systex | 8ca4749dba0efae946e3ba2e52bd7fb1096db6c0bdddb90df7896fac40301570

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260701-a2a1wsbw4l
SHA256 8ca4749dba0efae946e3ba2e52bd7fb1096db6c0bdddb90df7896fac40301570
MD5 10d4be3edb406c28f3b42b12fbf7f28b
SHA1 17e55f2f7a247d552046ade5233016a023446089
SHA512 d2ab0a9127b2781a977297f919e98651c675f2abde260cbd1a5e0fee438a5fdb56e087a9899212e0f7c011ed415b6652d0c52bc530f074098f5cfd2680836451
SSDEEP 3072:1FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4552	dxvpnifaysqkfdxv.exe
3616	dxvpnifaysqkfdxv.sys
5872	CreateProcess.exe
2532	caxvpnhfax.exe
5012	CreateProcess.exe
5008	CreateProcess.exe
3024	i_caxvpnhfax.exe
360	nhfcauspnh.sys
3380	CreateProcess.exe
3060	hfcxusmkic.exe
4836	CreateProcess.exe
2960	CreateProcess.exe
3028	i_hfcxusmkic.exe
2764	fzxrpkhczu.sys
1064	CreateProcess.exe
3032	zxrpjhczus.exe
5656	CreateProcess.exe
2084	CreateProcess.exe
2316	i_zxrpjhczus.exe
5596	jhbzwrpmhe.sys
1640	CreateProcess.exe
5476	jhbzwurlje.exe
2516	CreateProcess.exe
4304	CreateProcess.exe
2152	i_jhbzwurlje.exe
2892	rojgeywroj.sys
3716	CreateProcess.exe
2860	bztrljebwq.exe
2432	CreateProcess.exe
5696	CreateProcess.exe
3416	i_bztrljebwq.exe
1068	bwtrljdbvt.sys
2376	CreateProcess.exe
2820	bztroigdbv.exe
792	CreateProcess.exe
5248	CreateProcess.exe
2016	i_bztroigdbv.exe
5556	gdbytqlidb.sys
2448	CreateProcess.exe
3460	dbvtnlgdyw.exe
4736	CreateProcess.exe
1144	CreateProcess.exe
5888	i_dbvtnlgdyw.exe
3152	xvqnigaysq.sys
2560	CreateProcess.exe
1432	qnifaysqki.exe
3756	CreateProcess.exe
252	CreateProcess.exe
5956	i_qnifaysqki.exe
3260	ysqnifdxvq.sys
4840	CreateProcess.exe
2700	fcavsnkfca.exe
4536	CreateProcess.exe
1572	CreateProcess.exe
1264	i_fcavsnkfca.exe
3264	kicausnkfc.sys
4632	CreateProcess.exe
3232	kfcxvpnhfa.exe
5432	CreateProcess.exe
4380	CreateProcess.exe
4796	i_kfcxvpnhfa.exe
5888	kecauspnhe.sys
1368	CreateProcess.exe
3152	khfzxrpmke.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_2064321862\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1935120102\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_377874182\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1922430728\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1922430728\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1922430728\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1935120102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_377874182\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1922430728\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwurlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxrpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztroigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljgbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdbvtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxrpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdbvtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxusmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxusmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljgbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifaysqkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwurlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztroigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcavsnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcavsnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnkfca.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4448	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1400	ipconfig.exe
5996	ipconfig.exe
5604	ipconfig.exe
1428	ipconfig.exe
2076	ipconfig.exe
5320	ipconfig.exe
4748	ipconfig.exe
4752	ipconfig.exe
2512	ipconfig.exe
1172	ipconfig.exe
2576	ipconfig.exe
3256	ipconfig.exe
5244	ipconfig.exe
3616	ipconfig.exe
3748	ipconfig.exe
1340	ipconfig.exe
2656	ipconfig.exe
1172	ipconfig.exe
2388	ipconfig.exe
5744	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273401307640912"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{BA95221C-3940-4376-9335-7B07B8C40B22}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe
4552	dxvpnifaysqkfdxv.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	i_caxvpnhfax.exe
Token: SeDebugPrivilege	3028	i_hfcxusmkic.exe
Token: SeDebugPrivilege	2316	i_zxrpjhczus.exe
Token: SeDebugPrivilege	2152	i_jhbzwurlje.exe
Token: SeDebugPrivilege	3416	i_bztrljebwq.exe
Token: SeDebugPrivilege	2016	i_bztroigdbv.exe
Token: SeDebugPrivilege	5888	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	5956	i_qnifaysqki.exe
Token: SeDebugPrivilege	1264	i_fcavsnkfca.exe
Token: SeDebugPrivilege	4796	i_kfcxvpnhfa.exe
Token: SeDebugPrivilege	2456	i_khfzxrpmke.exe
Token: SeDebugPrivilege	6120	i_hezwrpjhbz.exe
Token: SeDebugPrivilege	964	i_bzwrojhbzt.exe
Token: SeDebugPrivilege	876	i_ojgbytrljd.exe
Token: SeDebugPrivilege	3028	i_tqljgbytqo.exe
Token: SeDebugPrivilege	4876	i_ifdbvtnlfa.exe
Token: SeDebugPrivilege	4916	i_ifaysqcaus.exe
Token: SeDebugPrivilege	2876	i_caxspnkfca.exe
Token: SeDebugPrivilege	1020	i_hecxusmhfz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 4552	5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5520 wrote to memory of 2608	5520	2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2608 wrote to memory of 5172	2608	iexplore.exe	90
PID 5172 wrote to memory of 2692	5172	msedge.exe	91
PID 5172 wrote to memory of 4420	5172	msedge.exe	92
PID 5172 wrote to memory of 4448	5172	msedge.exe	93
PID 5172 wrote to memory of 4420	5172	msedge.exe	92
PID 5172 wrote to memory of 4420	5172	msedge.exe	92
PID 5172 wrote to memory of 5800	5172	msedge.exe	95
PID 5172 wrote to memory of 5800	5172	msedge.exe	95
PID 5172 wrote to memory of 2568	5172	msedge.exe	96
