systex | cbe472c1c1609a334df72dfaddb97af9b76fe19fb5663f6ac08df70a03136d6d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260629-ejrm5scw9v
SHA256 cbe472c1c1609a334df72dfaddb97af9b76fe19fb5663f6ac08df70a03136d6d
MD5 ad47448562d39ea7f8ce3517b8af508f
SHA1 7c04934623acc3a61a1aa7cca19d44d765c21849
SHA512 d22f1bb51f86732183298d965d8830e0204bc8d395378530adbcb6866eadf7e7f0efa4391cf5406de43e6da0f591f2042868f799b29f953a5bd81c92fdb75290
SSDEEP 3072:/T6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:L6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1420	mkecxupnhfzxrpkh.exe
4628	mkecxupnhfzxrpkh.sys
5712	CreateProcess.exe
1484	pkhfzxspkc.exe
772	CreateProcess.exe
2216	CreateProcess.exe
4776	i_pkhfzxspkc.exe
4420	kecwupmkec.sys
4228	CreateProcess.exe
3756	hezxrpjhbz.exe
564	CreateProcess.exe
6108	CreateProcess.exe
5524	i_hezxrpjhbz.exe
5512	pmgecwuomh.sys
2452	CreateProcess.exe
2076	mjebztromg.exe
2268	CreateProcess.exe
2196	CreateProcess.exe
1444	i_mjebztromg.exe
5904	geywuolgey.sys
2404	CreateProcess.exe
2584	dbytrljdbz.exe
4356	CreateProcess.exe
3296	CreateProcess.exe
2168	i_dbytrljdbz.exe
2480	vtqojgbytr.sys
2964	CreateProcess.exe
2524	ljgaywqnlj.exe
4796	CreateProcess.exe
1428	CreateProcess.exe
3840	i_ljgaywqnlj.exe
1096	oigdyvtnli.sys
5512	CreateProcess.exe
2688	ligaytqlid.exe
1188	CreateProcess.exe
1204	CreateProcess.exe
5620	i_ligaytqlid.exe
1672	dxvpnifays.sys
4144	CreateProcess.exe
1712	sqkigaysqk.exe
1968	CreateProcess.exe
964	CreateProcess.exe
2632	i_sqkigaysqk.exe
2324	nkifzxvsnk.sys
1172	CreateProcess.exe
3884	spnhfcaxsq.exe
2960	CreateProcess.exe
5420	CreateProcess.exe
2804	i_spnhfcaxsq.exe
2568	icaxvpnhfa.sys
4804	CreateProcess.exe
3688	pmkhcausmk.exe
5580	CreateProcess.exe
616	CreateProcess.exe
5820	i_pmkhcausmk.exe
3680	xupnhfzxup.sys
3592	CreateProcess.exe
1160	uspnhezwur.exe
4888	CreateProcess.exe
3692	CreateProcess.exe
4580	i_uspnhezwur.exe
2204	uomjhezxrp.sys
2056	CreateProcess.exe
3344	uomhezxrpj.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1927097768\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_828707229\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1065630164\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1897532000\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1927097768\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1927097768\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1927097768\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1065630164\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5528_1897532000\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dausnkfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aurpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgaywqnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbywqolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxspkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxspkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtqlifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dausnkfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aurpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgaywqnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtqlifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbywqolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebztromg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1736	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2544	ipconfig.exe
5028	ipconfig.exe
1888	ipconfig.exe
1384	ipconfig.exe
5468	ipconfig.exe
4872	ipconfig.exe
2812	ipconfig.exe
2860	ipconfig.exe
5672	ipconfig.exe
548	ipconfig.exe
2352	ipconfig.exe
2572	ipconfig.exe
2680	ipconfig.exe
428	ipconfig.exe
5556	ipconfig.exe
2264	ipconfig.exe
3784	ipconfig.exe
3260	ipconfig.exe
5684	ipconfig.exe
6024	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271791231583521"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{3D645ED0-1C3F-4F9C-BB10-EE5A9A041398}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe
1420	mkecxupnhfzxrpkh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	i_pkhfzxspkc.exe
Token: SeDebugPrivilege	5524	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	1444	i_mjebztromg.exe
Token: SeDebugPrivilege	2168	i_dbytrljdbz.exe
Token: SeDebugPrivilege	3840	i_ljgaywqnlj.exe
Token: SeDebugPrivilege	5620	i_ligaytqlid.exe
Token: SeDebugPrivilege	2632	i_sqkigaysqk.exe
Token: SeDebugPrivilege	2804	i_spnhfcaxsq.exe
Token: SeDebugPrivilege	5820	i_pmkhcausmk.exe
Token: SeDebugPrivilege	4580	i_uspnhezwur.exe
Token: SeDebugPrivilege	1536	i_uomhezxrpj.exe
Token: SeDebugPrivilege	5280	i_mgeywqojgb.exe
Token: SeDebugPrivilege	6008	i_dbywqolgdy.exe
Token: SeDebugPrivilege	2036	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	1396	i_dyvtqlifdx.exe
Token: SeDebugPrivilege	3564	i_dausnkfaxv.exe
Token: SeDebugPrivilege	5036	i_spkicausmk.exe
Token: SeDebugPrivilege	2320	i_aurpnhfzxs.exe
Token: SeDebugPrivilege	4400	i_xrpjhczurm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1420	2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2052 wrote to memory of 3968	2052	2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3968 wrote to memory of 5528	3968	iexplore.exe	91
PID 5528 wrote to memory of 4960	5528	msedge.exe	92
PID 5528 wrote to memory of 5632	5528	msedge.exe	93
PID 5528 wrote to memory of 1736	5528	msedge.exe	94
PID 5528 wrote to memory of 5632	5528	msedge.exe	93
PID 5528 wrote to memory of 5632	5528	msedge.exe	93
PID 5528 wrote to memory of 3232	5528	msedge.exe	96
PID 5528 wrote to memory of 3232	5528	msedge.exe	96
PID 5528 wrote to memory of 2508	5528	msedge.exe	97
