_cxupmkeczu.exe
      C:\Temp\i_cxupmkeczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmheuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:924
  - - C:\Temp\upmheuomhe.exe
      C:\Temp\upmheuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmheuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\i_upmheuomhe.exe
      C:\Temp\i_upmheuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urojhbztrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4252
  - - C:\Temp\urojhbztrp.exe
      C:\Temp\urojhbztrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urojhbztrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2260
  - - C:\Temp\i_urojhbztrp.exe
      C:\Temp\i_urojhbztrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\jhbwtomgey.exe
      C:\Temp\jhbwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3188
  - - C:\Temp\i_jhbwtomgey.exe
      C:\Temp\i_jhbwtomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywtrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Temp\gdywtrljdb.exe
      C:\Temp\gdywtrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywtrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1252
  - - C:\Temp\i_gdywtrljdb.exe
      C:\Temp\i_gdywtrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaykigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\igaykigays.exe
      C:\Temp\igaykigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaykigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5328
  - - C:\Temp\i_igaykigays.exe
      C:\Temp\i_igaykigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnliday.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1452
  - - C:\Temp\ayvqnliday.exe
      C:\Temp\ayvqnliday.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnliday.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4336
  - - C:\Temp\i_ayvqnliday.exe
      C:\Temp\i_ayvqnliday.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\xvpnhfaxsp.exe
      C:\Temp\xvpnhfaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3736
  - - C:\Temp\i_xvpnhfaxsp.exe
      C:\Temp\i_xvpnhfaxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkfzxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\mkfzxvpnhf.exe
      C:\Temp\mkfzxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkfzxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\i_mkfzxvpnhf.exe
      C:\Temp\i_mkfzxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caukecxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\caukecxupm.exe
      C:\Temp\caukecxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caukecxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\i_caukecxupm.exe
      C:\Temp\i_caukecxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2308
  - - C:\Temp\wuomhezxrp.exe
      C:\Temp\wuomhezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    PID:4160
  - - C:\Temp\i_wuomhezxrp.exe
      C:\Temp\i_wuomhezxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwtomge.exe ups_run
    3⤵
    PID:2400
  - - C:\Temp\ljebwtomge.exe
      C:\Temp\ljebwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwtomge.exe ups_ins
    3⤵
    PID:3204
  - - C:\Temp\i_ljebwtomge.exe
      C:\Temp\i_ljebwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgby.exe ups_run
    3⤵
    PID:2240
  - - C:\Temp\geywqojgby.exe
      C:\Temp\geywqojgby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    PID:5552
  - - C:\Temp\i_geywqojgby.exe
      C:\Temp\i_geywqojgby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqgayw.exe ups_run
    3⤵
    PID:5896
  - - C:\Temp\lgeywqgayw.exe
      C:\Temp\lgeywqgayw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqgayw.exe ups_ins
    3⤵
    PID:2188
  - - C:\Temp\i_lgeywqgayw.exe
      C:\Temp\i_lgeywqgayw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsqoiga.exe ups_run
    3⤵
    PID:1172
  - - C:\Temp\idavsqoiga.exe
      C:\Temp\idavsqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsqoiga.exe ups_ins
    3⤵
    PID:5296
  - - C:\Temp\i_idavsqoiga.exe
      C:\Temp\i_idavsqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsqkifay.exe ups_run
    3⤵
    PID:4308
  - - C:\Temp\davsqkifay.exe
      C:\Temp\davsqkifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsqkifay.exe ups_ins
    3⤵
    PID:4432
  - - C:\Temp\i_davsqkifay.exe
      C:\Temp\i_davsqkifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    PID:1368
  - - C:\Temp\ausmkfcxvp.exe
      C:\Temp\ausmkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    PID:4868
  - - C:\Temp\i_ausmkfcxvp.exe
      C:\Temp\i_ausmkfcxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\auspkhcaus.exe ups_run
    3⤵
    PID:5256
  - - C:\Temp\auspkhcaus.exe
      C:\Temp\auspkhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_auspkhcaus.exe ups_ins
    3⤵
    PID:2416
  - - C:\Temp\i_auspkhcaus.exe
      C:\Temp\i_auspkhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    PID:3404
  - - C:\Temp\wupmhfzxrp.exe
      C:\Temp\wupmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    PID:2544
  - - C:\Temp\i_wupmhfzxrp.exe
      C:\Temp\i_wupmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ff917d3c188,0x7ff917d3c194,0x7ff917d3c1a0
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,12444039805707976150,7029805070671556375,262144 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,15351844832203190045,1110599885904772795,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
      4⤵
      System Time Discovery
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,2141501302362446979,12800123424097401855,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,6242447821485377149,4453473080992644097,2097152 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,18169663025091873430,12111192276092434742,2097152 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5493079248901311248,10165809407167022320,2097152 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,17876387888394891095,18106120723194564183,2097152 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,1476781130981717529,7204405424991377475,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,13788816378738325075,16559075126374042158,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11931337438459010808,7452396394032237480,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13901648386427572109,17381413898704249912,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13901648386427572109,17381413898704249912,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6201665223642365237,1100744705008394792,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,5963540900679721654,17176998572639684172,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,16136266537798148315,11210707407971094393,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,4026047148246256272,9348212974184944423,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,2761296991341887018,11118770416540520370,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,10260311890243768154,11884925780255700613,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,15286275039991057593,16754783507650589387,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,6612547982153699221,16278885347917660958,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,14808282487254455765,1295423657255869124,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5020,i,2172829718979623909,16871755838420992053,262144 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:10
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3092,i,17215583642329391203,1344836785479007353,524288 --field-trial-handle=2344,i,10566561080126808651,6496805008041216722,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1272

