systex | 14443763bdaf5fb22b8b26628019f6247f592686582de57a5556e416972f694c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260930-hvthnattcv
SHA256 14443763bdaf5fb22b8b26628019f6247f592686582de57a5556e416972f694c
MD5 e7eba4920231984ca98410e5eecb6e5e
SHA1 451e9a39ff4a0558114c5c7a2e7057b2c539398d
SHA512 b315bdd278777acbccf1fe7ce3ab9f533de86408a88ea090af568a68cf0a3004dd37edaf73ddeba7494d265055df06bdd936bef0fa1418acdbc1a9997c0dd5a8
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2104	nhfdxvpnkfcxvsnk.exe
2944	nhfdxvpnkfcxvsnk.sys
4800	CreateProcess.exe
2912	spnhfdxspi.exe
4160	CreateProcess.exe
712	CreateProcess.exe
6012	i_spnhfdxspi.exe
2668	cxusmkecxu.sys
2832	CreateProcess.exe
3328	mkecxrpkhc.exe
4916	CreateProcess.exe
2868	CreateProcess.exe
3224	i_mkecxrpkhc.exe
5544	pmhfzxupmh.sys
2748	CreateProcess.exe
4340	zwupmecwuo.exe
4480	CreateProcess.exe
2216	CreateProcess.exe
4792	i_zwupmecwuo.exe
4268	mjhbzurpjh.sys
4484	CreateProcess.exe
5624	gezwjgbzto.exe
2164	CreateProcess.exe
4492	CreateProcess.exe
1844	i_gezwjgbzto.exe
2444	ebwtomgeyw.sys
2544	CreateProcess.exe
2864	trljdbwtol.exe
2496	CreateProcess.exe
1840	CreateProcess.exe
2948	i_trljdbwtol.exe
1672	lgeyvtnlgd.sys
4244	CreateProcess.exe
3896	dbywqoljdb.exe
1648	CreateProcess.exe
2068	CreateProcess.exe
5664	i_dbywqoljdb.exe
2752	idayvtnlfd.sys
3560	CreateProcess.exe
5504	igaysqnlfd.exe
4708	CreateProcess.exe
2996	CreateProcess.exe
2460	i_igaysqnlfd.exe
4948	sqlidavsnl.sys
2612	CreateProcess.exe
5376	ifaxvpnica.exe
5932	CreateProcess.exe
5648	CreateProcess.exe
3304	i_ifaxvpnica.exe
2500	kfcavsnlfc.sys
2660	CreateProcess.exe
4588	icaxsqkica.exe
2624	CreateProcess.exe
4904	CreateProcess.exe
5484	i_icaxsqkica.exe
3016	kicauspkhc.sys
3028	CreateProcess.exe
4856	hczxupkhfz.exe
3512	CreateProcess.exe
3436	CreateProcess.exe
5176	i_hczxupkhfz.exe
700	bzxupmkecw.sys
4948	CreateProcess.exe
5680	hbzxusmjhb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2740_479739153\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2740_479739153\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2740_408385084\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwjgbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxupkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxusmkhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbywqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupmecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbywqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysnkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfdxspi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupmecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxupkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxusmkhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfdxvpnkfcxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzxusmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzxusmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysnkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwjgbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfdxspi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3180	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4784	ipconfig.exe
4252	ipconfig.exe
2468	ipconfig.exe
2360	ipconfig.exe
5488	ipconfig.exe
1120	ipconfig.exe
3196	ipconfig.exe
5036	ipconfig.exe
2408	ipconfig.exe
2768	ipconfig.exe
2020	ipconfig.exe
5564	ipconfig.exe
6000	ipconfig.exe
3236	ipconfig.exe
2832	ipconfig.exe
2476	ipconfig.exe
3408	ipconfig.exe
3228	ipconfig.exe
1640	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{0229CF9B-F7B9-4586-BF0F-5843EA143465}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe
2104	nhfdxvpnkfcxvsnk.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	6012	i_spnhfdxspi.exe
Token: SeDebugPrivilege	3224	i_mkecxrpkhc.exe
Token: SeDebugPrivilege	4792	i_zwupmecwuo.exe
Token: SeDebugPrivilege	1844	i_gezwjgbzto.exe
Token: SeDebugPrivilege	2948	i_trljdbwtol.exe
Token: SeDebugPrivilege	5664	i_dbywqoljdb.exe
Token: SeDebugPrivilege	2460	i_igaysqnlfd.exe
Token: SeDebugPrivilege	3304	i_ifaxvpnica.exe
Token: SeDebugPrivilege	5484	i_icaxsqkica.exe
Token: SeDebugPrivilege	5176	i_hczxupkhfz.exe
Token: SeDebugPrivilege	3732	i_hbzxusmjhb.exe
Token: SeDebugPrivilege	5800	i_pjhbztrojh.exe
Token: SeDebugPrivilege	1380	i_omgeywrljd.exe
Token: SeDebugPrivilege	3160	i_eywqolgeyw.exe
Token: SeDebugPrivilege	3592	i_tnljdaytnl.exe
Token: SeDebugPrivilege	2080	i_icaysnkiga.exe
Token: SeDebugPrivilege	6020	i_qnicavsnkf.exe
Token: SeDebugPrivilege	1500	i_fcxusmkhfa.exe
Token: SeDebugPrivilege	5384	i_pnhfzxrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2104	4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 4140 wrote to memory of 1312	4140	2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1312 wrote to memory of 2740	1312	iexplore.exe	90
PID 2740 wrote to memory of 4752	2740	msedge.exe	91
PID 2740 wrote to memory of 3180	2740	msedge.exe	92
PID 2740 wrote to memory of 2440	2740	msedge.exe	94
PID 2740 wrote to memory of 2440	2740	msedge.exe	94
PID 2740 wrote to memory of 4072	2740	msedge.exe	93
PID 2740 wrote to memory of 4072	2740	msedge.exe	93
PID 2740 wrote to memory of 4072	2740	msedge.exe	93
PID 2740 wrote to memory of 4796	2740	msedge.exe	96
PID 2740 wrote to memory of 4796	2740	msedge.exe	96
PID 2740 wrote to memory of 4796	2740	msedge.exe	96
PID 2740 wrote to memory of 1056	2740	msedge.exe	97
PID 2740 wrote to memory of 1056	2740	msedge.exe	97
PID 2740 wrote to memory of 1056	2740	msedge.exe	97
PID 2740 wrote to memory of 3564	2740	msedge.exe	98
