systex | 58355a8d0db3105f9573df2045baf72c5759f6710b5da659c1bf8e05fb7ba27e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260820-m4d7jsvfnf
SHA256 58355a8d0db3105f9573df2045baf72c5759f6710b5da659c1bf8e05fb7ba27e
MD5 fd91c8f89444ff0a85e7e723140ad706
SHA1 380d9945bc08241a277f99a2be8e4bf284dda3bb
SHA512 bfd5a7ef51e9e688b0db0756b895e28f36facdaf6c5c30cfb564ca9441d5a1059702166fb034495540da756cfb21e98c243dd29085afb0cb6637af68a2f603a1
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4156	nicaxvpnhfcauspk.exe
4904	nicaxvpnhfcauspk.sys
1772	CreateProcess.exe
2620	uspkicausc.exe
2972	CreateProcess.exe
3420	CreateProcess.exe
2536	i_uspkicausc.exe
2828	rpmkeczusm.sys
3080	CreateProcess.exe
5272	usmkecwupn.exe
2372	CreateProcess.exe
3688	CreateProcess.exe
4968	i_usmkecwupn.exe
1756	hbzxuomhez.sys
5984	CreateProcess.exe
6108	ecwuomgecw.exe
4352	CreateProcess.exe
5360	CreateProcess.exe
2796	i_ecwuomgecw.exe
3944	ztrojhbzwt.sys
1416	CreateProcess.exe
5856	bztromgebw.exe
2056	CreateProcess.exe
5628	CreateProcess.exe
2600	i_bztromgebw.exe
1068	geywqojgbz.sys
1408	CreateProcess.exe
2516	qoigbytqoi.exe
5296	CreateProcess.exe
2236	CreateProcess.exe
4488	i_qoigbytqoi.exe
5724	ligeywqolg.sys
5336	CreateProcess.exe
5908	igeyvqolga.exe
4540	CreateProcess.exe
1084	CreateProcess.exe
3780	i_igeyvqolga.exe
2384	fdavtnlfdx.sys
4264	CreateProcess.exe
928	xvqnifaysq.exe
2004	CreateProcess.exe
2696	CreateProcess.exe
5884	i_xvqnifaysq.exe
4908	vsqkifaxvp.sys
2828	CreateProcess.exe
3652	ayspnifdav.exe
3392	CreateProcess.exe
2600	CreateProcess.exe
3344	i_ayspnifdav.exe
5888	kfcauspnhf.sys
4836	CreateProcess.exe
5724	xvpnhfaxsp.exe
4592	CreateProcess.exe
3004	CreateProcess.exe
3064	i_xvpnhfaxsp.exe
3240	czxspkhcau.sys
4852	CreateProcess.exe
5852	xupmhecaxr.exe
4768	CreateProcess.exe
4756	CreateProcess.exe
4172	i_xupmhecaxr.exe
5988	uomkeczxro.sys
1316	CreateProcess.exe
4868	urmjhfzxrp.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_694329140\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_694329140\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_694329140\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1351008739\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_423522930\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_423522930\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2119706584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2119706584\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_694329140\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztromgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayspnifdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicausc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeyvqolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbysqnifdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nicaxvpnhfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztromgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljeywuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayspnifdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeyvqolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhecaxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljeywuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeczxrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbysqnifdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhecaxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicausc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgecw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2000	ipconfig.exe
5008	ipconfig.exe
4912	ipconfig.exe
3960	ipconfig.exe
4904	ipconfig.exe
4384	ipconfig.exe
4040	ipconfig.exe
6008	ipconfig.exe
2460	ipconfig.exe
2704	ipconfig.exe
1360	ipconfig.exe
4892	ipconfig.exe
1292	ipconfig.exe
3860	ipconfig.exe
1968	ipconfig.exe
5612	ipconfig.exe
1304	ipconfig.exe
2028	ipconfig.exe
5068	ipconfig.exe
3368	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316972598672237"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{68135C21-A5B1-436B-AC34-4ABEE62D1B1B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe
4156	nicaxvpnhfcauspk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	i_uspkicausc.exe
Token: SeDebugPrivilege	4968	i_usmkecwupn.exe
Token: SeDebugPrivilege	2796	i_ecwuomgecw.exe
Token: SeDebugPrivilege	2600	i_bztromgebw.exe
Token: SeDebugPrivilege	4488	i_qoigbytqoi.exe
Token: SeDebugPrivilege	3780	i_igeyvqolga.exe
Token: SeDebugPrivilege	5884	i_xvqnifaysq.exe
Token: SeDebugPrivilege	3344	i_ayspnifdav.exe
Token: SeDebugPrivilege	3064	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	4172	i_xupmhecaxr.exe
Token: SeDebugPrivilege	3760	i_urmjhfzxrp.exe
Token: SeDebugPrivilege	4148	i_rljeywuomg.exe
Token: SeDebugPrivilege	2796	i_geywqoigdb.exe
Token: SeDebugPrivilege	4284	i_lgeywqoiga.exe
Token: SeDebugPrivilege	5464	i_dbysqnifdb.exe
Token: SeDebugPrivilege	3240	i_avsnlfdxvp.exe
Token: SeDebugPrivilege	1708	i_xvhfzxvpnk.exe
Token: SeDebugPrivilege	5236	i_smkicausmk.exe
Token: SeDebugPrivilege	5108	i_rpjhcxupmh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4156	4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4484 wrote to memory of 5792	4484	2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5792 wrote to memory of 1688	5792	iexplore.exe	90
PID 1688 wrote to memory of 4532	1688	msedge.exe	91
PID 1688 wrote to memory of 1800	1688	msedge.exe	93
PID 1688 wrote to memory of 5024	1688	msedge.exe	92
PID 1688 wrote to memory of 1800	1688	msedge.exe	93
PID 1688 wrote to memory of 1800	1688	msedge.exe	93
PID 1688 wrote to memory of 2564	1688	msedge.exe	94
PID 1688 wrote to memory of 2564	1688	msedge.exe	94
PID 1688 wrote to memory of 4044	1688	msedge.exe	96