PID 5172 wrote to memory of 2568	5172	msedge.exe	96
PID 5172 wrote to memory of 2568	5172	msedge.exe	96
PID 5172 wrote to memory of 3464	5172	msedge.exe	97
PID 5172 wrote to memory of 3464	5172	msedge.exe	97
PID 5172 wrote to memory of 3464	5172	msedge.exe	97
PID 5172 wrote to memory of 2104	5172	msedge.exe	98
PID 5172 wrote to memory of 5920	5172	msedge.exe	99
PID 5172 wrote to memory of 2104	5172	msedge.exe	98
PID 5172 wrote to memory of 2104	5172	msedge.exe	98
PID 5172 wrote to memory of 5920	5172	msedge.exe	99
PID 5172 wrote to memory of 5920	5172	msedge.exe	99
PID 5172 wrote to memory of 3180	5172	msedge.exe	100
PID 5172 wrote to memory of 3180	5172	msedge.exe	100
PID 5172 wrote to memory of 5744	5172	msedge.exe	104
PID 5172 wrote to memory of 5812	5172	msedge.exe	105
PID 5172 wrote to memory of 5744	5172	msedge.exe	104
PID 5172 wrote to memory of 5812	5172	msedge.exe	105
PID 5172 wrote to memory of 3436	5172	msedge.exe	107
PID 4552 wrote to memory of 5872	4552	dxvpnifaysqkfdxv.exe	108
PID 5172 wrote to memory of 4976	5172	msedge.exe	110
PID 5172 wrote to memory of 4976	5172	msedge.exe	110
PID 2532 wrote to memory of 5012	2532	caxvpnhfax.exe	114
PID 5172 wrote to memory of 5320	5172	msedge.exe	117
PID 5172 wrote to memory of 5320	5172	msedge.exe	117
PID 4552 wrote to memory of 5008	4552	dxvpnifaysqkfdxv.exe	118
PID 4552 wrote to memory of 3380	4552	dxvpnifaysqkfdxv.exe	122
PID 3060 wrote to memory of 4836	3060	hfcxusmkic.exe	124
PID 4552 wrote to memory of 2960	4552	dxvpnifaysqkfdxv.exe	127
PID 4552 wrote to memory of 1064	4552	dxvpnifaysqkfdxv.exe	131
PID 3032 wrote to memory of 5656	3032	zxrpjhczus.exe	133
PID 4552 wrote to memory of 2084	4552	dxvpnifaysqkfdxv.exe	136
PID 4552 wrote to memory of 1640	4552	dxvpnifaysqkfdxv.exe	141
PID 5476 wrote to memory of 2516	5476	jhbzwurlje.exe	143
PID 4552 wrote to memory of 4304	4552	dxvpnifaysqkfdxv.exe	146
PID 5172 wrote to memory of 1944	5172	msedge.exe	148
PID 5172 wrote to memory of 5076	5172	msedge.exe	149
PID 5172 wrote to memory of 1952	5172	msedge.exe	150
PID 4552 wrote to memory of 3716	4552	dxvpnifaysqkfdxv.exe	153
PID 2860 wrote to memory of 2432	2860	bztrljebwq.exe	155
PID 4552 wrote to memory of 5696	4552	dxvpnifaysqkfdxv.exe	158
PID 4552 wrote to memory of 2376	4552	dxvpnifaysqkfdxv.exe	162
PID 2820 wrote to memory of 792	2820	bztroigdbv.exe	164
PID 4552 wrote to memory of 5248	4552	dxvpnifaysqkfdxv.exe	167
PID 4552 wrote to memory of 2448	4552	dxvpnifaysqkfdxv.exe	171
PID 3460 wrote to memory of 4736	3460	dbvtnlgdyw.exe	173
PID 4552 wrote to memory of 1144	4552	dxvpnifaysqkfdxv.exe	176
PID 4552 wrote to memory of 2560	4552	dxvpnifaysqkfdxv.exe	180
PID 1432 wrote to memory of 3756	1432	qnifaysqki.exe	182
PID 4552 wrote to memory of 252	4552	dxvpnifaysqkfdxv.exe	185
PID 5172 wrote to memory of 4300	5172	msedge.exe	187
PID 5172 wrote to memory of 4300	5172	msedge.exe	187
PID 4552 wrote to memory of 4840	4552	dxvpnifaysqkfdxv.exe	193
PID 2700 wrote to memory of 4536	2700	fcavsnkfca.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_10d4be3edb406c28f3b42b12fbf7f28b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Temp\dxvpnifaysqkfdxv.exe
  C:\Temp\dxvpnifaysqkfdxv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\Temp\caxvpnhfax.exe
      C:\Temp\caxvpnhfax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxvpnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5008
  - - C:\Temp\i_caxvpnhfax.exe
      C:\Temp\i_caxvpnhfax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxusmkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\hfcxusmkic.exe
      C:\Temp\hfcxusmkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxusmkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2960
  - - C:\Temp\i_hfcxusmkic.exe
      C:\Temp\i_hfcxusmkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1064
  - - C:\Temp\zxrpjhczus.exe
      C:\Temp\zxrpjhczus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2084
  - - C:\Temp\i_zxrpjhczus.exe
      C:\Temp\i_zxrpjhczus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzwurlje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1640
  - - C:\Temp\jhbzwurlje.exe
      C:\Temp\jhbzwurlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzwurlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4304
  - - C:\Temp\i_jhbzwurlje.exe
      C:\Temp\i_jhbzwurlje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebwq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3716
  - - C:\Temp\bztrljebwq.exe
      C:\Temp\bztrljebwq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebwq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Temp\i_bztrljebwq.exe
      C:\Temp\i_bztrljebwq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztroigdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2376
  - - C:\Temp\bztroigdbv.exe
      C:\Temp\bztroigdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztroigdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5248
  - - C:\Temp\i_bztroigdbv.exe
      C:\Temp\i_bztroigdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2448
  - - C:\Temp\dbvtnlgdyw.exe
      C:\Temp\dbvtnlgdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1144
  - - C:\Temp\i_dbvtnlgdyw.exe
      C:\Temp\i_dbvtnlgdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2560
  - - C:\Temp\qnifaysqki.exe
      C:\Temp\qnifaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\i_qnifaysqki.exe
      C:\Temp\i_qnifaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcavsnkfca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4840
  - - C:\Temp\fcavsnkfca.exe