PID 2740 wrote to memory of 4068	2740	msedge.exe	99
PID 2740 wrote to memory of 3564	2740	msedge.exe	98
PID 2740 wrote to memory of 3564	2740	msedge.exe	98
PID 2740 wrote to memory of 4068	2740	msedge.exe	99
PID 2740 wrote to memory of 4068	2740	msedge.exe	99
PID 2740 wrote to memory of 4684	2740	msedge.exe	100
PID 2740 wrote to memory of 4684	2740	msedge.exe	100
PID 2104 wrote to memory of 4800	2104	nhfdxvpnkfcxvsnk.exe	104
PID 2740 wrote to memory of 3908	2740	msedge.exe	107
PID 2740 wrote to memory of 1340	2740	msedge.exe	108
PID 2740 wrote to memory of 3908	2740	msedge.exe	107
PID 2740 wrote to memory of 1340	2740	msedge.exe	108
PID 2912 wrote to memory of 4160	2912	spnhfdxspi.exe	109
PID 2740 wrote to memory of 3848	2740	msedge.exe	113
PID 2740 wrote to memory of 2824	2740	msedge.exe	114
PID 2740 wrote to memory of 2824	2740	msedge.exe	114
PID 2104 wrote to memory of 712	2104	nhfdxvpnkfcxvsnk.exe	117
PID 2740 wrote to memory of 1484	2740	msedge.exe	119
PID 2740 wrote to memory of 1484	2740	msedge.exe	119
PID 2104 wrote to memory of 2832	2104	nhfdxvpnkfcxvsnk.exe	123
PID 3328 wrote to memory of 4916	3328	mkecxrpkhc.exe	125
PID 2104 wrote to memory of 2868	2104	nhfdxvpnkfcxvsnk.exe	128
PID 2104 wrote to memory of 2748	2104	nhfdxvpnkfcxvsnk.exe	132
PID 4340 wrote to memory of 4480	4340	zwupmecwuo.exe	134
PID 2104 wrote to memory of 2216	2104	nhfdxvpnkfcxvsnk.exe	137
PID 2104 wrote to memory of 4484	2104	nhfdxvpnkfcxvsnk.exe	142
PID 5624 wrote to memory of 2164	5624	gezwjgbzto.exe	144
PID 2740 wrote to memory of 3500	2740	msedge.exe	147
PID 2740 wrote to memory of 5752	2740	msedge.exe	148
PID 2740 wrote to memory of 4708	2740	msedge.exe	149
PID 2104 wrote to memory of 4492	2104	nhfdxvpnkfcxvsnk.exe	150
PID 2740 wrote to memory of 5528	2740	msedge.exe	154
PID 2740 wrote to memory of 5528	2740	msedge.exe	154
PID 2740 wrote to memory of 5528	2740	msedge.exe	154
PID 2740 wrote to memory of 3000	2740	msedge.exe	155
PID 2740 wrote to memory of 3000	2740	msedge.exe	155
PID 2740 wrote to memory of 3000	2740	msedge.exe	155
PID 2104 wrote to memory of 2544	2104	nhfdxvpnkfcxvsnk.exe	156
PID 2864 wrote to memory of 2496	2864	trljdbwtol.exe	158
PID 2104 wrote to memory of 1840	2104	nhfdxvpnkfcxvsnk.exe	161
PID 2104 wrote to memory of 4244	2104	nhfdxvpnkfcxvsnk.exe	165
PID 3896 wrote to memory of 1648	3896	dbywqoljdb.exe	167
PID 2104 wrote to memory of 2068	2104	nhfdxvpnkfcxvsnk.exe	170
PID 2104 wrote to memory of 3560	2104	nhfdxvpnkfcxvsnk.exe	174
PID 5504 wrote to memory of 4708	5504	igaysqnlfd.exe	176
PID 2104 wrote to memory of 2996	2104	nhfdxvpnkfcxvsnk.exe	179
PID 2104 wrote to memory of 2612	2104	nhfdxvpnkfcxvsnk.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_e7eba4920231984ca98410e5eecb6e5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Temp\nhfdxvpnkfcxvsnk.exe
  C:\Temp\nhfdxvpnkfcxvsnk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfdxspi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4800
  - - C:\Temp\spnhfdxspi.exe
      C:\Temp\spnhfdxspi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfdxspi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:712
  - - C:\Temp\i_spnhfdxspi.exe
      C:\Temp\i_spnhfdxspi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2832
  - - C:\Temp\mkecxrpkhc.exe
      C:\Temp\mkecxrpkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxrpkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Temp\i_mkecxrpkhc.exe
      C:\Temp\i_mkecxrpkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwupmecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2748
  - - C:\Temp\zwupmecwuo.exe
      C:\Temp\zwupmecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwupmecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2216
  - - C:\Temp\i_zwupmecwuo.exe
      C:\Temp\i_zwupmecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwjgbzto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\gezwjgbzto.exe
      C:\Temp\gezwjgbzto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwjgbzto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4492
  - - C:\Temp\i_gezwjgbzto.exe
      C:\Temp\i_gezwjgbzto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2544
  - - C:\Temp\trljdbwtol.exe
      C:\Temp\trljdbwtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1840
  - - C:\Temp\i_trljdbwtol.exe
      C:\Temp\i_trljdbwtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbywqoljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4244
  - - C:\Temp\dbywqoljdb.exe
      C:\Temp\dbywqoljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbywqoljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2068
  - - C:\Temp\i_dbywqoljdb.exe
      C:\Temp\i_dbywqoljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3560
  - - C:\Temp\igaysqnlfd.exe
      C:\Temp\igaysqnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2996
  - - C:\Temp\i_igaysqnlfd.exe
      C:\Temp\i_igaysqnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvpnica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2612
  - - C:\Temp\ifaxvpnica.exe
      C:\Temp\ifaxvpnica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvpnica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\i_ifaxvpnica.exe
      C:\Temp\i_ifaxvpnica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2660
  - - C:\Temp\icaxsqkica.exe
      C:\Temp\icaxsqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_icaxsqkica.exe
      C:\Temp\i_icaxsqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxupkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\hczxupkhfz.exe