C:\Temp\axsqkhczxvsnkica.sys
C:\Temp\axsqkhczxvsnkica.sys
1⤵
- Executes dropped EXE
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1944

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\wuomgebztr.sys
C:\Temp\wuomgebztr.sys
1⤵
- Executes dropped EXE
PID:3960

C:\Temp\mgeywrojgb.sys
C:\Temp\mgeywrojgb.sys
1⤵
- Executes dropped EXE
PID:2684

C:\Temp\toljytqolg.sys
C:\Temp\toljytqolg.sys
1⤵
- Executes dropped EXE
PID:3816

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
- Executes dropped EXE
PID:1756

C:\Temp\idavtnlfdy.sys
C:\Temp\idavtnlfdy.sys
1⤵
- Executes dropped EXE
PID:2020

C:\Temp\xvsnlfdxvp.sys
C:\Temp\xvsnlfdxvp.sys
1⤵
- Executes dropped EXE
PID:5108

C:\Temp\xvsnkicspk.sys
C:\Temp\xvsnkicspk.sys
1⤵
- Executes dropped EXE
PID:4488

C:\Temp\hecxupnhfz.sys
C:\Temp\hecxupnhfz.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\zusmkecwur.sys
C:\Temp\zusmkecwur.sys
1⤵
- Executes dropped EXE
PID:5692

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
PID:4472

C:\Temp\ztrljdbolg.sys
C:\Temp\ztrljdbolg.sys
1⤵
PID:4308

C:\Temp\jdbywqoigb.sys
C:\Temp\jdbywqoigb.sys
1⤵
PID:4156

C:\Temp\igaysqlida.sys
C:\Temp\igaysqlida.sys
1⤵
PID:4900

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
PID:1908

C:\Temp\kicausnkic.sys
C:\Temp\kicausnkic.sys
1⤵
PID:668

C:\Temp\ausmkhfcxu.sys
C:\Temp\ausmkhfcxu.sys
1⤵
PID:5108

C:\Temp\zxupmhfzxr.sys
C:\Temp\zxupmhfzxr.sys
1⤵
PID:3376

C:\Temp\pmhezwuomj.sys
C:\Temp\pmhezwuomj.sys
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axsqkhczxvsnkica.exe

Path C:\Temp\axsqkhczxvsnkica.exe
Size 361KB
SHA256 d750748e3f89b2799a38175735776de61b0cb79d83869501589826222a5d7941
MD5 0f866830b42ae9b93d8ca8018c2ba4fc
SHA1 1fb5dc7f4097ead33191539948c2c62e32d391bf
SHA512 a2f0a83d9e6c16bbe903780851923df3a112463343a554fc5554294c9ad4c0e20f59407ded22bcce2cf16319c48111b19accff0f32aa19a58615b7c72fe9855c
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T137747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkhczxvsnkica.sys