      C:\Temp\fcavsnkfca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcavsnkfca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Temp\i_fcavsnkfca.exe
      C:\Temp\i_fcavsnkfca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Temp\kfcxvpnhfa.exe
      C:\Temp\kfcxvpnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Temp\i_kfcxvpnhfa.exe
      C:\Temp\i_kfcxvpnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxrpmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1368
  - - C:\Temp\khfzxrpmke.exe
      C:\Temp\khfzxrpmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxrpmke.exe ups_ins
    3⤵
    PID:3944
  - - C:\Temp\i_khfzxrpmke.exe
      C:\Temp\i_khfzxrpmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwrpjhbz.exe ups_run
    3⤵
    PID:2980
  - - C:\Temp\hezwrpjhbz.exe
      C:\Temp\hezwrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhbz.exe ups_ins
    3⤵
    PID:3900
  - - C:\Temp\i_hezwrpjhbz.exe
      C:\Temp\i_hezwrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwrojhbzt.exe ups_run
    3⤵
    PID:5328
  - - C:\Temp\bzwrojhbzt.exe
      C:\Temp\bzwrojhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwrojhbzt.exe ups_ins
    3⤵
    PID:2776
  - - C:\Temp\i_bzwrojhbzt.exe
      C:\Temp\i_bzwrojhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbytrljd.exe ups_run
    3⤵
    PID:2656
  - - C:\Temp\ojgbytrljd.exe
      C:\Temp\ojgbytrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbytrljd.exe ups_ins
    3⤵
    PID:1564
  - - C:\Temp\i_ojgbytrljd.exe
      C:\Temp\i_ojgbytrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljgbytqo.exe ups_run
    3⤵
    PID:2188
  - - C:\Temp\tqljgbytqo.exe
      C:\Temp\tqljgbytqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljgbytqo.exe ups_ins
    3⤵
    PID:5104
  - - C:\Temp\i_tqljgbytqo.exe
      C:\Temp\i_tqljgbytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdbvtnlfa.exe ups_run
    3⤵
    PID:2044
  - - C:\Temp\ifdbvtnlfa.exe
      C:\Temp\ifdbvtnlfa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdbvtnlfa.exe ups_ins
    3⤵
    PID:2252
  - - C:\Temp\i_ifdbvtnlfa.exe
      C:\Temp\i_ifdbvtnlfa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqcaus.exe ups_run
    3⤵
    PID:4120
  - - C:\Temp\ifaysqcaus.exe
      C:\Temp\ifaysqcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqcaus.exe ups_ins
    3⤵
    PID:4892
  - - C:\Temp\i_ifaysqcaus.exe
      C:\Temp\i_ifaysqcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnkfca.exe ups_run
    3⤵
    PID:6096
  - - C:\Temp\caxspnkfca.exe
      C:\Temp\caxspnkfca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnkfca.exe ups_ins
    3⤵
    PID:3264
  - - C:\Temp\i_caxspnkfca.exe
      C:\Temp\i_caxspnkfca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecxusmhfz.exe ups_run
    3⤵
    PID:5468
  - - C:\Temp\hecxusmhfz.exe
      C:\Temp\hecxusmhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecxusmhfz.exe ups_ins
    3⤵
    PID:2212
  - - C:\Temp\i_hecxusmhfz.exe
      C:\Temp\i_hecxusmhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxrpjhezw.exe ups_run
    3⤵
    PID:5304
  - - C:\Temp\ezxrpjhezw.exe
      C:\Temp\ezxrpjhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa77fdc188,0x7ffa77fdc194,0x7ffa77fdc1a0
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14994012243303753060,8082432228745020048,262144 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,12131179691051369035,3167726310211118401,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,6631348547962031105,2486419416554093955,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,8466065116573414096,5419672036217427500,2097152 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,3452949905433468115,8478086389852353306,2097152 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,14277515294386385127,17367879189485816623,2097152 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:9
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,7347576773242546922,2080184745801722096,2097152 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,310008627932975763,3444665674433798433,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,16584566115311893243,9008243512979758193,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,2624618343208989019,5081551110701288830,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9606209243416973661,17770813686909615624,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9606209243416973661,17770813686909615624,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,17780504861551927119,17389629320239477882,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,13031326402432033534,11924034070933867107,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,18187910741305085304,2710735954092586314,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,14832219601574274221,12227467806009723397,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,18080694792562206010,7670328090780356072,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,2661624925363501622,14587075524759995281,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,4562936106118395317,16790248730698141876,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,8863997777260301202,3384840248991608429,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,1801213425837093165,7626279774493149078,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6404,i,11556636586450679504,8147280811800094162,262144 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:10
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,7008070961045722078,2689800310033243295,524288 --field-trial-handle=2324,i,2082519024797082633,17929417222911727896,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1948