      C:\Temp\hczxupkhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxupkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3436
  - - C:\Temp\i_hczxupkhfz.exe
      C:\Temp\i_hczxupkhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzxusmjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\hbzxusmjhb.exe
      C:\Temp\hbzxusmjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzxusmjhb.exe ups_ins
    3⤵
    PID:2184
  - - C:\Temp\i_hbzxusmjhb.exe
      C:\Temp\i_hbzxusmjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrojh.exe ups_run
    3⤵
    PID:5512
  - - C:\Temp\pjhbztrojh.exe
      C:\Temp\pjhbztrojh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbztrojh.exe ups_ins
    3⤵
    PID:1300
  - - C:\Temp\i_pjhbztrojh.exe
      C:\Temp\i_pjhbztrojh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrljd.exe ups_run
    3⤵
    PID:3068
  - - C:\Temp\omgeywrljd.exe
      C:\Temp\omgeywrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrljd.exe ups_ins
    3⤵
    PID:5032
  - - C:\Temp\i_omgeywrljd.exe
      C:\Temp\i_omgeywrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqolgeyw.exe ups_run
    3⤵
    PID:5292
  - - C:\Temp\eywqolgeyw.exe
      C:\Temp\eywqolgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqolgeyw.exe ups_ins
    3⤵
    PID:2736
  - - C:\Temp\i_eywqolgeyw.exe
      C:\Temp\i_eywqolgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnljdaytnl.exe ups_run
    3⤵
    PID:2640
  - - C:\Temp\tnljdaytnl.exe
      C:\Temp\tnljdaytnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnljdaytnl.exe ups_ins
    3⤵
    PID:5564
  - - C:\Temp\i_tnljdaytnl.exe
      C:\Temp\i_tnljdaytnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaysnkiga.exe ups_run
    3⤵
    PID:2632
  - - C:\Temp\icaysnkiga.exe
      C:\Temp\icaysnkiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaysnkiga.exe ups_ins
    3⤵
    PID:4816
  - - C:\Temp\i_icaysnkiga.exe
      C:\Temp\i_icaysnkiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnicavsnkf.exe ups_run
    3⤵
    PID:1380
  - - C:\Temp\qnicavsnkf.exe
      C:\Temp\qnicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnicavsnkf.exe ups_ins
    3⤵
    PID:416
  - - C:\Temp\i_qnicavsnkf.exe
      C:\Temp\i_qnicavsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxusmkhfa.exe ups_run
    3⤵
    PID:5024
  - - C:\Temp\fcxusmkhfa.exe
      C:\Temp\fcxusmkhfa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxusmkhfa.exe ups_ins
    3⤵
    PID:4760
  - - C:\Temp\i_fcxusmkhfa.exe
      C:\Temp\i_fcxusmkhfa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpjh.exe ups_run
    3⤵
    PID:1904
  - - C:\Temp\pnhfzxrpjh.exe
      C:\Temp\pnhfzxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpjh.exe ups_ins
    3⤵
    PID:256
  - - C:\Temp\i_pnhfzxrpjh.exe
      C:\Temp\i_pnhfzxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5384
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff3079c188,0x7fff3079c194,0x7fff3079c1a0
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,16562276756305548654,15568170662660859457,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
      4⤵
      System Time Discovery
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,2330416619869061866,1979754660275908239,262144 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,9787536884917007425,5724248162986194142,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,3545229363797988348,2082639270299421344,2097152 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,6311241107578925770,14631129777700941629,2097152 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,13345345302943930482,16850983928548008291,2097152 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,8688717346823326727,5819905917667003456,2097152 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,2981945479802630956,6200971710252502147,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,17155114263469501721,735580370895230060,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4890592240805956317,12627381750980263845,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6743562330313450104,11265986094874616915,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6743562330313450104,11265986094874616915,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,14936429101364214080,11739936673250851119,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,9213134959212387523,5169881689229075486,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,239304730188314845,10121023560995138527,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,4782820036010031887,6434843109791881327,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16897161779362413816,6682453029466372272,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5676,i,5740067926457085432,10230730671671488765,2097152 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6692,i,7323645185002440490,14096782534839588709,2097152 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,10899150122613149384,1190624652127114505,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3164787052021423775,15517165847911062576,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15442361296883862391,13365623621296532025,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,16365956348406667780,16308321799947902666,524288 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=916,i,4080183443321448015,3129916985711221622,262144 --field-trial-handle=2280,i,15524424981099900470,17137727582749748610,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:10
      4⤵
      PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3024

