systex | bc36d0b45361d5499f7ae43f9296d24597e51bf8c0812ed72a92e841017d4817

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260701-d526bsfv7v
SHA256 bc36d0b45361d5499f7ae43f9296d24597e51bf8c0812ed72a92e841017d4817
MD5 9e559b5f99542893689dfbace38a6192
SHA1 326264eb30d0f74a0b8a7c7c8b902a7df1e9c661
SHA512 134ddd1fab66e43335cec77456494b2037e1be753336c4a674b380f42d80ba9465f97488f2fad7ee8068df261a0bcf7e55d914bd1d91561f06360e3aaeaf4e07
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5836	dyvqnigaysqligay.exe
3168	dyvqnigaysqligay.sys
3120	CreateProcess.exe
3116	igaysqigvn.exe
2264	CreateProcess.exe
4260	CreateProcess.exe
2200	i_igaysqigvn.exe
5668	axsqkicavs.sys
1436	CreateProcess.exe
720	xvsqlfdxvs.exe
3212	CreateProcess.exe
4656	CreateProcess.exe
1640	i_xvsqlfdxvs.exe
596	xspkhcausm.sys
1308	CreateProcess.exe
3548	pkhfzxvpnh.exe
1880	CreateProcess.exe
5344	CreateProcess.exe
1800	i_pkhfzxvpnh.exe
5796	spkhfzxusm.sys
4500	CreateProcess.exe
5632	mkhczxrpjh.exe
2868	CreateProcess.exe
1428	CreateProcess.exe
2656	i_mkhczxrpjh.exe
2776	mjhczusmke.sys
4740	CreateProcess.exe
5840	jhbzxrpmhe.exe
5508	CreateProcess.exe
1996	CreateProcess.exe
2540	i_jhbzxrpmhe.exe
1768	CreateProcess.exe
2840	bzwromjecw.exe
1640	CreateProcess.exe
5952	CreateProcess.exe
1980	i_bzwromjecw.exe
3960	jhbywtomge.sys
2284	CreateProcess.exe
5764	jgbztrljdb.exe
1624	CreateProcess.exe
3416	CreateProcess.exe
5472	i_jgbztrljdb.exe
2316	bvtolgebwt.sys
4184	CreateProcess.exe
5928	qnlgaytqli.exe
4220	CreateProcess.exe
2008	CreateProcess.exe
1432	i_qnlgaytqli.exe
3712	yvqolgdyvt.sys
3840	CreateProcess.exe
5264	olfdyvtnlg.exe
6132	CreateProcess.exe
5484	CreateProcess.exe
5020	i_olfdyvtnlg.exe
6040	nifdxvqnif.sys
5096	CreateProcess.exe
4252	ifaysqkica.exe
5740	CreateProcess.exe
872	CreateProcess.exe
3516	i_ifaysqkica.exe
4772	nhfaxspnhf.sys
3276	CreateProcess.exe
1432	hfzxvsqkif.exe
3500	CreateProcess.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_940197714\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_358784731\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_358784731\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_1402141662\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_940197714\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_358784731\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_358784731\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_460465797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2196_1402141662\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuspcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomjebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlgaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlgaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwromjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olfdyvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqigvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzxrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olfdyvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigaysqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwromjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqigvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzxrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomjebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuspcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjecwu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1724	ipconfig.exe
6044	ipconfig.exe
5056	ipconfig.exe
2724	ipconfig.exe
1512	ipconfig.exe
1112	ipconfig.exe
2484	ipconfig.exe
1412	ipconfig.exe
2624	ipconfig.exe
3516	ipconfig.exe
1112	ipconfig.exe
3240	ipconfig.exe
3160	ipconfig.exe
5652	ipconfig.exe
3180	ipconfig.exe
4956	ipconfig.exe
3496	ipconfig.exe
5056	ipconfig.exe
2724	ipconfig.exe
2940	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273505909029883"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{B7E2CD4C-E997-455E-8F85-486CC4678A7D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe
5836	dyvqnigaysqligay.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	i_igaysqigvn.exe
Token: SeDebugPrivilege	1640	i_xvsqlfdxvs.exe
Token: SeDebugPrivilege	1800	i_pkhfzxvpnh.exe
Token: SeDebugPrivilege	2656	i_mkhczxrpjh.exe
Token: SeDebugPrivilege	1980	i_bzwromjecw.exe
Token: SeDebugPrivilege	5472	i_jgbztrljdb.exe
Token: SeDebugPrivilege	1432	i_qnlgaytqli.exe
Token: SeDebugPrivilege	5020	i_olfdyvtnlg.exe
Token: SeDebugPrivilege	3516	i_ifaysqkica.exe
Token: SeDebugPrivilege	3688	i_hfzxvsqkif.exe
Token: SeDebugPrivilege	480	i_xuspcauspk.exe
Token: SeDebugPrivilege	1236	i_cwupmhezxr.exe
Token: SeDebugPrivilege	2484	i_bzurmjecwu.exe
Token: SeDebugPrivilege	5448	i_dbztrljebw.exe
Token: SeDebugPrivilege	3712	i_tomjebwtol.exe
Token: SeDebugPrivilege	5088	i_gdyvtolgey.exe
Token: SeDebugPrivilege	6096	i_aysqkidavt.exe
Token: SeDebugPrivilege	5728	i_nkicavsnkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 5836	5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5336 wrote to memory of 5040	5336	2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5040 wrote to memory of 2196	5040	iexplore.exe	90
PID 2196 wrote to memory of 5140	2196	msedge.exe	91
PID 2196 wrote to memory of 1176	2196	msedge.exe	93
PID 2196 wrote to memory of 5984	2196	msedge.exe	94
PID 2196 wrote to memory of 5984	2196	msedge.exe	94
PID 2196 wrote to memory of 2032	2196	msedge.exe	95
PID 2196 wrote to memory of 2032	2196	msedge.exe	95
PID 2196 wrote to memory of 2032	2196	msedge.exe	95
PID 2196 wrote to memory of 5864	2196	msedge.exe	96
PID 2196 wrote to memory of 5864	2196	msedge.exe	96
PID 2196 wrote to memory of 1260	2196	msedge.exe	97
PID 2196 wrote to memory of 5864	2196	msedge.exe	96
PID 2196 wrote to memory of 1260	2196	msedge.exe	97
PID 2196 wrote to memory of 1260	2196	msedge.exe	97
PID 2196 wrote to memory of 940	2196	msedge.exe	98
PID 2196 wrote to memory of 2840	2196	msedge.exe	99
PID 2196 wrote to memory of 940	2196	msedge.exe	98
PID 2196 wrote to memory of 940	2196	msedge.exe	98
PID 2196 wrote to memory of 2840	2196	msedge.exe	99
PID 2196 wrote to memory of 2840	2196	msedge.exe	99
PID 2196 wrote to memory of 3020	2196	msedge.exe	100
PID 2196 wrote to memory of 3020	2196	msedge.exe	100
PID 2196 wrote to memory of 3020	2196	msedge.exe	100
PID 2196 wrote to memory of 720	2196	msedge.exe	102
PID 2196 wrote to memory of 720	2196	msedge.exe	102
PID 2196 wrote to memory of 4124	2196	msedge.exe	103
PID 2196 wrote to memory of 4124	2196	msedge.exe	103
PID 2196 wrote to memory of 4124	2196	msedge.exe	103
PID 5836 wrote to memory of 3120	5836	dyvqnigaysqligay.exe	106
PID 3116 wrote to memory of 2264	3116	igaysqigvn.exe	109
PID 2196 wrote to memory of 2404	2196	msedge.exe	112
PID 2196 wrote to memory of 2404	2196	msedge.exe	112
PID 2196 wrote to memory of 4660	2196	msedge.exe	113
PID 2196 wrote to memory of 4660	2196	msedge.exe	113
PID 2196 wrote to memory of 4196	2196	msedge.exe	115
PID 2196 wrote to memory of 1904	2196	msedge.exe	116
PID 2196 wrote to memory of 1904	2196	msedge.exe	116
PID 2196 wrote to memory of 5268	2196	msedge.exe	117
PID 2196 wrote to memory of 5268	2196	msedge.exe	117
PID 5836 wrote to memory of 4260	5836	dyvqnigaysqligay.exe	120
PID 5836 wrote to memory of 1436	5836	dyvqnigaysqligay.exe	124
PID 720 wrote to memory of 3212	720	xvsqlfdxvs.exe	126
PID 5836 wrote to memory of 4656	5836	dyvqnigaysqligay.exe	129
PID 5836 wrote to memory of 1308	5836	dyvqnigaysqligay.exe	133
PID 3548 wrote to memory of 1880	3548	pkhfzxvpnh.exe	135
PID 5836 wrote to memory of 5344	5836	dyvqnigaysqligay.exe	138
PID 5836 wrote to memory of 4500	5836	dyvqnigaysqligay.exe	142
PID 5632 wrote to memory of 2868	5632	mkhczxrpjh.exe	144
PID 5836 wrote to memory of 1428	5836	dyvqnigaysqligay.exe	148
PID 2196 wrote to memory of 3056	2196	msedge.exe	150
PID 2196 wrote to memory of 3432	2196	msedge.exe	151
PID 2196 wrote to memory of 6016	2196	msedge.exe	152
PID 5836 wrote to memory of 4740	5836	dyvqnigaysqligay.exe	155