PID 5528 wrote to memory of 2508	5528	msedge.exe	97
PID 5528 wrote to memory of 2508	5528	msedge.exe	97
PID 5528 wrote to memory of 2308	5528	msedge.exe	98
PID 5528 wrote to memory of 2308	5528	msedge.exe	98
PID 5528 wrote to memory of 2308	5528	msedge.exe	98
PID 5528 wrote to memory of 1036	5528	msedge.exe	99
PID 5528 wrote to memory of 1036	5528	msedge.exe	99
PID 5528 wrote to memory of 1036	5528	msedge.exe	99
PID 5528 wrote to memory of 5864	5528	msedge.exe	100
PID 5528 wrote to memory of 5864	5528	msedge.exe	100
PID 5528 wrote to memory of 5864	5528	msedge.exe	100
PID 5528 wrote to memory of 1236	5528	msedge.exe	102
PID 5528 wrote to memory of 1236	5528	msedge.exe	102
PID 5528 wrote to memory of 3784	5528	msedge.exe	105
PID 5528 wrote to memory of 672	5528	msedge.exe	106
PID 5528 wrote to memory of 3784	5528	msedge.exe	105
PID 5528 wrote to memory of 672	5528	msedge.exe	106
PID 5528 wrote to memory of 1052	5528	msedge.exe	108
PID 1420 wrote to memory of 5712	1420	mkecxupnhfzxrpkh.exe	110
PID 1484 wrote to memory of 772	1484	pkhfzxspkc.exe	114
PID 5528 wrote to memory of 4888	5528	msedge.exe	117
PID 5528 wrote to memory of 4888	5528	msedge.exe	117
PID 5528 wrote to memory of 1160	5528	msedge.exe	118
PID 5528 wrote to memory of 1160	5528	msedge.exe	118
PID 1420 wrote to memory of 2216	1420	mkecxupnhfzxrpkh.exe	119
PID 1420 wrote to memory of 4228	1420	mkecxupnhfzxrpkh.exe	123
PID 3756 wrote to memory of 564	3756	hezxrpjhbz.exe	125
PID 1420 wrote to memory of 6108	1420	mkecxupnhfzxrpkh.exe	128
PID 1420 wrote to memory of 2452	1420	mkecxupnhfzxrpkh.exe	132
PID 2076 wrote to memory of 2268	2076	mjebztromg.exe	134
PID 1420 wrote to memory of 2196	1420	mkecxupnhfzxrpkh.exe	137
PID 1420 wrote to memory of 2404	1420	mkecxupnhfzxrpkh.exe	142
PID 2584 wrote to memory of 4356	2584	dbytrljdbz.exe	144
PID 1420 wrote to memory of 3296	1420	mkecxupnhfzxrpkh.exe	147
PID 5528 wrote to memory of 2204	5528	msedge.exe	149
PID 5528 wrote to memory of 3520	5528	msedge.exe	150
PID 5528 wrote to memory of 1196	5528	msedge.exe	151
PID 1420 wrote to memory of 2964	1420	mkecxupnhfzxrpkh.exe	154
PID 2524 wrote to memory of 4796	2524	ljgaywqnlj.exe	156
PID 1420 wrote to memory of 1428	1420	mkecxupnhfzxrpkh.exe	159
PID 1420 wrote to memory of 5512	1420	mkecxupnhfzxrpkh.exe	163
PID 2688 wrote to memory of 1188	2688	ligaytqlid.exe	165
PID 1420 wrote to memory of 1204	1420	mkecxupnhfzxrpkh.exe	168
PID 1420 wrote to memory of 4144	1420	mkecxupnhfzxrpkh.exe	172
PID 1712 wrote to memory of 1968	1712	sqkigaysqk.exe	174
PID 1420 wrote to memory of 964	1420	mkecxupnhfzxrpkh.exe	177
PID 1420 wrote to memory of 1172	1420	mkecxupnhfzxrpkh.exe	181
PID 3884 wrote to memory of 2960	3884	spnhfcaxsq.exe	183
PID 1420 wrote to memory of 5420	1420	mkecxupnhfzxrpkh.exe	186
PID 5528 wrote to memory of 3668	5528	msedge.exe	188
PID 5528 wrote to memory of 3668	5528	msedge.exe	188
PID 1420 wrote to memory of 4804	1420	mkecxupnhfzxrpkh.exe	194
PID 3688 wrote to memory of 5580	3688	pmkhcausmk.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad47448562d39ea7f8ce3517b8af508f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Temp\mkecxupnhfzxrpkh.exe
  C:\Temp\mkecxupnhfzxrpkh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxspkc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5712
  - - C:\Temp\pkhfzxspkc.exe
      C:\Temp\pkhfzxspkc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxspkc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2216
  - - C:\Temp\i_pkhfzxspkc.exe
      C:\Temp\i_pkhfzxspkc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4228
  - - C:\Temp\hezxrpjhbz.exe
      C:\Temp\hezxrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\i_hezxrpjhbz.exe
      C:\Temp\i_hezxrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebztromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2452
  - - C:\Temp\mjebztromg.exe
      C:\Temp\mjebztromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebztromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2196
  - - C:\Temp\i_mjebztromg.exe
      C:\Temp\i_mjebztromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytrljdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2404
  - - C:\Temp\dbytrljdbz.exe
      C:\Temp\dbytrljdbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytrljdbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3296
  - - C:\Temp\i_dbytrljdbz.exe
      C:\Temp\i_dbytrljdbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgaywqnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\ljgaywqnlj.exe
      C:\Temp\ljgaywqnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgaywqnlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1428
  - - C:\Temp\i_ljgaywqnlj.exe
      C:\Temp\i_ljgaywqnlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligaytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5512
  - - C:\Temp\ligaytqlid.exe
      C:\Temp\ligaytqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligaytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1204
  - - C:\Temp\i_ligaytqlid.exe
      C:\Temp\i_ligaytqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\sqkigaysqk.exe
      C:\Temp\sqkigaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:964
  - - C:\Temp\i_sqkigaysqk.exe
      C:\Temp\i_sqkigaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Temp\spnhfcaxsq.exe
      C:\Temp\spnhfcaxsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5420
  - - C:\Temp\i_spnhfcaxsq.exe
      C:\Temp\i_spnhfcaxsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\pmkhcausmk.exe