PID 1688 wrote to memory of 4044	1688	msedge.exe	96
PID 1688 wrote to memory of 2592	1688	msedge.exe	95
PID 1688 wrote to memory of 4044	1688	msedge.exe	96
PID 1688 wrote to memory of 2592	1688	msedge.exe	95
PID 1688 wrote to memory of 2592	1688	msedge.exe	95
PID 1688 wrote to memory of 2928	1688	msedge.exe	98
PID 1688 wrote to memory of 2928	1688	msedge.exe	98
PID 1688 wrote to memory of 2928	1688	msedge.exe	98
PID 1688 wrote to memory of 1820	1688	msedge.exe	99
PID 1688 wrote to memory of 1820	1688	msedge.exe	99
PID 1688 wrote to memory of 1820	1688	msedge.exe	99
PID 1688 wrote to memory of 4480	1688	msedge.exe	100
PID 1688 wrote to memory of 4480	1688	msedge.exe	100
PID 1688 wrote to memory of 1088	1688	msedge.exe	103
PID 1688 wrote to memory of 1088	1688	msedge.exe	103
PID 1688 wrote to memory of 4316	1688	msedge.exe	104
PID 1688 wrote to memory of 4316	1688	msedge.exe	104
PID 4156 wrote to memory of 1772	4156	nicaxvpnhfcauspk.exe	106
PID 1688 wrote to memory of 3992	1688	msedge.exe	110
PID 2620 wrote to memory of 2972	2620	uspkicausc.exe	111
PID 1688 wrote to memory of 5948	1688	msedge.exe	115
PID 1688 wrote to memory of 5948	1688	msedge.exe	115
PID 1688 wrote to memory of 4516	1688	msedge.exe	117
PID 1688 wrote to memory of 4516	1688	msedge.exe	117
PID 4156 wrote to memory of 3420	4156	nicaxvpnhfcauspk.exe	119
PID 4156 wrote to memory of 3080	4156	nicaxvpnhfcauspk.exe	123
PID 5272 wrote to memory of 2372	5272	usmkecwupn.exe	125
PID 4156 wrote to memory of 3688	4156	nicaxvpnhfcauspk.exe	128
PID 4156 wrote to memory of 5984	4156	nicaxvpnhfcauspk.exe	132
PID 6108 wrote to memory of 4352	6108	ecwuomgecw.exe	134
PID 4156 wrote to memory of 5360	4156	nicaxvpnhfcauspk.exe	137
PID 4156 wrote to memory of 1416	4156	nicaxvpnhfcauspk.exe	141
PID 5856 wrote to memory of 2056	5856	bztromgebw.exe	143
PID 4156 wrote to memory of 5628	4156	nicaxvpnhfcauspk.exe	147
PID 1688 wrote to memory of 3276	1688	msedge.exe	149
PID 1688 wrote to memory of 1672	1688	msedge.exe	150
PID 1688 wrote to memory of 4492	1688	msedge.exe	151
PID 4156 wrote to memory of 1408	4156	nicaxvpnhfcauspk.exe	154
PID 2516 wrote to memory of 5296	2516	qoigbytqoi.exe	156
PID 4156 wrote to memory of 2236	4156	nicaxvpnhfcauspk.exe	159
PID 4156 wrote to memory of 5336	4156	nicaxvpnhfcauspk.exe	163
PID 5908 wrote to memory of 4540	5908	igeyvqolga.exe	165
PID 4156 wrote to memory of 1084	4156	nicaxvpnhfcauspk.exe	168
PID 4156 wrote to memory of 4264	4156	nicaxvpnhfcauspk.exe	172
PID 928 wrote to memory of 2004	928	xvqnifaysq.exe	174
PID 4156 wrote to memory of 2696	4156	nicaxvpnhfcauspk.exe	177
PID 4156 wrote to memory of 2828	4156	nicaxvpnhfcauspk.exe	181
PID 3652 wrote to memory of 3392	3652	ayspnifdav.exe	183
PID 4156 wrote to memory of 2600	4156	nicaxvpnhfcauspk.exe	186
PID 1688 wrote to memory of 1268	1688	msedge.exe	188
PID 1688 wrote to memory of 1268	1688	msedge.exe	188
PID 4156 wrote to memory of 4836	4156	nicaxvpnhfcauspk.exe	194
PID 5724 wrote to memory of 4592	5724	xvpnhfaxsp.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_fd91c8f89444ff0a85e7e723140ad706_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Temp\nicaxvpnhfcauspk.exe
  C:\Temp\nicaxvpnhfcauspk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkicausc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1772
  - - C:\Temp\uspkicausc.exe
      C:\Temp\uspkicausc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkicausc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\i_uspkicausc.exe
      C:\Temp\i_uspkicausc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecwupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3080
  - - C:\Temp\usmkecwupn.exe
      C:\Temp\usmkecwupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecwupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3688
  - - C:\Temp\i_usmkecwupn.exe
      C:\Temp\i_usmkecwupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\ecwuomgecw.exe
      C:\Temp\ecwuomgecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5360
  - - C:\Temp\i_ecwuomgecw.exe
      C:\Temp\i_ecwuomgecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztromgebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1416
  - - C:\Temp\bztromgebw.exe
      C:\Temp\bztromgebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztromgebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\i_bztromgebw.exe
      C:\Temp\i_bztromgebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1408
  - - C:\Temp\qoigbytqoi.exe
      C:\Temp\qoigbytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2236
  - - C:\Temp\i_qoigbytqoi.exe
      C:\Temp\i_qoigbytqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igeyvqolga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\igeyvqolga.exe
      C:\Temp\igeyvqolga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igeyvqolga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1084
  - - C:\Temp\i_igeyvqolga.exe
      C:\Temp\i_igeyvqolga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\xvqnifaysq.exe
      C:\Temp\xvqnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2696
  - - C:\Temp\i_xvqnifaysq.exe
      C:\Temp\i_xvqnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayspnifdav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2828
  - - C:\Temp\ayspnifdav.exe
      C:\Temp\ayspnifdav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayspnifdav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2600
  - - C:\Temp\i_ayspnifdav.exe
      C:\Temp\i_ayspnifdav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\xvpnhfaxsp.exe
      C:\Temp\xvpnhfaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3004
  - - C:\Temp\i_xvpnhfaxsp.exe