Path C:\Temp\axsqkhczxvsnkica.sys
Size 293KB
SHA256 5fa252344c4dce1fa61aff7269b44aa55c98806c805d654725fb9ac8dde3d17a
MD5 5b5aed63112619bed8a228621c92b394
SHA1 ffe28408fd59177c7868063c84594c3f53c7b587
SHA512 500327119e433a9620ff9c7b1ebb0a02bdc2bcaccfad69704d5a9b00ac90863f0112700ac8f3d2ee2f56786c098a53b7a4fc272013ebd33818f68f4aed18b846
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupmkeczu.exe

Path C:\Temp\cxupmkeczu.exe
Size 361KB
SHA256 4e193d269ea89816e4ddc8684ac6f1c4f82e0cebc5ae0aee0ac9203cca75c9eb
MD5 71b683cadc32601369b7de6b6441c130
SHA1 d86ed18b0a0386504275c69bab5b7974a4f37dab
SHA512 7070f075657824658914ad1224bead0d9653f4d2a565a3d94c8b1521b3ec2d5d04ca60fccee22c45e38a99a1c243d1840371e613c75f407e10486ad84971388f
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T188747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywtrljdb.exe

Path C:\Temp\gdywtrljdb.exe
Size 361KB
SHA256 425083c541aebc9c4d1b91ee0f61e41d9908bd42fff282cf06c34fc7b4f602b6
MD5 eec7972e90601be1342ed2bad78935f0
SHA1 52bc360bbd67d9a31382d3927e74901d1bc2b2a4
SHA512 a3571cfc12dbde92e8e49a791e032ffcc8eb49aa8ace347247967e958a7c5fdbd61c1cf176c4b491807b4df7a37ca0af04a1901688e7acd0095d4e3d30d8e3e0
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T174747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupmkeczu.exe

Path C:\Temp\i_cxupmkeczu.exe
Size 361KB
SHA256 d9ba40d0b418779d2be7c634bd52e306db718a932c4a57975340aed1ba613495
MD5 600959b2629ceef3165bbfadc59c34c2
SHA1 66f66ccc999958ffabe5ed5a23055ed509279d18
SHA512 a37846f5b764873f44e0be9db1d67b59042c4b9d2394805d1a99b2378b35ab3689b92123db482dafb55f51852beb89c02a7c7910f04934d4a216d65cebb88d3c
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T11C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdywtrljdb.exe

Path C:\Temp\i_gdywtrljdb.exe
Size 361KB
SHA256 b50a6dcc19165ae9bd79ed825e70f159170f18bb4c37e23144d0433b8ac4e1f0
MD5 dd08f62779d26421d4e4fd82b8f9eab6
SHA1 2064853fb5847a33ee67a90a281c364f4bc12122
SHA512 ec4685152a5fd40b470e4eaf2b3687322f5a4a9054dcd984d2ff68fe42d817a051c490f45b2f100a8a2de2ae87762a80cdaca13c5465f61b2f9377fc5a2bdfed
SSDEEP 6144:lflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:lflfAsiVGjSGecvX
TLSH
T107747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbwtomgey.exe

Path C:\Temp\i_jhbwtomgey.exe
Size 361KB
SHA256 ad243e673b6d86ef3696682070d9898a4a14d325c48e479e4484e7c0517c3ced
MD5 71a410aff7c291692cf46fafd06b5041
SHA1 0071c82243f45917d576181fd72a9b190bf8b813
SHA512 6a0455785a438eeb155bf2e84109f8def2c738f052f1aba11cfb4d168e931b54df01d3ad40b555c10c977bcf06d7a54e286c881098ebe328ff6b3f1c97532af4
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T114747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmheuomhe.exe

Path C:\Temp\i_upmheuomhe.exe
Size 361KB
SHA256 59d199b1c12b00d888363eef69e577d62f3e5747295c7cb67c47030d6288de93
MD5 0bfbfcf866209b17bfc1b408b901f684
SHA1 ccd8d2efd9af511780c47d8f022a7a9fd4db4d1f
SHA512 1ec9c15652d8f36a987417afb4001d6b1e7eb0111203d5e00ace80747953d62b18be642c34b6e515d88eef520266762f6d7f19fd0a27949be00176766cd6d58c
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1E2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urojhbztrp.exe