PID 5840 wrote to memory of 5508	5840	jhbzxrpmhe.exe	157
PID 5836 wrote to memory of 1996	5836	dyvqnigaysqligay.exe	160
PID 5836 wrote to memory of 1768	5836	dyvqnigaysqligay.exe	162
PID 2840 wrote to memory of 1640	2840	bzwromjecw.exe	164
PID 5836 wrote to memory of 5952	5836	dyvqnigaysqligay.exe	167
PID 5836 wrote to memory of 2284	5836	dyvqnigaysqligay.exe	171
PID 5764 wrote to memory of 1624	5764	jgbztrljdb.exe	173
PID 5836 wrote to memory of 3416	5836	dyvqnigaysqligay.exe	176
PID 5836 wrote to memory of 4184	5836	dyvqnigaysqligay.exe	180

C:\Users\Admin\AppData\Local\Temp\2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_9e559b5f99542893689dfbace38a6192_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Temp\dyvqnigaysqligay.exe
  C:\Temp\dyvqnigaysqligay.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqigvn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3120
  - - C:\Temp\igaysqigvn.exe
      C:\Temp\igaysqigvn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqigvn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\i_igaysqigvn.exe
      C:\Temp\i_igaysqigvn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsqlfdxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1436
  - - C:\Temp\xvsqlfdxvs.exe
      C:\Temp\xvsqlfdxvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsqlfdxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4656
  - - C:\Temp\i_xvsqlfdxvs.exe
      C:\Temp\i_xvsqlfdxvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1308
  - - C:\Temp\pkhfzxvpnh.exe
      C:\Temp\pkhfzxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5344
  - - C:\Temp\i_pkhfzxvpnh.exe
      C:\Temp\i_pkhfzxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhczxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4500
  - - C:\Temp\mkhczxrpjh.exe
      C:\Temp\mkhczxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhczxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1428
  - - C:\Temp\i_mkhczxrpjh.exe
      C:\Temp\i_mkhczxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzxrpmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4740
  - - C:\Temp\jhbzxrpmhe.exe
      C:\Temp\jhbzxrpmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzxrpmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Temp\i_jhbzxrpmhe.exe
      C:\Temp\i_jhbzxrpmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwromjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Temp\bzwromjecw.exe
      C:\Temp\bzwromjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwromjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\i_bzwromjecw.exe
      C:\Temp\i_bzwromjecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2284
  - - C:\Temp\jgbztrljdb.exe
      C:\Temp\jgbztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3416
  - - C:\Temp\i_jgbztrljdb.exe
      C:\Temp\i_jgbztrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlgaytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4184
  - - C:\Temp\qnlgaytqli.exe
      C:\Temp\qnlgaytqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlgaytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Temp\i_qnlgaytqli.exe
      C:\Temp\i_qnlgaytqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olfdyvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3840
  - - C:\Temp\olfdyvtnlg.exe
      C:\Temp\olfdyvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olfdyvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5484
  - - C:\Temp\i_olfdyvtnlg.exe
      C:\Temp\i_olfdyvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5096
  - - C:\Temp\ifaysqkica.exe
      C:\Temp\ifaysqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:872
  - - C:\Temp\i_ifaysqkica.exe
      C:\Temp\i_ifaysqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxvsqkif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3276
  - - C:\Temp\hfzxvsqkif.exe
      C:\Temp\hfzxvsqkif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxvsqkif.exe ups_ins