C:\Temp\nhfdxvpnkfcxvsnk.sys
C:\Temp\nhfdxvpnkfcxvsnk.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3700

C:\Temp\cxusmkecxu.sys
C:\Temp\cxusmkecxu.sys
1⤵
- Executes dropped EXE
PID:2668

C:\Temp\pmhfzxupmh.sys
C:\Temp\pmhfzxupmh.sys
1⤵
- Executes dropped EXE
PID:5544

C:\Temp\mjhbzurpjh.sys
C:\Temp\mjhbzurpjh.sys
1⤵
- Executes dropped EXE
PID:4268

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:2444

C:\Temp\lgeyvtnlgd.sys
C:\Temp\lgeyvtnlgd.sys
1⤵
- Executes dropped EXE
PID:1672

C:\Temp\idayvtnlfd.sys
C:\Temp\idayvtnlfd.sys
1⤵
- Executes dropped EXE
PID:2752

C:\Temp\sqlidavsnl.sys
C:\Temp\sqlidavsnl.sys
1⤵
- Executes dropped EXE
PID:4948

C:\Temp\kfcavsnlfc.sys
C:\Temp\kfcavsnlfc.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\kicauspkhc.sys
C:\Temp\kicauspkhc.sys
1⤵
- Executes dropped EXE
PID:3016

C:\Temp\bzxupmkecw.sys
C:\Temp\bzxupmkecw.sys
1⤵
- Executes dropped EXE
PID:700

C:\Temp\urmjhczurm.sys
C:\Temp\urmjhczurm.sys
1⤵
PID:5372

C:\Temp\omjebztrlj.sys
C:\Temp\omjebztrlj.sys
1⤵
PID:5684

C:\Temp\gdbwtolgey.sys
C:\Temp\gdbwtolgey.sys
1⤵
PID:1376

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
PID:2348

C:\Temp\tnlidbvtnl.sys
C:\Temp\tnlidbvtnl.sys
1⤵
PID:5096

C:\Temp\nlfdxvpnlf.sys
C:\Temp\nlfdxvpnlf.sys
1⤵
PID:3168

C:\Temp\fdxupnhfax.sys
C:\Temp\fdxupnhfax.sys
1⤵
PID:4748

C:\Temp\mkhczurpkh.sys
C:\Temp\mkhczurpkh.sys
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxusmkecxu.sys

Path C:\Temp\cxusmkecxu.sys
Size 293KB
SHA256 90f9be6b7687b8a5378088e5062e41014cbfacad9294055a207b380355debd82
MD5 942899452410c58ee0cdf130354fd9f8
SHA1 e195b784095678dbc0fe7794b61dd868d5e7ab03
SHA512 a2581168924a7426ade049d06ab2ef41337378b9bc01b5c08ae41f325ca873307edf527baa423b573af0bab2684e6126a6fdc0ffec41aa5c7f287ea67d95e3f2
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbywqoljdb.exe