Path C:\Temp\i_urojhbztrp.exe
Size 361KB
SHA256 3e2215425f100dd972f033365247aeada3bbf38ff96e26aadd601ba2f8d2fbab
MD5 0dcd2c05fdb46e58794eb5fa14b4a4fa
SHA1 33b42c7829197c835de75c40467725bc2a779ab0
SHA512 9096a02076cd7ce6a4f549b56a4b403ef122828c7b5f532facf2e08550871e8d5b811f68fd297b5e7bf95e74e01fa4d4606071adbc6532d6688e67daae5c6d5c
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaykigays.exe

Path C:\Temp\igaykigays.exe
Size 361KB
SHA256 0943a55dde3ba9483e23eef1d76c498c94d4bf4e29a65b8f635bc6465b688e91
MD5 8fe1cfaa05a620a85dcb74af39875626
SHA1 6106a89005f1f08358f21d9ff0ccb1c0d9809498
SHA512 545bc222cc7367d9b41f5d479db4c9ddecf925466543c73f4cdc87b29380cd8cc840f8078337a6e3d027f788e5e4d11129f7bc94980eea0b409afe0c6cc8b674
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T11B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbwtomgey.exe

Path C:\Temp\jhbwtomgey.exe
Size 361KB
SHA256 ceedf40f33b65f0580a5256f3c9de815308e3a1cb5f7041238f94bae221fc1a8
MD5 ae737808caac9e00bb061fdf9f68055e
SHA1 85dd42661e5ca0b6a630f5d866019fcc4b80957e
SHA512 7980d70666d91750721ea9eaf5e13cc6154f9bca300b023d79b898245b1ea4d148f75f62d6428e8715eb6420f156384ad28f5dfc1a15ba3b89347fc8d1f5eee3
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T195747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.sys

Path C:\Temp\lgdywqoiga.sys
Size 293KB
SHA256 a54c94da396f404f08588f790e4a52a4a4fd455dd4658e685d28e8f81812fe58
MD5 95f47967a4f76db23033622800ff6581
SHA1 3a98c033d8dbfac80f45526e0d8a47a4b934d37a
SHA512 53675ac40f98af3bebaf645f9a202bfe483c95147260399ba2469417bef493a652002bd115c3e8afaa1c036bf0b25cd1a5122348d0d7e3063587e5d01a00641e
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T166545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrojgb.sys

Path C:\Temp\mgeywrojgb.sys
Size 293KB
SHA256 ec4e59260f24c3e3e3ebb535c09854930544fe33b033ff59126732b982c1355c
MD5 278e4522d91005f02ec0c981283e7934
SHA1 8b20164440ae0d8f7cfad5a061932f242005ce2a
SHA512 8c01bd848e43c48cd8dc17ebcbaa870918d4ed11490e11f3fb348d906c3b18e060b29d814ca173c1682b275e5765ca0751d34ace39ded82fe419bc6bfb024b66
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljytqolg.sys

Path C:\Temp\toljytqolg.sys
Size 293KB
SHA256 05538b62044840c19136b39b58bf5fc280362260848ccf6847f1ac4d9eda30c0
MD5 03fb79aa8043aab99cf3a3ad6ced299f
SHA1 40d4733f1bd6d730c7edb37cb5639f2b934acf02
SHA512 6a791b8addb939c6a6b3b906fbf3d988bc738c318a520fb6a6f1857b36940e32a75653fb1f9009b3c152374cf724d03294be1abdd01e7323e28eaae30bc92a89
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmheuomhe.exe

Path C:\Temp\upmheuomhe.exe
Size 361KB
SHA256 e67f8291987418223b16302dade718383c42b424e6dd8f2727fc50504d229bf7
MD5 fe81645dd21ede7c007b5ce8e4d7ef6d
SHA1 7ab3c0e6ac5eba5d9a1e4a22c5d493ca83bb8354
SHA512 88bde20f9faaeb7742fa40b049518f21a9a16bec6ba8ce649a316836181dc1dea6173a41a4d99017fb040aaa3c9175d885f2c83ab1dc014637a35341e4a50a4c
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:eflfAsiVGjSGecvX
TLSH
T19C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urojhbztrp.exe