      C:\Temp\i_xvpnhfaxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhecaxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4852
  - - C:\Temp\xupmhecaxr.exe
      C:\Temp\xupmhecaxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhecaxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4756
  - - C:\Temp\i_xupmhecaxr.exe
      C:\Temp\i_xupmhecaxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1316
  - - C:\Temp\urmjhfzxrp.exe
      C:\Temp\urmjhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjhfzxrp.exe ups_ins
    3⤵
    PID:4788
  - - C:\Temp\i_urmjhfzxrp.exe
      C:\Temp\i_urmjhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljeywuomg.exe ups_run
    3⤵
    PID:5836
  - - C:\Temp\rljeywuomg.exe
      C:\Temp\rljeywuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljeywuomg.exe ups_ins
    3⤵
    PID:200
  - - C:\Temp\i_rljeywuomg.exe
      C:\Temp\i_rljeywuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigdb.exe ups_run
    3⤵
    PID:5056
  - - C:\Temp\geywqoigdb.exe
      C:\Temp\geywqoigdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigdb.exe ups_ins
    3⤵
    PID:4652
  - - C:\Temp\i_geywqoigdb.exe
      C:\Temp\i_geywqoigdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoiga.exe ups_run
    3⤵
    PID:2968
  - - C:\Temp\lgeywqoiga.exe
      C:\Temp\lgeywqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoiga.exe ups_ins
    3⤵
    PID:3152
  - - C:\Temp\i_lgeywqoiga.exe
      C:\Temp\i_lgeywqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbysqnifdb.exe ups_run
    3⤵
    PID:4372
  - - C:\Temp\dbysqnifdb.exe
      C:\Temp\dbysqnifdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbysqnifdb.exe ups_ins
    3⤵
    PID:4904
  - - C:\Temp\i_dbysqnifdb.exe
      C:\Temp\i_dbysqnifdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    PID:4452
  - - C:\Temp\avsnlfdxvp.exe
      C:\Temp\avsnlfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    PID:2028
  - - C:\Temp\i_avsnlfdxvp.exe
      C:\Temp\i_avsnlfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvhfzxvpnk.exe ups_run
    3⤵
    PID:5760
  - - C:\Temp\xvhfzxvpnk.exe
      C:\Temp\xvhfzxvpnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvhfzxvpnk.exe ups_ins
    3⤵
    PID:3852
  - - C:\Temp\i_xvhfzxvpnk.exe
      C:\Temp\i_xvhfzxvpnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkicausmk.exe ups_run
    3⤵
    PID:5404
  - - C:\Temp\smkicausmk.exe
      C:\Temp\smkicausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkicausmk.exe ups_ins
    3⤵
    PID:2360
  - - C:\Temp\i_smkicausmk.exe
      C:\Temp\i_smkicausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhcxupmh.exe ups_run
    3⤵
    PID:1172
  - - C:\Temp\rpjhcxupmh.exe
      C:\Temp\rpjhcxupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhcxupmh.exe ups_ins
    3⤵
    PID:2460
  - - C:\Temp\i_rpjhcxupmh.exe
      C:\Temp\i_rpjhcxupmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jeczxrojhb.exe ups_run
    3⤵
    PID:2060
  - - C:\Temp\jeczxrojhb.exe
      C:\Temp\jeczxrojhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff917d3c188,0x7ff917d3c194,0x7ff917d3c1a0
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6271682662283824262,16946481407904828105,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5860958135852880536,2977019649506741504,262144 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,14215010126292431968,3978850345097184958,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,5308910298427315131,5817803445840720525,2097152 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,13656494587047357533,1301713368261590613,2097152 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,6343336575590837307,13794241041160955365,2097152 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,17920321053969811260,14117077623765988485,2097152 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,17891054380680853077,4797150528019081679,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,745829112782034742,4835987876112119479,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,6853236614928801020,6751335239871430830,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3876189316475909347,14597633704193850484,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3876189316475909347,14597633704193850484,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,846328929563154535,8933991317623576314,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,1468363461246723457,920330064912128742,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,13068298948130029017,13983303791190044432,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,3557030162856988086,12902787508290258617,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,11132680362329613702,3564144634012609381,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,12329600203733065922,15761790820628525070,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10249671251321118728,13898741891194074106,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16416405437294247873,1378576464378703159,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15034764906904056575,12907318658233866552,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6020,i,10352236103733081625,13892613290103641016,262144 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:10
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,8618339434141681466,10128935532948893499,524288 --field-trial-handle=2328,i,15890074106116519080,6843903118290652287,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Temp\nicaxvpnhfcauspk.sys
C:\Temp\nicaxvpnhfcauspk.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5084