      C:\Temp\pmkhcausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\i_pmkhcausmk.exe
      C:\Temp\i_pmkhcausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspnhezwur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3592
  - - C:\Temp\uspnhezwur.exe
      C:\Temp\uspnhezwur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspnhezwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3692
  - - C:\Temp\i_uspnhezwur.exe
      C:\Temp\i_uspnhezwur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2056
  - - C:\Temp\uomhezxrpj.exe
      C:\Temp\uomhezxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    PID:5744
  - - C:\Temp\i_uomhezxrpj.exe
      C:\Temp\i_uomhezxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    PID:5820
  - - C:\Temp\mgeywqojgb.exe
      C:\Temp\mgeywqojgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    PID:2968
  - - C:\Temp\i_mgeywqojgb.exe
      C:\Temp\i_mgeywqojgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbywqolgdy.exe ups_run
    3⤵
    PID:4872
  - - C:\Temp\dbywqolgdy.exe
      C:\Temp\dbywqolgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbywqolgdy.exe ups_ins
    3⤵
    PID:1900
  - - C:\Temp\i_dbywqolgdy.exe
      C:\Temp\i_dbywqolgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    PID:4404
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    PID:1096
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtqlifdx.exe ups_run
    3⤵
    PID:5668
  - - C:\Temp\dyvtqlifdx.exe
      C:\Temp\dyvtqlifdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtqlifdx.exe ups_ins
    3⤵
    PID:2672
  - - C:\Temp\i_dyvtqlifdx.exe
      C:\Temp\i_dyvtqlifdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dausnkfaxv.exe ups_run
    3⤵
    PID:2556
  - - C:\Temp\dausnkfaxv.exe
      C:\Temp\dausnkfaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dausnkfaxv.exe ups_ins
    3⤵
    PID:3092
  - - C:\Temp\i_dausnkfaxv.exe
      C:\Temp\i_dausnkfaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run
    3⤵
    PID:6040
  - - C:\Temp\spkicausmk.exe
      C:\Temp\spkicausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    PID:5708
  - - C:\Temp\i_spkicausmk.exe
      C:\Temp\i_spkicausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aurpnhfzxs.exe ups_run
    3⤵
    PID:5168
  - - C:\Temp\aurpnhfzxs.exe
      C:\Temp\aurpnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aurpnhfzxs.exe ups_ins
    3⤵
    PID:2664
  - - C:\Temp\i_aurpnhfzxs.exe
      C:\Temp\i_aurpnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run
    3⤵
    PID:2016
  - - C:\Temp\xrpjhczurm.exe
      C:\Temp\xrpjhczurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins
    3⤵
    PID:3636
  - - C:\Temp\i_xrpjhczurm.exe
      C:\Temp\i_xrpjhczurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    PID:4952
  - - C:\Temp\wrojhbztrm.exe
      C:\Temp\wrojhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2264
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff5171c188,0x7fff5171c194,0x7fff5171c1a0
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,873763155265516004,10083880262935931013,262144 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,14314431071691852809,2593943390531395648,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,6249209885355593535,6886302076112024647,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,5789285608384511997,2201331837947907989,2097152 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,9509431801191827902,17169123831667345021,2097152 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,6867381760239479763,18197128567688767354,2097152 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,3590150606119297698,8549988241950215976,2097152 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,5194551539326763832,13695487305568866975,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,9076438603632726262,3640936342426798135,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,8201648832211533939,15312349793947033470,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11938692192558833578,14555683056117346261,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11938692192558833578,14555683056117346261,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16722645004428510564,17718221589590913529,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,9701999839826347072,5588561075340389436,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7964346483743503086,18395817048734668137,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16756674737490881973,13911167420254792757,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,12444264239827916934,3108519247751106364,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,5074313530193605695,1378699370147334884,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,9717504217048043316,4155755087639609763,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11440396295439405687,16087603487588398462,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,18125450483780967279,13240973750211466735,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6796,i,7403326347019053193,12129764789331088836,262144 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:10
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,10130508680381724275,16188601096292652675,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,14072533380229170920,9441173922966471626,524288 --field-trial-handle=2272,i,2358883559986351558,17117795760535246652,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4808