Path C:\Temp\urojhbztrp.exe
Size 361KB
SHA256 f81d722f05c8e677597cc0b23d61005d975b8fd5f7a34e18c3e96b0518ae1b13
MD5 1c78b03fb51b077ba2d966845e5cf2e9
SHA1 2d0ea5737b79b8b3789f75b868f5fd6fd289ab2a
SHA512 63c691d7f48b51fbd70c2c6d540274431bcc111703da246b0964c57f9ef7c4f3d29f5b5c24e28d30020a62dc4f9bc35725538079ae4f5f1c5915da749cf9354a
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T1DD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgebztr.sys

Path C:\Temp\wuomgebztr.sys
Size 293KB
SHA256 4385e5bb50f85c1621188f76b2417dce7e245040032745354cb52aeb4572a895
MD5 3ad2eb70013e77c48ac820043a88bbd9
SHA1 27f5230bbd6865d369019008eaffeec56ff630eb
SHA512 be8638151e8dd330c5c47bcfc21d24c8cdd184ce7e6a57b0653aef053e8c210e684df97f66baab3b8ddd4df8ac6ee056a7cffd4b5729bfe1ff01086940236e9f
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxrp.sys

Path C:\Temp\xupnhfzxrp.sys
Size 293KB
SHA256 e3d68e1ddb10b68252d2664d5c6b5837d2a8131ff672bf1649d829a879545cd8
MD5 4158b3ad37983ab4ad3b93edd5e78db0
SHA1 77d99498b14f1395a2ba2aad51fcafc21d5cfb80
SHA512 280c277d5049cadf61434e247e7f5692ec47e905de9fb2eaba8fb41608f9eed3f4376e269fa70b673237b40e1f8a39c5d955d4dc2245f050a08663c34ca5c158
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