Path C:\Temp\dbywqoljdb.exe
Size 389KB
SHA256 ad49b9cd857413cc475e4ea070411689fc159b9588760cbd9cdf4ba166db2624
MD5 7f455ef53f78ca302b258264d39a28f1
SHA1 5a86bf53761be9a4a9906e6b12206909bce85f44
SHA512 10759a8541e3a636a9d267631eacfbe41a04f59bbfeab8436321e015563e3f417fa4769bc4797fff5159d846fb624a4feb20a95c8a0d786e60b63406f431503a
SSDEEP 3072:uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeyw.sys

Path C:\Temp\ebwtomgeyw.sys
Size 293KB
SHA256 e92ddee410370012fe99c21dac449301b33f68ab380fbe69ee15f35d240bc521
MD5 a9180fbcbc3dfbd4a070470fb2e39244
SHA1 420ffa889ef9d2fe8c2d3ac0988a890910c062a5
SHA512 48ecb789f3d75b1e68e6c9c092050f00a759799fbd9c6324db52a48ef84874df2a7ec92e04b4c65c101c99581fed0f3c4321671238b8942f6a4192a94a30c552
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwjgbzto.exe

Path C:\Temp\gezwjgbzto.exe
Size 389KB
SHA256 2d9935d982d85efc544dbf795707317587a5f5c107334f2d22cc927e895ea990
MD5 74c9d622a0bcfcb0c0b2adcce7e6d427
SHA1 808b32ce990ad95fe5f403bebd3828620a1d5db5
SHA512 df84794c94be23a9aec5838bf05f15320687b5c44ab76d5ca7c390e50934be5814c204ddfa2ffaaed6b9253ac63c24d0ed6d60eefb0eeaff52b5cff61786f09d
SSDEEP 3072:8uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwjgbzto.exe

Path C:\Temp\i_gezwjgbzto.exe
Size 389KB
SHA256 dbbb2ac8f69279938f9501d4a875a9be54e65db7f4013c95d621201e54071735
MD5 81ed55dd2026495206182519b89c8fbe
SHA1 c9cce309160086ec5352bb1dbc8728b77f9c61dd
SHA512 4ca468e52d8dfc10e48117675e948ab04cf106f7fea1b3686035576bb31d2a91ccd27239364445444a0c5ea6c0dd8877f47f27e7be975c68fd771c1a40f85606
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T148847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxrpkhc.exe

Path C:\Temp\i_mkecxrpkhc.exe
Size 389KB
SHA256 9920c2c2cce362802fb628da0350be146189af7b5996ff505af3af74b4e38715
MD5 9a402f4226dd22876c22f973eb28e244
SHA1 fc6e9c7e1cc451c50d7726fb68822ff456cfbc35
SHA512 f66491cd0c5ff06cb45e9195277b2ed6b78f08af4cf582278e0c10e752975ab1c264db794c3a9c881ded6f7f83fb56d38bbe9121d9a8886e0bcb56f580b29b5a
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfdxspi.exe

Path C:\Temp\i_spnhfdxspi.exe
Size 389KB
SHA256 b49ea6b8472ed4c5981f7e2aaa11be92cc501e79ec98be04c6f256283d2406f6
MD5 7533845f933f36e5201e22c54ff94c2d
SHA1 9dbc98a6df7e0a9ccf0402fbc08ae6360e0b5f36
SHA512 e0dcda93babd7609121dfbcad6d8f6e017edf2ea06f1f21980d2f52519040aa7fc6642ff6eda328109bea24f24aa5ec7e49e2d96e55394c0dda37212c821a12f
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtol.exe

Path C:\Temp\i_trljdbwtol.exe
Size 389KB
SHA256 b4278ead46a6e6e12c24be34cc04b75079c13a70485b906c2e0235aa03de4b58
MD5 375e03a9e62ffa9020d23ee7da2dff87
SHA1 9627040114e8584c09f396d0ecb071ad237c8cf6
SHA512 f13d80624c2206f329c437c7ae00de38334b367a1f0b33d17902289226aa3cf4f171a0a424be51deeb7465259426bb580ab4492860081a7244715452ba305b3a
SSDEEP 3072:wuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwupmecwuo.exe

Path C:\Temp\i_zwupmecwuo.exe
Size 389KB
SHA256 67648bd7c4ee7205be0db04efe3ebeed99f214b3c293667af0436a5294c83346
MD5 0c38c62d1ec78c81bb7f255e7b017a98
SHA1 5b0016394ef149cdc9fde8f807ce1729258b3ccb
SHA512 896dfd14269a72ec7dd787b8414715800a4893c1ec0708afb3132ba81e5ff59edd9bc4c6b6bf030ff90466d1964780c690cfe94b6664fb71b31badd8f56bf275
SSDEEP 3072:ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeyvtnlgd.sys