C:\Temp\mkecxupnhfzxrpkh.sys
C:\Temp\mkecxupnhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5408

C:\Temp\kecwupmkec.sys
C:\Temp\kecwupmkec.sys
1⤵
- Executes dropped EXE
PID:4420

C:\Temp\pmgecwuomh.sys
C:\Temp\pmgecwuomh.sys
1⤵
- Executes dropped EXE
PID:5512

C:\Temp\geywuolgey.sys
C:\Temp\geywuolgey.sys
1⤵
- Executes dropped EXE
PID:5904

C:\Temp\vtqojgbytr.sys
C:\Temp\vtqojgbytr.sys
1⤵
- Executes dropped EXE
PID:2480

C:\Temp\oigdyvtnli.sys
C:\Temp\oigdyvtnli.sys
1⤵
- Executes dropped EXE
PID:1096

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
- Executes dropped EXE
PID:1672

C:\Temp\nkifzxvsnk.sys
C:\Temp\nkifzxvsnk.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\icaxvpnhfa.sys
C:\Temp\icaxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:2568

C:\Temp\xupnhfzxup.sys
C:\Temp\xupnhfzxup.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\uomjhezxrp.sys
C:\Temp\uomjhezxrp.sys
1⤵
- Executes dropped EXE
PID:2204

C:\Temp\omgezwqojg.sys
C:\Temp\omgezwqojg.sys
1⤵
PID:5624

C:\Temp\olgdbztroj.sys
C:\Temp\olgdbztroj.sys
1⤵
PID:5676

C:\Temp\ljdbvtnlgd.sys
C:\Temp\ljdbvtnlgd.sys
1⤵
PID:3564

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
PID:2380

C:\Temp\icaxvqnifa.sys
C:\Temp\icaxvqnifa.sys
1⤵
PID:4532

C:\Temp\causnkifax.sys
C:\Temp\causnkifax.sys
1⤵
PID:5796

C:\Temp\usmkhczxup.sys
C:\Temp\usmkhczxup.sys
1⤵
PID:6096

C:\Temp\cwuomhezxr.sys
C:\Temp\cwuomhezxr.sys
1⤵
PID:1412

C:\Temp\urmjebztrp.sys
C:\Temp\urmjebztrp.sys
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbytrljdbz.exe

Path C:\Temp\dbytrljdbz.exe
Size 376KB
SHA256 11fc1be5f002eafaa97edce466873862f09ce9e6dd1769e34fbc59ee4f669357
MD5 6d84eed8012ca9a3eb73b05caeab3e95
SHA1 4b99050cf7b835a22efc28845f9009de50ea9d2e
SHA512 9249ed85a85daaac5dbac752d31d60c259890a2a742f19e504c7ea5b6828a81951e551f0b1a1810c50bdd9e37a536583772f39af1489b737b400d7c4c73a0955
SSDEEP 3072:FT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:J6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T181847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywuolgey.sys

Path C:\Temp\geywuolgey.sys
Size 293KB
SHA256 06051030573993782ec5e8525cf109136351c310119b8d1fada792ea29ed226b
MD5 04399af40c161c78ed6d8dd12a6a2934
SHA1 a3231b0b8d3cbb74f0fb76259c861cd47d94e4e1
SHA512 4fa79959593209d68a112e785ccc2e1ec582e515e770976226113e32d10891f8f3872fb577beaffcdb197c3eceac5812c64ce62a83ebb1aad3e71e5547332d21
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhbz.exe