C:\Temp\dxvpnifaysqkfdxv.sys
C:\Temp\dxvpnifaysqkfdxv.sys
1⤵
- Executes dropped EXE
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3204

C:\Temp\nhfcauspnh.sys
C:\Temp\nhfcauspnh.sys
1⤵
- Executes dropped EXE
PID:360

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\jhbzwrpmhe.sys
C:\Temp\jhbzwrpmhe.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\rojgeywroj.sys
C:\Temp\rojgeywroj.sys
1⤵
- Executes dropped EXE
PID:2892

C:\Temp\bwtrljdbvt.sys
C:\Temp\bwtrljdbvt.sys
1⤵
- Executes dropped EXE
PID:1068

C:\Temp\gdbytqlidb.sys
C:\Temp\gdbytqlidb.sys
1⤵
- Executes dropped EXE
PID:5556

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
- Executes dropped EXE
PID:3152

C:\Temp\ysqnifdxvq.sys
C:\Temp\ysqnifdxvq.sys
1⤵
- Executes dropped EXE
PID:3260

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
- Executes dropped EXE
PID:3264

C:\Temp\kecauspnhe.sys
C:\Temp\kecauspnhe.sys
1⤵
- Executes dropped EXE
PID:5888

C:\Temp\jhbzurmjec.sys
C:\Temp\jhbzurmjec.sys
1⤵
PID:6140

C:\Temp\jhezwuomke.sys
C:\Temp\jhezwuomke.sys
1⤵
PID:3220

C:\Temp\jhbzwtomge.sys
C:\Temp\jhbzwtomge.sys
1⤵
PID:2664

C:\Temp\trligbytrl.sys
C:\Temp\trligbytrl.sys
1⤵
PID:6140

C:\Temp\vqoigdyolf.sys
C:\Temp\vqoigdyolf.sys
1⤵
PID:2148

C:\Temp\sqoigaysql.sys
C:\Temp\sqoigaysql.sys
1⤵
PID:1876

C:\Temp\fdxvsqkifa.sys
C:\Temp\fdxvsqkifa.sys
1⤵
PID:1088

C:\Temp\kfcxuspkic.sys
C:\Temp\kfcxuspkic.sys
1⤵
PID:200

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtrljdbvt.sys

Path C:\Temp\bwtrljdbvt.sys
Size 293KB
SHA256 1e529d1fe6f330c2ab3adb6401c863cdc3ed0a709f12e3b45cf04736ef0cd697
MD5 14a295eaedfe282bb27c8859fcf549d2
SHA1 50639736dcf59b00c9522a5890487e5f6a579c04
SHA512 a52140f2ac2aa15c757484fd83498471bac12944bfed0fe5172bffcfac57146e81d9c996b0fdb224597278c18033108ea384d799ca8b6d109f37c641a051c4e0
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T12C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwq.exe