6e877753-18a3-4d82-8fa0-a6e3ea32a7d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e877753-18a3-4d82-8fa0-a6e3ea32a7d6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d8ba3939cde0ba01d6886fd121df971078115a7542cc0bfcae5751bfb196d222
MD5 a75611e96e07a9cfd41b7c00d03ab5b2
SHA1 770f88fd9b8dba599dbd4ea3f111ea80a5cc51e8
SHA512 d366feae265f783f7b8dbf54fbf8244b9077022a6137f88df63c18bb8cb59a50a7c448de3a1a9bec815663f9072dcbf2ca7106e9e99db75a067fca40135a80ba
TLSH
T10D5182A4477B89C2DB2B97B10BF3858A32F5C5D64A076FDE4C4860F4F04EF5D9042151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a424a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a424a.TMP
Size 2KB
SHA256 14cc16ed912663952e5a7a632abd2da6ceb9c705db51e24fb6579c588a401b4d
MD5 ab51afff8207d27fabd7ae2199718ef1
SHA1 58b1e424404f9bcf7ec3ae7dec0b521e327f9467
SHA512 41bc946c673f7eeabb5b8cbf60d5b0d9d6102d08ffdb33f9936e3000c1410e5ef06e2c24dcbd075a43e3ba139b46b53abe0625d93be6486ab9318f9992588b37
TLSH
T1315171A4477B89C2DB2B97B10AF3818A32F5C5D64A075FDE4C4820F4F04EE5CA042151
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 217b2957f0e72c7f791aa0fce08a0681c9aee4e10e7151e9c94239a7241d6ec0
MD5 3eec6c06de2b420c5ee562c753fa97db
SHA1 b3dd7cc59731d5968fa21b02f801b4c112ff3970
SHA512 e12c81c8a3e6a0530d6f1cd654fdb3bedc3efdbd4f1d921267f8ab490a1dce3f0299843f5d60e0d3c5765ff9fde80e5d8dd1cb1cec1980b4fe6953302c7e9437
TLSH
T1E841DEF783F4856E890156F0AA14AE1FCE2D0915832C7D5AC9E0AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 21e004d06ea6183ef9de6eecabb0285508a451fa85d711ff9be08b7b95876fe9
MD5 45283f4da156792b3db780acb4f5a3f6
SHA1 930aa00dfaa54d1b7d93a8a4cacb667e5095d761
SHA512 d19e02bdff912541f1857773991a3c3f22c2554c34ff236672c56aae74153648df0aa74e825d6b900946bcea201eef2427ce1923687bdecc2774c1fa05aeec40
SSDEEP 192:sxR9R0pCA/fisrT0ZazzoA8p9R/g6+WNCeH/YoMDCYZGSIgV7J:sxR9LA/fisrTKaif/5f/1WP
TLSH
T11142D8556E28AD3B9CC7D21DFA15BF53D3F95432A0D06E48BAFC861C14E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 517cf3efa15b2ba82e8f185fc4b1e44ce6ad7080cf77fcfc232fc7a984ed4cef
MD5 678569bccf78544a53b8ec126a4160c6
SHA1 96eb3dad5e5405ceee9262d5e09360c41a2eafa4
SHA512 4906cf8369eb84c7621403229959e9a0a307e9a49aaf41cffeecaa3688d11991db8aeb112e8ac822d225333c957fcd7b6a84359a2d9f6e1dfab4dc3560dd2d78
SSDEEP 192:sxRuR0pCA/fisUHg0ZazzoA8p9R/g6+WNCeH/Yo3bCYZGSIgD57J:sxRuLA/fisUHgKaif/5f/+Wv
TLSH
T1E642D7556D28AD3B9CC7E219BB15BF53D3F95432A0D02E48BAFC861C10E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 146fa54e927a366025d76ed8122cf5669a8292ed301fe83311ffc533b4027c08
MD5 79a7c5da083952f677b6cd8e9d869fcd
SHA1 b6c20f6e6f16d3d1f21cfdafac468bdb3abddeb4
SHA512 f1cb74ee15c1db15b375a53768d5f6f9ee7488d41d94424499487a7f529e41ff233ce8cc1e2ba8fb17a66904bd02fa8217b854c455d06407101b6025a6c45d93
SSDEEP 192:sxRuR0pCA/fisUT0ZazzoA8p9R/g6+WNCeH/YoMDCYZGSIgDr7J:sxRuLA/fisUTKaif/5f/1Wd
TLSH
T1AB42D8556E28AD3B9CC7D21DFA15BF53D3F95432A0D02E48BAFC861C14E66DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8855bff1819c51d050330f87cd5dd4c34f4aeb52c20065c4ee24e44f4cb6abdb
MD5 b2fef091cbdbc5309aa1bbd608623bfe
SHA1 2fabc0c7d072a6273cee715f489e5609557820fe
SHA512 57cafd11087f6f62e5838b970137be551f96a368e92ceb9cd992ad88413b0e409c9876a070c94ee0731086fe38fd076de7a5932d359aa8e044be4f35abe299df
SSDEEP 768:j26HUo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVKmBVuw/ro9ee0b:j26HUUE7MRWgs2f02u1jatmB4wspg
TLSH
T110D2DB7B740DCABF4F804ADDEC197E9F6D6802CB9698CD8047FE941C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8786e69bc7e402f73a5204eff2e9c6ca704124333db8cd34dd283b64bf458f08
MD5 8a043014e949cb76273655d4cf16779e
SHA1 9f00daa389e37db7f109a3cfd38072c014ab0beb
SHA512 64ae46dcea756c6d088d27b2a497b6b965dee0126efd4f28cec4b1e58cfab25c98a6716ba3f027db63a798059d88cd02a100e6c200f30c5cd64208fb412b7a31
SSDEEP 768:+q3IpLX/TBOWSpuONXyer1IRCzni91e62KM:+q3Q5SIqn+ePKM
TLSH
T1FEF2BF30E8959D338CE6F396B50777866FF86077D8C49A90EDE9AB0D049366E130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c558d49727a8e22ff236077ccb74942ec48a9c6c1a7a418eca548e2d35846097