Path C:\Temp\hezxrpjhbz.exe
Size 376KB
SHA256 65fad5590ea91fc87b341c9f4494c1c7b2a0160825ba59dec4447b8e389df28a
MD5 c39e4addeea83c41978729ded6027943
SHA1 4c91ae66a43c3826df44dd93f98849c0165cc49a
SHA512 bc1ddb2cb456f7be260076be854bc6461a99328a5f46911f55f695eab583d06856751e363e8258bf5ce644725fdfb1ebeaa325cdff4187b94e20538f5d1ca639
SSDEEP 3072:LT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:n6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytrljdbz.exe

Path C:\Temp\i_dbytrljdbz.exe
Size 376KB
SHA256 ad571a621540bbd8c1a39121b530b38119b39bb45a08df38f3577df4f70b6456
MD5 2af0062571c18b5e9f0154ba3eabc3c7
SHA1 1bc04344a151875374e826a61a369b42287bb52b
SHA512 4bdd55bb713d9c9e5c166a1d5ae103decc7ae0126902c3a13f235518562269c03785f3be61314a5f78f5ba99f6d52612c291f640beb40e35bd84e6671cb99b0e
SSDEEP 3072:mT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:86LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11F847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxrpjhbz.exe

Path C:\Temp\i_hezxrpjhbz.exe
Size 376KB
SHA256 b27dcdafc3ae353d2a81a9a9a7c786b9a98d7279963fa0ed444f9c1a38c568f6
MD5 f7f8c361593db5936f0c1d5e8ca5aeaa
SHA1 d8ff9f03dfac0e0899f99cb48acd2632c3885710
SHA512 febfe91018029fcc937e1e741e6dbe21ce54151b6e5469545a11a38b2703f6d0c1783cc2b15b1e7d00d784b8755adddf2c37b3d5db93a8b7b034f64b0b6cf5af
SSDEEP 3072:IT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:m6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T187847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljgaywqnlj.exe

Path C:\Temp\i_ljgaywqnlj.exe
Size 376KB
SHA256 00b1c30278e1a09d7a30d1359d83acd211e6c5ed56d073a2527bfb4c2b89c46d
MD5 4ea657ea44cfb0ce1fda5bcad2646850
SHA1 cfd3d159f61fe3f9b10d1c39d0396ca130f2998a
SHA512 c0c2bc306e44b924d3e60d64199ae26f82862ca4551dacef74de7066a7074931904d9ea9084015af66a119683d259dd71d3e9fbdaf963f97218d748f33a3d142
SSDEEP 3072:rT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:H6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjebztromg.exe

Path C:\Temp\i_mjebztromg.exe
Size 376KB
SHA256 c16f2527f3a543d8006ace7577440e162a7dcbcac98ddd7baa32c7918f4e4277
MD5 634db1b48b2defb1a5cc32bcf88898fc
SHA1 b8ee414b68e466c0591f604e8b697318640e0d8d
SHA512 31bf36a0044c4dcc38204e64b098dbb6269a668fed7deaa88ebc6abe517e4eeb79decd1b67e8022a7991f504e0bdfc63b104c72a8fce59b0e03f10e530606f9c
SSDEEP 3072:MT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:K6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T175847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhfzxspkc.exe

Path C:\Temp\i_pkhfzxspkc.exe
Size 376KB
SHA256 22a8a88e3091824f3d5ad2fd0c3ef8c122ca75a425f86307143fccb5d21192c8
MD5 a41f222ad559fbca60764ecc7d40719d
SHA1 29d00387bacfb68e798d476acc1fe0d83a00073f
SHA512 f93dda77fb20a49119d91934166669d4db3e211ed889662802b57f64a752249873f1ac6301b5af579da10ba053777f8f93ca6451d620124dcfc4703c9750c12f
SSDEEP 3072:iT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:I6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmkec.sys

Path C:\Temp\kecwupmkec.sys
Size 293KB
SHA256 161fd268137b0b2beb39aae010eb89627691b3c1474ecd92945488970c0d6d2b
MD5 6f4fd540539ddca44ae562e0ffdf9630
SHA1 3aee47d44a242992886cf00c2a14e3106121679f
SHA512 cd09d7bcefe8f91b9451641ef6db0a0b79b9d5556c957de4fd523ae7d5ee7650da8f0b28e4a276ffcf98a7f56e1b4c15094e8d917007f02444fac68dabc38c03
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T116545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligaytqlid.exe

Path C:\Temp\ligaytqlid.exe
Size 376KB
SHA256 da8d49fbfd9bf59e73bae9a71c1fa9eadd7986858722202f3ce0224b78198d55
MD5 2935c1953b0e907e6258ac3b86838ce0
SHA1 32bae370e6fe34c6e22ffb400428ce62d3c4b5e4
SHA512 5484a0c7d22ef474b229863c0a28391cfa7a8f3f558292fb7d8ba1ede73651e1a8fb46c3dcb3ca32725e6a8e3d7f0df09629693f63586d3033dbf9fac8a471e3
SSDEEP 3072:HT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:z6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T175847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgaywqnlj.exe