C:\Temp\rpmkeczusm.sys
C:\Temp\rpmkeczusm.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\hbzxuomhez.sys
C:\Temp\hbzxuomhez.sys
1⤵
- Executes dropped EXE
PID:1756

C:\Temp\ztrojhbzwt.sys
C:\Temp\ztrojhbzwt.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:1068

C:\Temp\ligeywqolg.sys
C:\Temp\ligeywqolg.sys
1⤵
- Executes dropped EXE
PID:5724

C:\Temp\fdavtnlfdx.sys
C:\Temp\fdavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\vsqkifaxvp.sys
C:\Temp\vsqkifaxvp.sys
1⤵
- Executes dropped EXE
PID:4908

C:\Temp\kfcauspnhf.sys
C:\Temp\kfcauspnhf.sys
1⤵
- Executes dropped EXE
PID:5888

C:\Temp\czxspkhcau.sys
C:\Temp\czxspkhcau.sys
1⤵
- Executes dropped EXE
PID:3240

C:\Temp\uomkeczxro.sys
C:\Temp\uomkeczxro.sys
1⤵
- Executes dropped EXE
PID:5988

C:\Temp\omgeywuomg.sys
C:\Temp\omgeywuomg.sys
1⤵
PID:3276

C:\Temp\romgeywtro.sys
C:\Temp\romgeywtro.sys
1⤵
PID:1136

C:\Temp\ljgbytrljd.sys
C:\Temp\ljgbytrljd.sys
1⤵
PID:4200

C:\Temp\gaytqoigay.sys
C:\Temp\gaytqoigay.sys
1⤵
PID:1420

C:\Temp\lfvsnlfdxv.sys
C:\Temp\lfvsnlfdxv.sys
1⤵
PID:2460

C:\Temp\xvqnifaxvp.sys
C:\Temp\xvqnifaxvp.sys
1⤵
PID:2456

C:\Temp\spnhfaxspk.sys
C:\Temp\spnhfaxspk.sys
1⤵
PID:6084

C:\Temp\smkecwusmk.sys
C:\Temp\smkecwusmk.sys
1⤵
PID:4492

C:\Temp\mjhezomjhb.sys
C:\Temp\mjhezomjhb.sys
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztromgebw.exe

Path C:\Temp\bztromgebw.exe
Size 376KB
SHA256 958c90167dc1396aa34174e99561986f09936855b8b502608b82c317998c40eb
MD5 ccd9d083890c47c8bc6224a93ef9296a
SHA1 dd77d62205bb18c3021ab2130a16add1d2baae97
SHA512 fc342dc6f3dd4e194ac519b8ba8af112219d7469296c24b7bfe58ad678120dcb33b45a9ef999deaa34da77c85b1edd29e74a7fe0d0900461bf51cd9b46e9508a
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgecw.exe

Path C:\Temp\ecwuomgecw.exe
Size 376KB
SHA256 3e3c1d87ab85098864dba3f5018fd725a54dc8d397c593034516c6111a03aa35
MD5 36e0f40f506b194b7e4a373f617af3fc
SHA1 8ac0235794947014d539ac4d376762f91bcf5e12
SHA512 27e7b6a8e786ec83be366806ccac2364944cb4b4a4c64534c50177bd34f8274fada8e02ec268c85eb03da7248c07cd1440afa5f6253c6a4ce3eb97b471f5ba75
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbz.sys