MD5 84f6529c8de0c084db8519e2e6032f18
SHA1 8db8cb72d37fff3f0ff22e9425a64e2f73829db8
SHA512 b993d584c2bcfee0a19276b03ec3a9001c1203d249d9faf3648d43ae238930066b0e2f37f5b3640fadef1e9fbbe03c69ca13ab3cd9cac2422bcb65f355532164
SSDEEP 768:hrv+4UNbdz3MF/TBOWTONXyer1IRCzniBHeVH1SK7:hbsbV3idSIqn0EH1l
TLSH
T17503BF32E4989E338CE2A3D6B04776437FB86057DA840790EDDE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d71392cccc51317b740107899f2d2797f0047672a1e281d853946753603332ea
MD5 bb15421b1679f02d797ac1a550805665
SHA1 c6f627f533f058020628b5dd6d9bc76f84b8751c
SHA512 b1489c04c8b2c24b828edff883749d73ddf4ee6e430626b0a70682ed6f79351ea2aed7cd6e116df460e3eed84629dadc6681c05892dc8342a639f5a257e21a6d
SSDEEP 768:6rv+4UNbdB3IpbX/TBOWSpdONXyer1IRCzni91e622:6bsb73isSIqn+eP2
TLSH
T1D803C030E459AE338CE6F295F10776837FB824A788C44B90EDE96B4D059756E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5568b9171944dd54e151ad19d1769081a6dfdd0b75089d78c514daf9d08f69ba
MD5 7be9c7f53da0e105257720dc411bef2a
SHA1 8011ad54d9731b792abab80a737574c0ee57b82f
SHA512 e9833de9857f54942167e7e5ecf65b4a51ede9b808464d3b3ece0f7aff72333257572db23a6f938691cce3a7e0d8e6e6c1d3e4d666a1271fffd3e858939e9117
SSDEEP 768:uFQe3DwgTpZIVsOWSpNONXyer1IRCzni91e62KM:Fe3uDSIqn+ePKM
TLSH
T141133AF594D79937D8AE9383A73D6E469EBCD063B4889980BBD55E0CCC8217FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d129d5e2804d34209a756fc61ff37d97345b0c01c86a53e5628a63aaac67b333
MD5 fe23812f870ef9ca370e20af6f9634b3
SHA1 7dfd7bd96dee75405a35168a7d40508100dba70e
SHA512 4ef802b56ecf5900263163d35568d9413e9654d39ff1cd37ecef333dfe4150cdbe48fa93ed7f0d8075e3078b189aacd90ab83e62e634c766bf135552a356545d
SSDEEP 768:frv+4UNbdz3sl/TBOWSpMONXyer1IRCzniw1eeVH1SK7:fbsbV363SIqnZeEH1l
TLSH
T1D703BF31E499DE334DE2A396B047B6837FF8206789800B90EDEA5F4E059759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9070e056ca497252e7d3559a79e5f9b432db039ba2e9e756745370b395812b4b
MD5 73058fa9ef5340a50a44bcfb2529cdf8
SHA1 0ebd9b757501f0432cfd9239edd6fe7ce58f70ab
SHA512 40387559db07817976ac671cb4b9d474b7d68d87437aa2da296d7e70db2967a4addbfa582320b5dc45757fa80dc6e5cbb5b4d4e86c299f2447b137fe7b2c074b
SSDEEP 768:uq3HpLX/TBOWSpuONXyer1IRCzni91e62KM:uq3B5SIqn+ePKM
TLSH
T184F2AF30E8959D338CE6F392B5077786AFF46477D8C49A90EDE9AB0D049366E130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

053c54c0-10f1-44bc-9987-bad4394701a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\053c54c0-10f1-44bc-9987-bad4394701a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2904_2132852527\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 64ec34dcc00f211d16314a5675f757fae074a8536ae4502c8e600735b18f64ed
MD5 76b462e8b5911c80dd6ab34aca7006a5
SHA1 78e8bca63f7af7099af8c0d555c65488606084ea
SHA512 e1375f01b551f94b28db55f620958daeaed70e6bf7e929713c650b1f2c6e892923a73b9a0330970316fcfcf96c26abe5bfe31e4b9bc5c788105cdf3f77545a82
TLSH
T17E71008366ADD9B2C2DA5BF002C35204F1BB62780B3330604B515587AB34A3A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/668-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1052-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1756-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1908-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1908-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2020-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2436-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2436-218-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3376-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3816-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3960-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3960-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4112-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4488-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5108-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5108-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5692-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download