Path C:\Temp\ljgaywqnlj.exe
Size 376KB
SHA256 84d2a7fe1868896e9a6b57f0d49b2610db89815effb4e5300a1a37f719d99625
MD5 bfbb1568ec1304c8bbbc80090a620850
SHA1 18e4f778058f4b9c4bab71534f28174a2ef7ccbf
SHA512 22f9be3802bd28ca57b92a060c049f8f626b5461d00c19d18b8ba8e794214f79e995d527a40f687b1f422381766d2c3d89714125d9fe7225226382294eae5c1f
SSDEEP 3072:rT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:H6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebztromg.exe

Path C:\Temp\mjebztromg.exe
Size 376KB
SHA256 a4996172d96c076ca32499c43b8779c4111d7e23c5b50d70f4d8a0b191a6baff
MD5 a4dfd6d847b2f5782b6e67641c02e011
SHA1 1a6f9b1c9076051f3f9f9292944fa388b0df9c2c
SHA512 b5489304a6f50b4e5ac46b86103e90fe3591113b8307c4a2c2a60c5d932ee2f7e4a54b8ed9be76bbd184c0c60f40c2308fdb46d98f2c9db091a0ff9626911bf8
SSDEEP 3072:IT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:m6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupnhfzxrpkh.exe

Path C:\Temp\mkecxupnhfzxrpkh.exe
Size 376KB
SHA256 b225b99cc433750692613e95dcca029ec7c771934f24e94ba072df482798bd62
MD5 c1babe2955e935275b0a432e8579036d
SHA1 c3fbe7dc042e44dffcd785eeff92af9dcbdca605
SHA512 6b523395aa76ca6b27a409511b46885a2625230cbc721225dc6478d21d4586d797a8dd553536f984a361e6320043ba2fb6c00bb3d2d0a630b78de351289621ff
SSDEEP 3072:8T6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:a6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupnhfzxrpkh.sys

Path C:\Temp\mkecxupnhfzxrpkh.sys
Size 293KB
SHA256 cb618988863470e2376be2954a20302fb44f658353a834b5b033ba5c8f9317dc
MD5 4c6d1a7f3e23fce3b562846bc77ad402
SHA1 8b6559e5f63c416463d6343894970ea1c3223cdc
SHA512 cd078a47aedc248d1a50fceddd3ff4453136a3d2911d5394a23f0a4b7c9a7a0310011a454c1bb04a042ad1433fb89b08ce5c05b026e2c7acdd9bcce88303e720
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdyvtnli.sys

Path C:\Temp\oigdyvtnli.sys
Size 293KB
SHA256 f9f99820cb6ecd562392620e5a88e7ca6eb286930ec0e5799ed3f72e5da93618
MD5 b43175b81d6917e62d069bfaba806298
SHA1 b9a32fedfd379075c989e6c7a30678dea36ad26d
SHA512 a68b36959f69050e3e7cd7c68db6e463e2745f7dad21c2832753dc950f854dc6a867068e0911efe6c42a0c177b6b0ee1a424e91aeeb999ee122d9094c373b4b0
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T167545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhfzxspkc.exe

Path C:\Temp\pkhfzxspkc.exe
Size 376KB
SHA256 cb60f68857e6cadacc5ead86edb377dc24536f897bd788d9ad18dfe2d1009723
MD5 27e612ec62061da3e6cccb9d72927e44
SHA1 45bc2e33f22f7eafc0d8b156f4bb8da8bf7c8ef9
SHA512 3798de8f4d1a40972204925fdae8b2227f6e23287fc6fa5d8ed9b7269c9a910f56afdd3e6d709e5075f7b928af26acaf970d6afbfca4abbc1e163c219004fb93
SSDEEP 3072:JT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:d6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmgecwuomh.sys

Path C:\Temp\pmgecwuomh.sys
Size 293KB
SHA256 52b16a4dfc23f9bf1b1c0090668075206c78097aed5f1963ba52163ea66dd5ca
MD5 b5346db3fa149e9f0b0151969050b817
SHA1 0f973b1d595d7d7d32b8d58addfbf6896cebfddb
SHA512 93261589983d44a7ea8a5954e50f68c0c5cbd659f0ab7e864af17eca07b44cf49c0b4b0b33359654685928a0332c1b7f0b87e64d25f386e73b5961fc1c2141d6
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqojgbytr.sys