Path C:\Temp\bztrljebwq.exe
Size 376KB
SHA256 fa259c868add7ce8740b1a21a34de2da3c023c9c0a63e5e6c6a3a6c9abf3b001
MD5 f6bdf410a0c3d23e6c1b3d6f8277cc5f
SHA1 f76451e3851a4701f44ab1ebd5124ab02b2ec1d1
SHA512 24b72ae721a4c9d4511551f0bc0660ea396a6852ed7e13c0520605325c583ce9bd0eaf7249cfed28edf997b66d1eac40882ea94ed28333d13a7cc9c970915f2a
SSDEEP 3072:WFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztroigdbv.exe

Path C:\Temp\bztroigdbv.exe
Size 376KB
SHA256 b32000b79a19464d3d0dabb3b4f88565d3d34586fe36fe4ea1e721233d7328ab
MD5 a18e457381114711a75cd4407ea81f45
SHA1 d4e73303ae16aed6841e6a3cac6f007da61f6361
SHA512 06799b48c4a1f21aaa0d044d4301c28f2aa5c2ce7975866ec33c7628821ae032ad5cd763421cb0a3f9e218bf5dcbc9938947225fc7edec089e08358c218cde41
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxvpnhfax.exe

Path C:\Temp\caxvpnhfax.exe
Size 376KB
SHA256 3c2296ec2a0f2856dc24fc83ef7ee056e120a8a60ce4537061f6f41981feed10
MD5 8553dbaf61bf95980af4cf88d74fffcc
SHA1 b56d46d21834f0e36be56342da67f70b301b2632
SHA512 df94022000db47aeedbc60adf008a94ba41b420bf84363d32d26c750267b69371208f72886a524a41d8e2fcd54da0ab69e2b4fec1b21178effddad6e437760a3
SSDEEP 3072:zFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifaysqkfdxv.exe

Path C:\Temp\dxvpnifaysqkfdxv.exe
Size 376KB
SHA256 2e8e90b9c51d370a4108d073638ac9aa5586e19ed4eabfe3baeb8077d6839f42
MD5 c1996763e553b5945e615aad9e55d8ed
SHA1 729d092162485638fe26cdd2baab1b0c589eb50f
SHA512 b56410c86d439d638559c45d14f57b260ff16d5669729cdd96d54010a20a4fba72b1a7c638fc217cabed3f52182b3d3ee5635ef0800856de4d0c405aecab9cbf
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifaysqkfdxv.sys

Path C:\Temp\dxvpnifaysqkfdxv.sys
Size 293KB
SHA256 3da23761c0de9bbe9c33675d884d084d53a98fb6a3fd4193b96dadaca3238cfa
MD5 ce6f62b64a4ab77ed07245c985a76856
SHA1 a8d13a01a45bc94cd415b5056f31c0d4d13bf00f
SHA512 add6d644345bc1a763b27debf42a02079dbdd6acef157e90643e2f5787df9e7e1ad734474400ef5e393df3a7c558c6a9eec9453e04283cf1006ee6cb729b7aed
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhczu.sys

Path C:\Temp\fzxrpkhczu.sys
Size 293KB
SHA256 eba941e9a9d12842e1eeab42d129082fffe74956410633cc82589e373c90bec2
MD5 bbb4a711d9eab29f1039e406cee4907d
SHA1 921b6847ae28050cb288c1108d8dc16deb50c91e
SHA512 d83cba663a53b72083fe1441ea55a554497d14df0b5f067e83464fc8d9416ef12e9d38e6cf5fdf95697591b5f3e287a1b82fcec3e1825f0bce53e0d86f943ee3
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxusmkic.exe

Path C:\Temp\hfcxusmkic.exe
Size 376KB
SHA256 f6b630665068cda0b5ca44ac859caf67f035047eef2787c92ec0964dd4920909
MD5 8fbb003c23e551a60a4877a228baf271
SHA1 7cd44a464eedf8a0d85a2899c414220269db7675
SHA512 c888100ad9cff9e6cf1ce7a150e3f86f572d319591e52746d49f10a3b01e022e711228f598f920f9d16a3560865679bf63a1a290576df012d2994a2aaa56296f
SSDEEP 3072:oFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:oFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljebwq.exe

Path C:\Temp\i_bztrljebwq.exe
Size 376KB
SHA256 81e872bb3b70cab6208f3c4f8805889adbf3432c1ca1917cd8ac39f8f3e34e01
MD5 ec9be01dbe53bee36fe4921639b3a52f
SHA1 6f8474985822cacceb8bd6731a727c5a2c0991ce
SHA512 b4b46aee30fb31664f96140d438086b2ef549bdbdd5103b18caf82e7eb230753380f804d172fef419be39fef152fe1afc3b00ca860efe42134a9690f6f25773a
SSDEEP 3072:XFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caxvpnhfax.exe

Path C:\Temp\i_caxvpnhfax.exe
Size 376KB
SHA256 98c66739f26c874d32fd8e2c12248f2fe214f010f8550e7b046a88eaaaf28a0d
MD5 888e59f9ca24c1ab3530688955c7e708
SHA1 782e57615708170e3a9b0a4f4db50175a6bd037d
SHA512 9ec1395f992d0b4e6a181451566f6dc61176030e38ae704a910c44b4ed9bbdf0bab0268bd876aa6be2b3dfa82f944807eef9bdb90de0b0554d2d7dd35d5f36a0
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcxusmkic.exe