Path C:\Temp\lgeyvtnlgd.sys
Size 293KB
SHA256 658136b0b9b31cdeb00a65b73ad3cd4680dacf10cf6e953650a4185849e0738e
MD5 8b55c9c29c08b88f940bf01a58cfbed2
SHA1 d1c00bd4b3f22a1c0b44403fa9d6bbca8457a6fb
SHA512 5827de7b061308a5e8433a5c5eeed4a308df43528828222407a613946dd4d6ae05e912a07b771aea6c3f0b4087e68716b90b3ca906bceb88ed65e897c389eb7e
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C40EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbzurpjh.sys

Path C:\Temp\mjhbzurpjh.sys
Size 293KB
SHA256 f30710abe184c8e618c4a3a3a5b0bc3d8df6614d674ce96a1c958da33ea3e313
MD5 2a07833f120279ec26b547e6e91b20a0
SHA1 365cc6c9610d18b3c05c82640f74c2e34c2f33af
SHA512 ae0720165b545934311932a81bf4eef1c0bfd139d528713a4856b6da4a1e24e561888182c1ae0729ec5d047ca101e04053d5041d834e4ad65462ce6dc6d9bbb7
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxrpkhc.exe

Path C:\Temp\mkecxrpkhc.exe
Size 389KB
SHA256 1095e81475e78a62dd0aad65a0cd80dd7c4d323f88464cd8721d4fafdaf7ef36
MD5 0d75becd95383543cfead432db06921c
SHA1 a00ef90f779cffcbb046171ac20ca2915600596b
SHA512 ab4d587e4dad0ecb75230ac5288f57a0db9e02366685d5ab1ccb22409362b8f4aa0def0f0c97c11160c4465b95f4f9a5ec3eba826b4e605f18fefcdc901882c8
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfdxvpnkfcxvsnk.exe

Path C:\Temp\nhfdxvpnkfcxvsnk.exe
Size 389KB
SHA256 1202a1853d8cb9546acb7d89e74d99d85a865cbdc7d34b7d9723666b214f4794
MD5 a1e770320331f9c2b95aad8aee5bcedf
SHA1 8f04c5e1c7eb9cf6abf1d12c6b136cd658722c34
SHA512 19a2ae697829fa04fca58637aedbbda7be62d084624748a0c3be6554d96191639ba74c0983a33a780b4710941a8754fa49b9bb5e1c7f6871a297746e696c5d4d
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfdxvpnkfcxvsnk.sys

Path C:\Temp\nhfdxvpnkfcxvsnk.sys
Size 293KB
SHA256 d30dbe81095c64dd33fc917a1f2437b9b98c510740258d9ef6edac6dfd0d299b
MD5 dabe3bfc8190412d7c861e676e98fd36
SHA1 318ebc798958994bd664d6b8cdd1ca458c2eb55f
SHA512 d6defb2f7e777983168dcc11ac4623249eb6bf51851adf01691062d643aeb4523a97263828c39b1a3504ec4b94f42cdbbc4a37196855f15ef93845721fcda8fd
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T13D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxupmh.sys

Path C:\Temp\pmhfzxupmh.sys
Size 293KB
SHA256 a27b93cd58f19a36d438f98e094faed4f75079a713b2f9f6fa53f1b822bf51b7
MD5 dfb1a3e75aef797c1218dccc332f7c62
SHA1 608311e1621a67d24f7679201f1f215bb3e35868
SHA512 344d0b9fe1da0a25aed09411c7733ff03391f736bfea6538dfa5d21736569b67f6a74f3a071297a8994a63a24ec08295840fac6fb3a3ffd3656ea45574f4fe91
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T114545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfdxspi.exe

Path C:\Temp\spnhfdxspi.exe
Size 389KB
SHA256 2f98b21cf9c0c67f47ab74837fa3c66400e82136acf145857ff15c0f6902a1f2
MD5 965e502e624d8616ea995a3d4c596c8e
SHA1 eec26de92808adcafcfcdb81e3cb0a3057846e48
SHA512 49efd7030522377ca72120c065da1bbbb5a7334b8f922b32759829a46a844243191b15cda68847c2a95e617954cf14506be856a6ba820f40128a8c35e95eb026
SSDEEP 3072:Ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtol.exe

Path C:\Temp\trljdbwtol.exe
Size 389KB
SHA256 1663c5f4bcfa96bc51a1f77387afada2f6c7142580a332c4eaffcc32bc1412ee
MD5 d50350e62d9eb04bb302a11f6b945498
SHA1 770c5b37663f24cf921dbd04720cb692d82487d6
SHA512 d509f515e0668f379c2abcff3dda45567c3a74d59c099ab71ce433414de7d54ac6279da2e8e6fcf59809dfe1e5930dba34a06c46345b4385c2aacd7fa1bda6b1
SSDEEP 3072:4uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwupmecwuo.exe