Path C:\Temp\geywqojgbz.sys
Size 293KB
SHA256 0076fc1397f077274bc4a19ba2a61c8fa1252e6add63e4e95570564f70c8dc2f
MD5 d0e35fd7b37f05c1ba2cf53eeefe18e4
SHA1 f469eb3056aa12878a1bef7c362a59a219483633
SHA512 6053f25e002cbe5e5f52ae96eb07d04ad920f6677961247f596123447a94398a48608c37d7023aa0f99a1e844499cf4c39332d15142e5a0aff179ba1e8417601
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxuomhez.sys

Path C:\Temp\hbzxuomhez.sys
Size 293KB
SHA256 14d68df82843b9161022d21880bdaa758a08f9a5035aeb39b85ccaa75ffb336f
MD5 3483488e13a154b61e79d3c2036c2c32
SHA1 18b736864828cb8ce65f56f38f5f13b90456effb
SHA512 5cb42b68c69e791ff643df701a775be936bb1a30fc5d9a4f37f8e6082a07ef9f745acc6161f4fa3e5855d95ec53ef1009f71a414d1a7e2357d8de638efcec5cf
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztromgebw.exe

Path C:\Temp\i_bztromgebw.exe
Size 376KB
SHA256 3da05995a4dbd0a0fe75a298226870e8531c767bb48582e8876d10df8a905b73
MD5 b3022422ab03ce2ca587541eedb5e0a2
SHA1 770088a502ab659f8bff14de2a47042a0664e131
SHA512 21dedca13108f9faf091c5a181e6b4be41ce7f85abd232198138cd86dc99bc6b1500d426323d55cd9af43aea53e74c9d941e7dc75709c10d7c3a7be90eca21be
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgecw.exe

Path C:\Temp\i_ecwuomgecw.exe
Size 376KB
SHA256 c54f9774e2f6b74fbfd0e77cd9112053dfc7cf4509b591d3f7584f0afdab2dad
MD5 8c48b1657fd7a495bb82e4a16dc7be81
SHA1 a5b49c81e32b7b63b303354ebc9d77125575c08e
SHA512 28b361804a6cddf02adc25c9aeecc3285f1841af2db34474cebe73c705a4527a298c7c6b85dc56a8c6999fd1e626347303a4c69edbdba54caea28f37b43ee0dc
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbytqoi.exe

Path C:\Temp\i_qoigbytqoi.exe
Size 376KB
SHA256 cb9e863ea8b74b7ac0b5234ed1620453d83ec1bc3d11068252ee92806aef3812
MD5 69c8ea1ed6a8f839c1a71a47f49e993a
SHA1 661dfb4d5a9ae829117cf22f33051589c0c576be
SHA512 9dd672a70b333a102fe036af3924a1f08ea13ad22aa4836f7149290f413a6040836377b0107cc3ee1c575b3410151114c15f7a700344fe1223063fabc89db26f
SSDEEP 3072:qFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecwupn.exe

Path C:\Temp\i_usmkecwupn.exe
Size 376KB
SHA256 8d6fb4cbe0ad480a0395a837f0dcab8fbd2fff30c8d7a2e3ddb1090dd8b8ed7b
MD5 40643f4b41d990cbd65a2689586dca66
SHA1 e779a39e700daa90cbea0cb7eb7ffbbe103c3490
SHA512 d889ec3bb20fcb768970c45f64de645864676494d4d1f2e726874f79e133b14167dc1112b65de13abaeb65cc359e7a41e2bfd1a607df5f6ff4de2bc2d74e45d8
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkicausc.exe

Path C:\Temp\i_uspkicausc.exe
Size 376KB
SHA256 0f6e2c8d61f7d78487b33469f266a24a720d1cbc97b815e46901e4ebe385878a
MD5 896f15bba5374889acc0331f941ff8f7
SHA1 7ea3fc20cab1fa76f116971bb3975413f6db3bce
SHA512 bf5664e7a6105dfb2f6f45132cd436cdb60c3c54bb9b10232ef021916d40bfd04b560a8d293df81b7f2efaea929f4f83570cbf125e5cb8e921ec6258a60f2c67
SSDEEP 3072:/FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igeyvqolga.exe

Path C:\Temp\igeyvqolga.exe
Size 376KB
SHA256 55e02f0310804614e6024c8a4254f3e5f6905446ac8a63567249044f0aef7a46
MD5 8d174699b823e9bef0bc6b6b922b3b99
SHA1 8300177757e7a9bc7b6603cd6399835c523e4f66
SHA512 6908e622b957481b618e52725ddeef8405f57f9c6d0a69cee5029bc9bede0921023e2fc26e1b9e8f053b8bc583c52c47f0b0f1b6243a3d9cf8fc77ce2751156e
SSDEEP 3072:AFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligeywqolg.sys

Path C:\Temp\ligeywqolg.sys
Size 293KB
SHA256 b3bc9cfe73253f0b7ffcd93bda989d9da62e4221331d19fca2e81fb4d02b1bf5
MD5 1c20d827bf87ee493fbd6905de0c09c1
SHA1 0529591165f05070dd1e92ea960097b1d72b9ac7
SHA512 f28cd37bdeb0543d0d330090fbd3f5b24f85e37f3b34f589bd33d7df4f5c3744ce1375e85501f59ba085692898e150b8a12a705bb4331fa2f32e95fd3924162a
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicaxvpnhfcauspk.exe