Path C:\Temp\i_hfcxusmkic.exe
Size 376KB
SHA256 a3a8e27debb5fc60003bcad4010680876063f510118ae9ff865f7bed5db49249
MD5 76b2fb3421abb7b7c31370304bedfe76
SHA1 60772303da51ec33b007cf67a362e527f1d0553e
SHA512 3b2370648b723ec0bb92cdfebb6ea325aa890547b45c298e5361d3f7ab4a75ebad0f9b860a0787dbd343ea864abdf093ab830865bcb00f299ffe0acead258778
SSDEEP 3072:UFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzwurlje.exe

Path C:\Temp\i_jhbzwurlje.exe
Size 376KB
SHA256 511134c95d367cd011b22f038661de39f24d4b33ec3d881e7b677e9036566843
MD5 814aae92b718688be029c6eed492de96
SHA1 de1d73189ccabd2322260cbffcbb0f9537280b33
SHA512 f50257f0d30f08d3d8acace45fb1ad07a6a710ee88491115c072d66720b375472ea243b2a1d938a8335eb03dbd21cd769ab0668269bb95d821556b345ca5cf77
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhczus.exe

Path C:\Temp\i_zxrpjhczus.exe
Size 376KB
SHA256 a7dfaeb4425ef20f441961a6cb94bc59dfef424d337babdc8449437a5714e8b9
MD5 0a8fe9b3999defcc8e9490c2fd0eea5d
SHA1 c94c08c629df01e26a36514d48205a88f4fba577
SHA512 29e93122324439cab4589f33649dbec69189c68d6b4f121c89d04a432395a6350e32199469a7663c9d49c31eb88a372254d6dbc89e9aba10e6c5d03f32788c0c
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwrpmhe.sys

Path C:\Temp\jhbzwrpmhe.sys
Size 293KB
SHA256 21f6de37993dae6dad923fa856dd84efb2f05f36d3165e133611af0ebff10276
MD5 73dcc4d4e32e32a83c93848ce5af8845
SHA1 f8dca9be0e947aa8e14698a06b339cfb93225ead
SHA512 6a1743002b82159ec2e38adf996f8cad12cc7ea94c41c096fe5fcbb79551c08acd9fe20cbfd6d0014e0ca821d6cca567cb9c5bb95e60217c7120b50f560937c9
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T187545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwurlje.exe

Path C:\Temp\jhbzwurlje.exe
Size 376KB
SHA256 222c90a373e0519c1c15bfccb1abee0d7823006e999891ee2af8a1428013a222
MD5 a6e3e82b01761db0001b31e2155f870e
SHA1 4f7abbb2e656d5c10ce2a255e930a997d3ab58f6
SHA512 a40f0b9f005bc25e92c8247a7a5190fdc16761803160bf24da693f39e7bd9c525bc7bac93b52853058abf3c72276f33ff4489bb9651ececf6e9cdc516aecffb8
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcauspnh.sys

Path C:\Temp\nhfcauspnh.sys
Size 293KB
SHA256 b4ec21bb2d1cbe808fa5cf937408756847d4edaae0b0d622c7099f9c30ab1ab5
MD5 928f3a73b105b68df69653c4a3cb15ad
SHA1 638b69e89951490d98fed2b5e93fc425364daddb
SHA512 63dfe748cd226760170c188921e5841f72fd75f4b828722ac3c3cef14be1c5bb2a70e4a046cccb17924666d7354e792c31454d05c3cc4b20151720dd8c013f86
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgeywroj.sys

Path C:\Temp\rojgeywroj.sys
Size 293KB
SHA256 3ec77713dc6014c9f9ff4402cc8df244bc910862b94513a8cd5dc887840ab8a6
MD5 1ebca1facf2bad72b8cf1d4b01d686d7
SHA1 3ffe1daf035081f6c697234d866fbefffc2862d4
SHA512 1e9401ab2c6fcac7ee6ce27205409ba672ec55498aefa740d53a7340bfceb27c28f2403820f4b2ad49b6d6d9237799f354285a556e0c0cb7a3cc6423c8985726
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczus.exe