Path C:\Temp\zwupmecwuo.exe
Size 389KB
SHA256 06c843f3341fce9663999fb73d0fb85ccd14f63997c1c4de528e4d6d9a0ab5a2
MD5 18cb01ce3aee809429f5938aa2044b12
SHA1 d4e420464b1ddcb370fbb45dac8de5de49144dbe
SHA512 e04ce2b88ef89d0c4f15993568291619c0cc2bee4258dcdcdb906ea259543a19bf253975c35362bc5e720321a3d03396403c5bf4dc2501cc7b2d638c0125517f
SSDEEP 3072:Zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T122847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8fd41f1379a27630ee1671899d37f3d005dc5185b474436735e4a397acecff61
MD5 241d4a20bb7d08cf827bec4a24d4ffcc
SHA1 9609127b82325ca3b1bd5b8f215ad955d8ac4e0e
SHA512 07b53b7167f55149a15b7bf1eab96a410a7d29e53ff00e07767495e4424ea2fd8f206432ade8217efdb329e011db264a2d085604cc0cbf79fa085c863efb6229
TLSH
T10851A9824184E3D1CB5C4373A5C565C776709BFC978F1E33A8E0E768971E702B25C844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a29b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a29b1.TMP
Size 3KB
SHA256 9fde3e548d3d4eb6ff7737fe6188b58cd0fa390bb3891f7ee653a75f081ed6ee
MD5 a3e0b42c4d02085c3295d5459204d82a
SHA1 2bde4938b3eedf33d707a75516b009c6b3c0dbed
SHA512 a226f5bbf1ba1941819ff0f49b1732367e06af397af2e8a388a198cdbc87fdfbc068c8b68bd0ef3b29c5a47636fc66826c74261b4457d1485b905e8976d54237
TLSH
T1765198824284E3D1CB5C4373A5C565C77A709BFC978F1E33A8E0EB649B1E702B25C854
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c87220ddf7fafbbb1f39d8731d5960192fe1fdd2fd2a7494db5f0b69a6186867
MD5 d0eef7b85a1b3903ef7dbff2339974aa
SHA1 27c0347b23582d96a912308387fe8209168b42e2
SHA512 14e331c6d28612e228d34d0118348ae95ea009cc54c6842ea267b9ac31b5d549ae50315fa9a71634dfbf11a776c716c304be544f0f84cdf63ee3792b991ffc13
TLSH
T1C551C0F3C3E8866D890156F0AB186E2BCE1D0954832C3D5AC8E4EF1B93E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aedb6f6d07e46cae57b22a094dd6d55abe547fc416feefe5eafb4fb0e3230f9e
MD5 62b69c4741f33f642008bf5723dbefe0
SHA1 11035867ffd78d9e70d8d43bc06e2276bae31a2a
SHA512 a2e39aee4559d79822d67acb8c7854d309a4979eb34fb9e915eca2feba0639f6e05cfe65ed4642cb90cacb741c0ce5b7ff25d4d2918fc635130608243f9b4e88
SSDEEP 192:sxRoRUCW/fsksUhZdKzoA8pi/g6+WNIY2hcNGmIgVUJ:sxRolW/fsksUvti/5Isp6
TLSH
T16C32A819AD28A97B8CC7D21DFB697F53D2F9103360945E48EAFC8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 04f1d9469d652e8b9c079e796b2f83322cf1d19a0f1c784ea6d23890d7254bc0
MD5 1c85b34c8fcdd8920b9d23a03cb3092e
SHA1 6a3b943a2e0ab682a20779a73e60545b74c8f5dc
SHA512 c018666a46b5be4fba7dbede79d8f79a186aad30fcca0557fd373c244b5331fdc3df731a14fe458af2fa975f2906ee254f03fcb2b277fd7f39d31434bb4130a4
SSDEEP 192:sxRvRUCW/fsksDhZdezoA8p9h/g6+WNCIP/Y2+cNGmIgDPUJ:sxRvlW/fsksDvl//55/Fpk
TLSH
T12142A719AD28A97B8CC7D619FB557F53E2F9103390941E48AAFC8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0d56ca2d543d48356791f6cf7453041267a845b4112e6283f49632c01fe07c9c
MD5 b9593301ac1a9f25e1b2538044079acc
SHA1 033bf8971ef0c67bdbda824bad22720803a35316
SHA512 84df94e8534b2c8bc89e84936df2ca58a6949dac0b79cc9709bfddf2f8308890c41537b3719361e8a80e601f86cb10f560783650cd97bb21f91651fca6f2c647
SSDEEP 192:sxRvRUCW/fsksOhZdKzoA8pi/g6+WNIY2hcNGmIgD1UJ:sxRvlW/fsksOvti/5Isp+
TLSH
T14832A719AD28A97B8CCBD21DFB657F53D2F9103360945E48EAFC8A1C04EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ee8446bdd0517058c53ee72eb0744ec1f0ee93820dab22d6c3ab118883cd3788
MD5 db6f4b6dcf7489ccb663ea25c4e1c2f4
SHA1 d30ffbee2e20e87da87e34df272a7625a3269d5d
SHA512 24d06c1239cbc2da86bfb324e99a21e79b136bbeae6249a57429cbe93563e9753bdbfe44ab5df07ab57c59c802359cf488087a05d8aca63b32fdc73b31495007
SSDEEP 768:L7aaqW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV06FdNM+roHi:L7aaq2Eb6DWgptfvDu1jaz6FrMVC
TLSH