Path C:\Temp\nicaxvpnhfcauspk.exe
Size 376KB
SHA256 c1dde90248c68157c05622bee16774849be6c942939665a690e0dc54d85198bb
MD5 7554ea40939b28d4d44be79ceae7c75e
SHA1 dc3be9e0604228e70e3c2eb647a442c1cd8db026
SHA512 fc3906f9443637c891074428240460df93ee6c4bf92464767c26e4c240ba6a4f64f55051796d43a925bb07a447132765a178cb6aabd6e17437c2cd84cd03d151
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicaxvpnhfcauspk.sys

Path C:\Temp\nicaxvpnhfcauspk.sys
Size 293KB
SHA256 244ddb596cade0303422ca963df83a713bb6cd1043fae49bf2dbb7ef5e5bda07
MD5 7738539d9baf8894e125602dd56fe425
SHA1 76f1414c34b4af0126da36fa11f406b231341101
SHA512 b4066896acefe19e468e4f122ceb712e21d52c4aff2821676c4723d312eb9319e0d111252f4371784c45505cde969bec4f01ef3b4b03aae786647c4b1a06dcec
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytqoi.exe

Path C:\Temp\qoigbytqoi.exe
Size 376KB
SHA256 32d2978578cb7dbe67df589ba25c1e50b7a4e328355c47e890c9b8617e295bb4
MD5 be6072ef88f5e52d28d2b708aed4f5b3
SHA1 03bd7ae6f8e0fb1b3a3482f79d9083a484aeb853
SHA512 a03219171ce33caf411d5934ac338d273f93e11ccc7ffc3be41918bee88aff2ab4abc437eef358c9be064c3d5551ff6d69f5ec8a97ac7bf76ccd03f5612bd515
SSDEEP 3072:9FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmkeczusm.sys

Path C:\Temp\rpmkeczusm.sys
Size 293KB
SHA256 835ed306c5541f77f76f4ad8bf702a4b536ff2f023504a6db1aa56026e9500e5
MD5 c85c7b1b0868e89defbafbd4c6c6af17
SHA1 cd8b8de4ffad9c0fa263cbdbd23fc17e2524d9cd
SHA512 8784736146999063db6cbd8a0d8c1ad4bc686f43aee7dc04ac976742a78f70e908f6c4ef941da8ed17df6c2f422c9106c841d691001ec8c19742626c2d28adea
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T14E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupn.exe

Path C:\Temp\usmkecwupn.exe
Size 376KB
SHA256 2105cff4226c527fc13f97fc32e7c9353387851a55985a1c044b986fa4b29fae
MD5 129c182170760bdc439ac87032ef97c2
SHA1 9d01b384b54fd76c11505b204288c7bad492d918
SHA512 481fb63b2d28a7bf87393cf9056963549af6f545d5dc2cfc0dcca5e3b164534fd21dffadf414e4d160217d54bf8d63881bd11c8cd77017735d0aa130a05bea01
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkicausc.exe

Path C:\Temp\uspkicausc.exe
Size 376KB
SHA256 fc1c2256cc9cf742764bc27fc2dcc3205e8d48a21dbb0555d72e9c21a7e7e083
MD5 67898705afeefbed06f6b32243c0d088
SHA1 746abd7293e3067a62de7840cdf8f463c8d7a290
SHA512 69cbf7bf38503a7d909717f0cc2e9845d6049eac1e00711cae4ac74184846df22bcd3f15e7ff875a177b678592c6cca57aa42a3517fd5b0332a5e0666e048c4f
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrojhbzwt.sys