Path C:\Temp\zxrpjhczus.exe
Size 376KB
SHA256 21f3ceb964c2c9b3329e9afcf7f51796be5fcec51752917755778229924e574f
MD5 d053e68f163a7269d372ddac2c2e7338
SHA1 58ef1ccb987eb5f107acc45a8d3533a4b68e9ff4
SHA512 a7df15e7697e82317b12dab4393babcd4510dc83c47415877bd4e4abcc6b5c81b545c367ece82c8dde3f28e426c5ffdf170d3399b55d483f1982fb826b6ef2f8
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96ff6112-91fa-4f9c-b4f6-d0bb21ecbb0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96ff6112-91fa-4f9c-b4f6-d0bb21ecbb0a.tmp
Size 43KB
SHA256 c8771e5f16edad8e2b7edaf6cc2c57c5cb31ceffcc24411a8338ee77bf1ca4d8
MD5 80c64232d8e01b245b318b58d149d249
SHA1 ddc68e760f5a3e96a8043911475a8e712990a749
SHA512 2bc6e83da8db55e4166f8335e2e0ab1ef80d3b37017af1806da6f76631543a379511afbb1aa02b8e8a8b4ab97b144a9522de7cca468089609eb2861d9c8c5d55
SSDEEP 768:0F1j+9S3uwg7JQ1MMcvnWgWWR+2SrXH78tRMLc8KzeoVd:Z9S3WJPWg1bSroCctz/
TLSH
T1351318F598D38972D8AE8783633DAE42AEBCC193B5885984F7C45D0DCC862BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2373611578e511ec272050c6be674604a20371e6c3ca49727b68a1331a837382
MD5 c61a707e5f4c6c74514d43c3fad750d5
SHA1 057c063ece667ffa9f02ba9273f2d8729e424276
SHA512 bc09e2ea5082e680107780da501881ddacc39cfa92c007ec386f1baa1d41e1174d95da8b961d1e8602f9500890865afa7ecd9a5c77bbac73302d3731f764809b
TLSH
T10661871555E90EE1CF5B50B652DDE05AB730C6AB45C79D134284FCF848CA729FC42739
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592bc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592bc9.TMP
Size 3KB
SHA256 59dca03d5e1a0e372bb9934784977d4688839ebba10676fe04c9abebb85daa3e
MD5 f8fe8dc46b21da23860e77b3c3b0ece7
SHA1 bf4c1ffdd2df1fd8145a5105cb82ed86555d6e7f
SHA512 77b0e17c6a6c3f5af272acebbd90e9d75272a3915036b6281dd241314e480d0c2b40ef6eb1b9248aa491e8c9af6aa2b98fd0ee3cf4b564b7cf8ce9eb9bef554a
TLSH
T15A61761555D90EE1CF6B50B652DDE05AB730C6AB45C39D134284FCF848CAB29FC42739
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 816da2c6960ed8c053e88a7f1089990d77e27b12e65c226e1732863dc893f206
MD5 6da5a652b70d45112b0589c807441be7
SHA1 c68d7c1945daf809303d1246e4c2f7eff5b6e171
SHA512 6fa3f8128ecb2fc314dbf0e067a9549fccb0711ed49a456dc8da3ad7a31df819083e2723180e82824702a6ec05909bafd8c5fcf8c9513d106feb27be83c19d41
TLSH
T1AB41BEF7C3E4866E890196F0BA186E2BCE1D0915832C3D5AC9E4EF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5bec5c146f468cd472c29e4c8dad2d6dbb9b4151306d1acaf69a49e4e71dffd1
MD5 433ed2f37ffbd26905a244d6cd4f4c8d
SHA1 8445549b1f954b59cafde18945d9dcb529d5ce75
SHA512 53cf244f946892b112fd1ef019f8311800e38440c43724ab56a68924736fdaa30ce63af34d2df10b56c9c060a270eee00c568c0669b658a988644e0588ec1481
SSDEEP 192:sxRVtLRI9yM/jK1Ml8wcYf/f4eu6sYZmTtZM0ojIJYmzoA8p9Va/g6+WNCVpJ/YJ:sxRPeCU/f4eJsEaDyJW/5c/RFap
TLSH
T15562D915AA3459778CDBD209FA55BF53D6F81472A2900E48AAFC8A0C05E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2d57f06b2530b4dff9e5c9c651a2ea03a4c6c9831a73301699f8fa36c23d4c29
MD5 73b7c00ce223bc838c09ad3ab6b04313
SHA1 6fa026c5c63fb1e61da1f53a9f0c627eea1158d1
SHA512 0afec24cf5af1321ea148e8c1009a0fbea04e7cf3acc425b036507f84206b3e0a7fa7919c138fa866968330dea1ec8cc562368be166fb11258e90fb63e5d926f
SSDEEP 192:sxRVtLRI9yM/jK1Ml8UQYN0cYf/f4eu6sYZmKjtZM0ojIJYmzoA8prVa/g6+WNCO:sxRPeqMTU/f4eJsEdDyJE/5c//FaH
TLSH
T19662D919AA3459778CDBD209FA55BF53D6F91472A2900E48AAFCCB0C01E77DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d0d54dab0ebc3bdd4bdf9377e4d78de0561d3e7984b6f3cfeb03548f272f93a0
MD5 6a075f899622553eaa8ac34c9d290387
SHA1 c6139bb75793bc888584363da12ff31e50cb3ea9
SHA512 c1eae41f607d2b3c0001c0a4bd5c54d97da3ee550064dcbbc81492dd5a6f63e28b0b311ef0c2d2b3de78427990336f9d16de40de7fc735f9a9c5d58f165b587d
SSDEEP 192:sxRVoLRI9yM/jK1Ml8wcYf/f4eu6s2mTtZM0ojIJYmzoA8p9Va/g6+WNCVpJ/Y+2:sxRgeCU/f4eJs2aDyJW/5c/RFa3
TLSH
T14562E915AA3459778CDBD209FA55BF53D6F81473A2900E48AAFCCA0C05E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1f343b220886a6b0d90af206b13c0236701f650c16c95a69250d63c7c6309b95
MD5 5c0d82d70c2a0841d1a2e743b0e0f77a
SHA1 d8793d76b72086dd73fc0911a736f286980c7fda