Path C:\Temp\vtqojgbytr.sys
Size 293KB
SHA256 909d11e3dcf01ed6e1a0ef82d643ead7e9dd805c3a28747078bb3f8a52700be2
MD5 dd2b5c0d64dd0754456bf6f844336d04
SHA1 4361585f12453a2b920ea2ee71e61182bfe354f7
SHA512 02b864c9aff2bda3ee78eb7ddc4369be24f4d652daf4e01203c115391e2d93643f5a8bc6124c5b02293a68df0b9390e59a9b5fc1e52d413724cb9c3416a1b233
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5edb3d9fed4fc4b2ed998c2daafb0762cd4f7664f53c186fe03c04eefb0b0671
MD5 87a62619563697d9caeb4d810c1d8b8d
SHA1 1c4808c2e96eed2a5f89921e9a22a43f5b8f5f13
SHA512 7b375cd5e0cb6b04c80adc13de6e9d6827131d6fde559538a97b7de29025a76f78454fe02c097ac886997feaaee43b19a6f85f130c54807b8c1dfa22ec8947ac
TLSH
T1266130F043A94566E7B745B9A4D15C8AB370F4AC0A872F275CECEC38B9057462BC581F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5952d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5952d9.TMP
Size 3KB
SHA256 3876b5e0266f8c1162d776a90fe0b13606ae072f857446aa1b2df2cfa4973cbc
MD5 e07ac1e6073631ca998df5b29ee27ac2
SHA1 4858ce544c02ab8a09ce29057eb85bda742772ba
SHA512 7781094a36091dec49faf91dee585e9ff279ffca406047834b2b4fce00e0b2879d232d81f69c266992a1a4b3e82634baab084552ec1e87363d669d424a5852fe
TLSH
T1076150F043994566E7B741B5A4D15C9AB3B0F8AC0A832F275CECEC38B9057062BC581F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cd80c3c09ccf5b2c4cc6f6a4dc0a7a98d1f1219fe51a3bdfd1223d4c6dc3d5c7
MD5 fb5769938e45c6a465cd4b53b1e7b400
SHA1 0bed8fc67d0be799549231f82a70f0c581e0431e
SHA512 0ad5a15fa8b31f3a2770f41ea95e2eff86f5d81d2a6d1fe9827cc1c412eb85aa05a1a8f87ebdc4a96cea48da9e2ab5fc10ae3b572acb069df6c7f51bdc2f7997
TLSH
T178518CF3C2E8856EC91196F0AB186E2BCE1D0954832C3D9A89E4AF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8f35ecb2d823d44024f94900d20a7e52c4d75a11a5508a5670707b366fa72521
MD5 84eea11f6b02065cfe04eee1511488ee
SHA1 ec77e1283623c4ac329396e61c4a8b0593ed74a0
SHA512 647007a1523e3eb4eb164329491f22751e2dd27b17194c6f552a966cac2387df205ea96b9f6fb91fd7176f07e37fb809a8932a8fcc5167a2eb8b2e17a14fa646
SSDEEP 192:sxRURGyM/jK1Ml8wc1/fnsfIN0ZhHrkzoA8p9a/g6+WNCGV/YZf5GDTNIgV8J:sxRUcC1/fnsfINKNJ8/5J/5S
TLSH
T1B462DA15AA34997BCCDBD309FA517F53D6F81473A2911E48AAFC8A0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 47585bec933b08f1b812254334647631ee8a59884290e4c5a17468413a96fbe6
MD5 b706a39d30da0b8dc41b65dc2d81d38f
SHA1 142cb484ba766636ed4b804c26313e90e9a333e0
SHA512 27bfa5fd2ce89e2ce89f43a7ab479ad06b5ad568ebb0ad7c8ae793454c8aa0d926e3cb724573d09bf81864ce47e0aa788d32798b448032dd10112192aca7cc67
SSDEEP 192:sxRDRGyM/jK1Ml8wc1/fnscNIN0ZhHrkzoA8p9a/g6+WNCGV/YZf5GDTNIgDS8J:sxRDcC1/fns6INKNJ8/5J/5p
TLSH
T18462DA16AA34597BCCDBD309FA517F53D6F81473A2911E48AAFC8A0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab5d80c09ab75bb8d0844467c05d723495dfffc11e9ad18dbaebf3b5479f6387
MD5 482db2932e45920563fca872003183c9
SHA1 40f06ad921afc11e85916dfd8a521a2f79f38efe
SHA512 f0f306a70c4cd4b4fad55019801e02544bf1db2bbdf7711a7a49ea016af34455cc7b8f4a01a2aaf0f9ea8b1afe01c842e198846f75e46cb635f41381f5624e85
SSDEEP 192:sxRDRGyM/jK1Ml8UQrc1/fnscNIs0ZhHrkzoA8pra/g6+WNCGV/YZn5GDTNIgDom:sxRDcqw1/fns6IsKNJ2/5J/Hi+
TLSH
T1AA62E956A934993BCCDBD309FA517F53D6F85473A2910E48AAFC8A0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2069cf31c19409874b722e0ef0ead032ae50dcc1f00744b10829173c54f20407
MD5 2d152ba0a445b349421f27bff67210db
SHA1 23998865fa90b63668f0fd4c9adda7026b94a9d2
SHA512 b2db07bb590e97cafe924ba2018dca39b816b2a6532b863eb075f0c29f856d3ff1b400da7662526a8c1a6a4194ef623c2632653f9d83a4a35fc3652225576455
SSDEEP 768:eOEtpf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV+hREkTqQsro7ov:eOEtpZE7ZIWgKgf16u1jath2/Q3888L
TLSH
T1ACE2EB3B680CCB7E4F404A9CED2A7E9F6DE801CB96D8C95447EA840C03C67EB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 16778cf035a81d198e842432699da8de95c728b635d2cdaeb3ad8ddd9de5cc0a
MD5 dbc0647553e0dcd13752e8c22634e772
SHA1 721da6fe5818a5d7b021703e6a9d3f83b79472e1