T169D2EA7B640CCB7F4F900ADDEC197E9F6D6802CB9698CD4047FA945C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7a3186d-252f-4633-a3db-6f12b6ebab2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f7a3186d-252f-4633-a3db-6f12b6ebab2d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3970e81cadb0449cd6494bad8756cbd4cf624a39de4146f98344ee01013a19c8
MD5 75651a30c62ef8239725146ca5ef14f2
SHA1 55c578b2ad331398460f5294318e98999340047a
SHA512 9d7697983f778d2451a9034e73cdd1477266ba32e584c910f00ff5764a5d44cb8dacfc28aef378e1a7006b4f86dd1e951bbc5662d2f41c92067495e3300cbb8c
SSDEEP 768:LO3OFxWgm1d8HKbDmGA5b65Q92RQMPbAhYGH3Mf:LO384dAF65dQLhYU3I
TLSH
T135F2BF71ECA5DDB35CBDA181764377457FF8416394CC8A9494E9AF1D0483A8E031BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ba41a626106003be726fb98997159e2b03cb957983a146b67b01379d0eeedb09
MD5 4e3d770ff51eab96a467b4840e35985b
SHA1 0deb74df2a0ac812f86a96c0b4c8637905446fbe
SHA512 a8c0154605bf09c901f4dfdb1d785823543863a711aa4395712012767bbfe551be85b2506e13ea4da48b12728fe12150e51f41435f40d91de8c77dcb691172c0
SSDEEP 768:iO3XFbWgm1d8HK4DmGA5b65Q92RQMPbAhYGH3Mf:iO31+YAF65dQLhYU3I
TLSH
T1C0F2BF71ECA5DDB39CBDA181764373467FB8416394CC8A9494E9AF1D0483A8E031BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bee2656a3d096f878b4a5f22d5a5554f84eb8af20b1ea8be5edbfe87e3e3dbae
MD5 3e5471eabea4e8b2389c9459ab85f2a0
SHA1 a116a3b6e99e4341154142731ad7b46f4f52101b
SHA512 6011997977bd27103c3b5cd3a36606dbc65fd48b7746073cc3d839ea9dd791f80c40557ec86188fb0514c1fe71d95d170c3a63337d18f651030c322c629476cd
SSDEEP 768:U/UxvxjgC+B33W6ngm1d1tDmGA5b65Q92RQMPbyFj0O:BZj3+B3Gu3AF65dQdFQO
TLSH
T15103C036ECA1AEB7DCF55280364BA35AAFF84473C1C955E049F96F1D06C768C830B85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0e07bb55932cbd4532f797c2f3db910c00eaf53fc23e0274c73ab057f8308d13
MD5 09332105225d2341d73a076b0eb1a92c
SHA1 cbd27e16f243cf29b62b032d73fc48375613a3e6
SHA512 9916d7cf3b39771a4b3a6664185d7241182cae0147a0b13ed466591e682002ac54ce553f43c90b556db2a79513f45d4e4e622829f6a54586977cec350d89bcc3
SSDEEP 768:iO3uFJWgm1d8HKQDmGA5b65Q92RQMPbAhYGH3Mf:iO3cQwAF65dQLhYU3I
TLSH
T128F2BF71ECA5DDB39CBDA1817643B7457FB8416394CC8A94E4E9AF1D0583A8E030BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 510e02380a33a37281fee24dc7df80fc76125bbb4b5877fa856dcd6f4fe7f8aa
MD5 8f1004fcce7ef760c8a7244906b5e14d
SHA1 1e81058896351d81afa94194ac1543a87e5f4a5b
SHA512 d02ae4875339812328a68af83274606588af168b9c5f4272ac772971aac83ce694dba8b673a46411e2e8702eb424c519da5e218642d7023843a1375435ff35c1
SSDEEP 768:QFHY3awguF7ZGe1d8HGDmGA5b65Q92RQMPbAhYGH3Mf:gY3D7AF65dQLhYU3I
TLSH
T1C21327F698D38A77E8AD5383673D6E459EBCC063B4888994B7D45D0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

8f38bbed-51a0-4367-9d11-799eb9d4f397.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f38bbed-51a0-4367-9d11-799eb9d4f397.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2740_1357224003\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 75d39f825ca276450ffb5eecbd011ffe38774cb8868906fe2216ecee1ec5640a
MD5 a9df583e5319528773e063aacdd436a9
SHA1 6b0cee0a0e8989fe97d52cf9d9bd5c7035949859
SHA512 12a56ec1bf0a8dcd9f7658d328271f72b4f3d7d3ef13c673d8bd54330771816f9c7cc7da0f279c8c6795caf0cedd4669488cf1df928fa5603704a35d412ba638
TLSH
T1A3710093A6B9DAF2C1DA5BF002835644F5BB2278072360244B515986AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1672-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2348-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2668-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2752-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-218-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3016-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3168-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4948-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5372-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5684-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download