SHA512 919fcf402f425ae082be498ee6a1f5f61349c76484cb90978abf5b163a7e37e31c0072b6f3bbe208582d27f82d071c40ea263ab9cc56b0e4f2bc25e13490be96
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVR/Ge0G+roddSgH:7dUhBHE7tgWgEyf3wu1jaS/GRGVdAgH
TLSH
T1AAE2FC3B680CCB7F4F404ADCE829BD9A6DA901CF9698CD5447EA840C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7417a8edb0af6e5dbef9d437b0b578e7b80fe3216a582935e6f2c4b670d61722
MD5 ef5d15c448d1e7c999d453ff9a542279
SHA1 a5386ae2676c8dbda2e7f8a8f8c473c114266a0a
SHA512 28bb067ecf659b7c157d661bb4c1e8b60d51fd66e988551abe4186c7012466dabdbb0cad58ada19d5609a75f118d4581c5d777fcabb1d96c15779e4842272c30
SSDEEP 96:KKVDVQVnVjV5VhVhV+jVRVmVlJVDV+KBVLJVtV+FVrVDVeV9VzVfM30D3FlFKjtf:vVDVQVnVjV5VhVhVSVRVmVTVDVDVLJV2
TLSH
T173913214767F2B80383E29098268B46A4682706371DFA42F3FA954F16F2AE015DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b586b210-9749-4379-b1bb-e599a198cf26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b586b210-9749-4379-b1bb-e599a198cf26.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8e7a5f9e39a8c4706b7879ccb7e57c7a6fa2ef11e9898a29620d0e49521c48af
MD5 788ec660b45257b86bca12f77895e4ea
SHA1 a96174ee4fc7d2bde43920d234c9b39cbf0ef9c5
SHA512 0d8dc085aaa571b88f0f4b73fb00790437639a876b91ebdba5f12b8300f204c3081c2753377d162ef78fe08c41bf64ec1480f3ad204211aab07e0a73027da279
SSDEEP 768:Orv+4UNbdp3+k5BlMcvnWgWWR+2SrXH78tRkc+8rr6F:Obsb/3zJPWg1bSro1Dr6
TLSH
T13603BF31A8688D73DCF2D684B20BB6437FF44193D6C91B88C4D91B4D829B9DE270BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c56196f0e3bc655c6a2bed48f848a63d159e56e928055f4bdc046d3bbe9835fe
MD5 6930ba13adc4765efb837e8aae538e13
SHA1 098b76034f29002f37deaff9e18e5195f65a2e27
SHA512 3882b3500c01b18366060d4c020d9ff72822c3990872bf095a9b7ec2e665a8709d48715134b80e3a72e9b40c8f5ec2c3eb16a4f0b4ce5a5ab54f75029decde96
SSDEEP 768:Qj+9Y3/Z65ByMcvnWgWWR+2SrXH78tRMLc8KzeoVd:v9Y3fJPWg1bSroCctz/
TLSH
T155F2BE35AC628D738CE6C684B207B793BFF451E3D5885F48C0D85B0E468B79D270B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7c6eaf483f4226e89665a20468b5ca06200f479d241b1ae3669c2f759f4c59a4
MD5 48b3882d8b2531761f5834ac34ac3f3e
SHA1 2f619c0272d9a2a0493ddcd97e7e8cab16289c9a
SHA512 9f0a6fee02cb7c476d80c3776a0ec461abb6c64eb497d80b0b3c73cea62ca25f3b929f9a9cfc7a4ee3696f5cc739ed7b5cad20cbab22dac5cd97927b04e9b543
SSDEEP 768:7rv+4UNbd23ar65BxMcvnWgWWR+2SrXH78tRMLc8KzeoVe:7bsbM31JPWg1bSroCctz0
TLSH
T1A613CE31B8689EB38CF2D184B107B793BFB81193C5884F58C0D95B0E465BADE370B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

9eabdc52-d9d8-4102-9cf0-13734634f55a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9eabdc52-d9d8-4102-9cf0-13734634f55a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5172_11641202\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3209e28a30fd9cf178fb43bea78ffa0f12b946e9c1d4753e7f602578b5d4c3ea
MD5 2f8d78d76436ddc876a6f1c8c986f9a1
SHA1 5f0cbe6907713a9bc6db58ebb687b180d57a93f1
SHA512 022cd37ea09b254cbee464bd8a1de96e7fd8348b6c3751f80391573a156da5f7129bad000c1f788ddcda0ad7226c5935971fbcf453eb218fa959e1a006919560
TLSH
T1C571009366A9C9B3C1DA5BF002835684F1FB2238072330640B525986AB74A3A68B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/360-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1068-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1088-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1088-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1876-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2148-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3152-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3220-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3260-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3264-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3264-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3616-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3616-227-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5556-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5556-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5724-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download