SHA512 936e3225431a41ccf0d7aa2a2a9a18a67fc86628163bdd8b3ae6c4d4229c767c3e669dd393862a62e078769b4a42e97ccffd787ca306058b9b506e657f1056f9
SSDEEP 96:Kb121j161m1k1A1U1gg1o151zu1u1gKm11u181gK1e1u1J1c1W1t9klAkKqKKgyV:AVZ/A/J
TLSH
T10FA1874470F6270428BF660E8194956F028330BB7246BA3B7BA914E65F2BE401FFD5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1066d9bb2a8ee79ecf591551d8d55daf9382b47de9ee21f6378154aaca145aa3
MD5 29fc42fa637848188b2216970927e1ee
SHA1 fde62bf5ce69fcdecfa73afb486bb3d896e7eb6a
SHA512 a1eba5fd4435906891acf086262f06f2bf7cf47c891c5a7fe9e7d5eafd01bc0626c5a96b4b6f5a6f59cdf2b3b4cc648f8686f4ff6518789871c58f5309746e7e
SSDEEP 768:EjaeqD4MlshiLdMma352PfcOXfX1V5R4HTytYYqgHvPg2yjWtxjTo:EqcjhIdMh3cfrfFWTwJHyj2y
TLSH
T1B403CF7AECB85CBB8CB29685770277976EB84293C3C52B64D9DC560D019B6CF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fb6518de1d290d222766f1b032ebc4a2c0efa98c72df367bf9381233c8334d82
MD5 10d9177227ba82acd2b0604a63b9686f
SHA1 4c7643cfa8f089aee9eac33fce155c576cf8fa11
SHA512 be101c8df16a2d53a3ac2a7a4b3cb03d0c94aa7079e5e707e88b19fa1a63a02b262344d15a8510b4ce16ba7de2759d5240d3aad099049566898e18d2b11d67e1
SSDEEP 768:RjaeqD4MlshiLdMmf3K5cPfcOXfX4fnV5R4HTytYYqgHvPwvMyjWtxUTL:RqcjhIdMo3LfrfofTWTwJJyj22
TLSH
T15313CFB5ECB89C774CB6D281721377D76EB442A3C3C12B68D9D8460D098B6DE270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 da3441aa42c61c8173f170ad659759d1eb65a5d7858bd0b64d569a48ef179c33
MD5 f7bb75502ab126bca38a71666ed61933
SHA1 ae837b05a0cf254cf4b2ed913be4e43cde0cc599
SHA512 adb8bf1edbf7321ab59023a01450b8c766f2a2e58655cd26baf48b633b09578774a8d36eec5e9f4905672bf1abb648b439ae7b260fa1c7adb319da1911d2c140
SSDEEP 768:1j+913gvxKfcOXfX4fZV5R4HTytYYqgHvPwvMzn12bfJjU:A913TfrfofxWTwJJByJjU
TLSH
T1801318F4D8E78936D89E8387633D2E8669BCC16372881994B7D84E4DCC876BFD706805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9e01f53f4c35dc9e6065892967949647b96282709fe1d7bc3aea5b2944558cde
MD5 c1636e8e1d9e2a7934ef4794b36f649a
SHA1 deadeb155e188fb1eab1c55ed965f2ba1cf8cf44
SHA512 a4b3c1d87f07c1e43511793486b0062c833b6ca025b434fe4dcb17828b29f0285c758c6de6b7ae38add8e63a7ac6307f4dfd915eaaac428c208f0aab155757d9
SSDEEP 768:hj+9V3gbcPfcOXfX4fKV5R4HTytYYqgHvPwvMzn12bfJjU:89V3FfrfofcWTwJJByJjU
TLSH
T1B0F2AF71ECB88D675DD2D78572123787BEE842B392C41B54C9D88F0D09CBADE274B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

0cff3a85-b6ed-4d27-bb46-31027e14ec80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0cff3a85-b6ed-4d27-bb46-31027e14ec80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5528_668815555\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ffe874587fe4180072e07402de761d417cb90ea2e3eec2dd3862441a99027eb5
MD5 c8f035058c846e1e6b294bf60217103a
SHA1 e0a4984a951f9e6279aed462dcceedfb01dc06be
SHA512 9264d530872fe30b8c8771348713e5337729057db73bcccf43785b59e990b2209778420d95040d54d507bb82de64fca0911044f64620bdb000d6990632785093
TLSH
T10571008356B9D9B2C1DA5FF002835648F2BB2238072360214B51598AAA30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1412-508-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1672-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2204-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2204-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2324-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2380-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2480-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2480-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3564-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3680-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4420-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4532-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5512-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5676-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5796-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5904-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6096-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download