Path C:\Temp\ztrojhbzwt.sys
Size 293KB
SHA256 e8ea4dedfb5d80025f685564da03a1515284c14bd045c6078004390d5fd08314
MD5 78dc44087d1d751c493833036ac34e77
SHA1 773720b58049dc8558e099e3bf96872709bfef8b
SHA512 1c1185126bb36a6e05e96cd469e2f28128f9a3d72b028312347779862b6369cb7fd22dd78095b07e19bcde7fc1d3044bf3f38e85e1bbfeb3a93ce66633ea3cab
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e1060eabe2ecc780331de8cfe36b653650bc5e70a64cb37083902ec7fff4fd36
MD5 613547aec814784b59ad57bfa006fa90
SHA1 8da450910911c2cba1ea9b2e0a7f08d347112125
SHA512 18570871e6a168126eff57443ee50cf5c89a9f7e0c86b02f881de75c991ceee0243ed37562b50f27bb399517a9c6620aadb9ad28c62594bb1787f4c719d8b3c2
TLSH
T1555161A8477B89C2DB2B97B10AF3858A32F5C5D64A075FDE4C4860F4F04EF5D9142155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3edf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3edf.TMP
Size 2KB
SHA256 eb16dbb283c8d494f243008606f7419e952069a81b4c83f62a7e059e0ae73afc
MD5 e966d71fef17d7e42553881c59ef24e7
SHA1 b5fea691e914642eb56fd3fbe19fb8c985953e7e
SHA512 e00320a038ab2cdfd8987db6378a799a2c0cc15968b43667e329a68546fafa2080cbe56616379efae67e96aa2520357f3907a3324d66706802dbbd7ff141c84a
TLSH
T1095181A8477B89C2DB2B97B20BF3818A32F6C5D64A0B5FEE4C4820F4F04EF5CA042151
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0c5daee097deb52a4f36062c04089044530b6743569be0fbc9121cf59f748b0a
MD5 d8e7974df3e5aebab9013292b24bcc0b
SHA1 c15a306e20ab718b86faf78913441a19c3045c32
SHA512 ca74e4c8634a8d200574a22e35af39ac25bc9080aa6ca4fdcf2f7b25ff11148c5f682f80fd76211886f556303aaf5925095ba36736b72e7ef57d327e2c82b7b1
TLSH
T15041A0F783F4856E890196F4AA18AF1FCE1C0515832C7D5AC9E4AF2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 00736d6c53f97f37652543ebd75ed00eeee9f81094689dff281fa9f3bfb0f82c
MD5 4591a584675e847a0b57a7166bfc4ccd
SHA1 786686888ab748c5e8dfa1ea1150a3b49af38a4b
SHA512 9d19b7cdc896c2075015f9384d111be9490af82df74bd8a0f6e6efbb8349c549b2f8a87f9c8e341388cd120714c6439353e9a12df7d75c722bb8f9dbd2d2b7c2
SSDEEP 192:sxR4RmCW/fVs8QYwGnzoA8p9l/g6+WNCQY/YorACYeG6IgVFJ:sxR4vW/fVsVYpOD/52/rrt
TLSH
T1E342A9166E28A93B4CC7E21DFB65BF53D2F9103361D51E48AAFC8A1C14E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8728099d66391039b8c546affa0fa34c9f408ae8c9a28aaea746268f9aea5a62
MD5 dd7cc09be77729ffa443fd0297c91ce4
SHA1 14657134aa3162d257018c199e0e866ebfaf24ca
SHA512 bd7806845b627da1d2c66e9cd31eeafbce576f047db7b11d1d1857daae8f837bb844ebcc52e17d0a657a24ab75fd20e80d00421d4472b3328f0428080fb3867e
SSDEEP 192:sxRvRmCW/fVsNQYwGnzoA8p9l/g6+WNCQY/YorACYeG6IgDBFJ:sxRvvW/fVs+YpOD/52/rrd
TLSH
T12E42B9166E28A93B4CC7E21DFB65BF53D2F9103261D51E48AAFC8A1C04E66DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6063e2d2ae803198c910fd613c413863a106604d63ac69c99a8a625747c4e5c9
MD5 086eb0fcba580f12052144db1327e6fc
SHA1 a99dd7c565c23884ab6022171c35578c829e96de
SHA512 580dc8637c27d79a6e8ca47ec8e7c0689456a7524b377ada60edd86675e8f81d1ace366c33d4bfbdaf6ea8513c82063f688a15e75b8f1015162332e5412dc4a4
SSDEEP 192:sxRvRmCW/fVsNQwdZlzoA8p9l/g6+WNCQY/Yo0uCYeG6IgDrFJ:sxRvvW/fVs+wTID/52/ErX
TLSH
T17942B8166E28693B5CC7E21DBB55BF53E3F9103361D52E48BAFC8A1C14E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6d3bb1294e46303d2e483b77c790404018d28e74ae387feed23a05f8fc9be5b4
MD5 a151acf0ecd6ee3c3fd48909f1810153
SHA1 b5794e8342d6487cd34e98b6ae84d93ba2dbfbd9
SHA512 f91257f4e026481c84d7e1cf5ee6a6d91c2ccfc366617f77f1bec98ca536a09ae2c5e5f5071937db8f415e80cc2680931acbf5f742cb749a51fd9c2300ced596
SSDEEP 192:sxRvRmCW/fVsNQwwGnzoA8p9l/g6+WNCQY/Yo0uCYeG6IgDrFJ:sxRvvW/fVs+wpOD/52/ErX
TLSH
T15042B8166E28693B5CC7E21DBB65BF53E3F9103361D51E48AAFC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4ab34030f721f5f09f9e3e2c59935da02c0b25170a67b1dab3911a7df7cce127
MD5 ece48ff4424602cd5a8d664cf48f84e8
SHA1 819cc4237914dc205992022b9eb81378842953f1
SHA512 824241650ceead5996458b040da02eae87048141e42d577442f9fed891938e73b2283957b336c2fdf84850f95e95affc290761b4ebaf631f890fae3a627b5ec1
SSDEEP 768:j26HYo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVWwBVuw5ro9Fe08:j26HYUE7MRWgs2f02u1jaNwB4wyw/
TLSH
T141D2DB7B640DCABF4F800ADDED197EDF6D6802CB9698CD8047FE841C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad9c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad9c7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 873a0fad8816a35a6c052b913cfe932dc3c176815a0095e039ca1258907e6333
MD5 3bfb5e9e7a099626f8c2826c7b0ba4db
SHA1 70579da459c5f373f34bb955a1956fb278602dc2
SHA512 db8287ad87167aa8168fabf10f9c5f1e5539288b8cdf249c875a8bc83613a1c2510d767d6c09d949e4a093e82fc382f5ed76242b423513bcb84d65b51ea84e13
SSDEEP 768:1FQV3ywgHlWrpsOWSWONXyer1IRCzni9Nf1I:UV32OmSIqnyf1I
TLSH
T168134AF594D38937D8AD9383A33D6E42AEBCD063B4885990BBD45E4CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1215f9af1d54e58648646346f3c3e6e2f74c4938264a65de281c5e8424b740e9
MD5 a68aa64c035db4d943e1fb7aafb42fb7
SHA1 15d67927c12f8115da3e44cb79f7bc0fc29d2e24
SHA512 116bead7d09998bbdb36e6b7b83c078f2001476dbfe67b123d3ee9e0e948204e334932cc1eda40f5bc6f58c3f39083c439a4c33995c62665b661b1f2a4d9f9e5
SSDEEP 768:hrv+4UNbdz3swF/TBOWTONXyer1IRCzniBceVH1SK7:hbsbV3sudSIqnXEH1l
TLSH
T10A03BF32E4989E338CE2A3D6B047B6437FB86057DA840790EDDE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c8f0bc8094c7e0ca24c1b9eb8c02ca08341b1f281e18f32a4a19962d748e73cb
MD5 ae34e90de43e86c25c8c85aa9f7e90ef
SHA1 ccb1fd8f46ff05b8ba897628f904759655fb3dcf
SHA512 7bd6425276946d93a44a5c07d0c26e6f26b1e4929aec28959653ee5600764aed554138ff7d8c0315c2ae310c1089a7d0d26503a5306a011fd30aeb99df57cae6
SSDEEP 768:yrv+4UNbd73B2oI/TBOWS3ONXyer1IRCzni9Ny3q:ybsbN3M34SIqnyf
TLSH
T1C903AF30E5599E334DE6A296B04777837FF8206788C00B94EDE66F8D059B5AE230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8d85a488450797d65703d9e4dc73eb5d80bba7484fa5046f9d06227f44c93696
MD5 3a4e8c7fcfc5285002556af614b2ed2f
SHA1 3d88b23a36f6241aeb279afef960b6c57d1135a8
SHA512 0d6934bae1be846bb801f8809f395b2a13f47d038cb9d93384dd65f6a2212590920c11427f67a10482fc4784e73f2c8c709f4535cafc7b0e346e209c79ed22ad
SSDEEP 384:nCZcI838N7tqc60DWe6uhf3RTpXOVc3V0x75GrYGgAN8SyrCZr1IR0VhMxAREYNR:w83gzWI/TBOWS9ONXyer1IRCzni9Nf1I
TLSH
T194F2BF30E9959D334CE5E3C6B1066783BFF8606789C84E54EDE99F0D0597A6E230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9ba810bc539c46fc54885db869857ece87c81024e4f6a91156e006ae8ce0d7cd
MD5 86f7fdaadbad61932c5ada9d25ed4f67
SHA1 9f77732e1262938e4c1d45a90cf57469c7c3607e
SHA512 c1bebc0fc7bb0c24b0edc1012a34d7a5d0843332ef4afb91638b0e90cc8eca03176099ceeaa082234ac9f4b5d5e61c7b8483bdca5618535d188397b592e21a28
SSDEEP 768:5rv+4UNbdz3fw6/TBOWS6ONXyer1IRCzniwNeVH1SK7:5bsbV3f9/SIqn5EH1l
TLSH
T1D903BF31E4999E334DE6A396B047B7837FF8206789800B90EDEA5F4E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 78d99bf12f2b722676487994387496beb54577a935cca1c3e55ac5d4d582e1c5
MD5 071a240af8b6284cdda1f062a4013b5c
SHA1 eeeeb64d3296a6983f1c9c86ec234de2dd1611b5
SHA512 8f299c1706238ff1e3edf24132145209e34c5fad8a352634dd8a75e20969c689b54ea0588860d4ad4a0959ef0d0f9bec9d8945bd6dc33d15909be1885b3d76f2
SSDEEP 384:noZcI838N7Oqc60DWe6uhf3RTpXOVc3V0x75GrYGgAN8SyrCZr1IR0VhMxAREYNR:W83/zWI/TBOWS9ONXyer1IRCzni9Nf1I
TLSH
T1AAF2BF30E9959D334CE5E3C6B1066783BFF8206789C84E54EDE99F0D0597A6E230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

82c31142-2ee5-448b-b10f-f232a8eebf9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82c31142-2ee5-448b-b10f-f232a8eebf9b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1688_1631897260\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 24bfa7b3a0005b6c5e109fcb7a5d919d724356410207ebd006cfe56ee52d4fea
MD5 677c66d9db7da5dbd130ab01b7af3407
SHA1 f1d1d70547dfe73d01ab861ba42e6683a5504563
SHA512 d861a837f6d4740c484c8cd13e7374e153c0d48ad82e4dd694d0e1aea8a8c4cbd592c0be3725ba318d8f0809276bd4b8bccec01ca1f0df634602894f76717ae4
TLSH
T19D71009366A9D5B3C1DA5BF403835644F1BB23380B2320245B525986AB30A3A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1068-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1068-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1136-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1420-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1756-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2384-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2460-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3240-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3944-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4200-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4908-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5724-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download