    3⤵
    PID:5012
  - - C:\Temp\i_hfzxvsqkif.exe
      C:\Temp\i_hfzxvsqkif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xuspcauspk.exe ups_run
    3⤵
    PID:2572
  - - C:\Temp\xuspcauspk.exe
      C:\Temp\xuspcauspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xuspcauspk.exe ups_ins
    3⤵
    PID:1976
  - - C:\Temp\i_xuspcauspk.exe
      C:\Temp\i_xuspcauspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    PID:4188
  - - C:\Temp\cwupmhezxr.exe
      C:\Temp\cwupmhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    PID:1112
  - - C:\Temp\i_cwupmhezxr.exe
      C:\Temp\i_cwupmhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurmjecwu.exe ups_run
    3⤵
    PID:5788
  - - C:\Temp\bzurmjecwu.exe
      C:\Temp\bzurmjecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurmjecwu.exe ups_ins
    3⤵
    PID:5680
  - - C:\Temp\i_bzurmjecwu.exe
      C:\Temp\i_bzurmjecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrljebw.exe ups_run
    3⤵
    PID:1484
  - - C:\Temp\dbztrljebw.exe
      C:\Temp\dbztrljebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrljebw.exe ups_ins
    3⤵
    PID:5428
  - - C:\Temp\i_dbztrljebw.exe
      C:\Temp\i_dbztrljebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomjebwtol.exe ups_run
    3⤵
    PID:5528
  - - C:\Temp\tomjebwtol.exe
      C:\Temp\tomjebwtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomjebwtol.exe ups_ins
    3⤵
    PID:5832
  - - C:\Temp\i_tomjebwtol.exe
      C:\Temp\i_tomjebwtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvtolgey.exe ups_run
    3⤵
    PID:4824
  - - C:\Temp\gdyvtolgey.exe
      C:\Temp\gdyvtolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvtolgey.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_gdyvtolgey.exe
      C:\Temp\i_gdyvtolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run
    3⤵
    PID:2244
  - - C:\Temp\aysqkidavt.exe
      C:\Temp\aysqkidavt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    PID:1408
  - - C:\Temp\i_aysqkidavt.exe
      C:\Temp\i_aysqkidavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicavsnkf.exe ups_run
    3⤵
    PID:4876
  - - C:\Temp\nkicavsnkf.exe
      C:\Temp\nkicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicavsnkf.exe ups_ins
    3⤵
    PID:4256
  - - C:\Temp\i_nkicavsnkf.exe
      C:\Temp\i_nkicavsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    PID:3544
  - - C:\Temp\xvpnhfaxsq.exe
      C:\Temp\xvpnhfaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    PID:1096
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x208,0x300,0x7fff50abc188,0x7fff50abc194,0x7fff50abc1a0
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,5267929280898923967,2382980835754993335,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
      4⤵
      System Time Discovery
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,7407801657996967007,4158240006658488455,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,11923604214827538666,4340570197820289464,262144 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:2
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,10185538367088721961,701393204583506330,2097152 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,10956212339819558979,3006187653635895950,2097152 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,1704971637910361500,7379624400986345826,2097152 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,15450923604853280913,441729621095846891,2097152 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5304,i,15922507339233073546,10547111726440756064,2097152 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12375692935054447636,12463969602988270984,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3824,i,17850067796045707896,18100954849418009,2097152 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,2180499757578595331,4126935001012547208,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,5859615069003237486,8851706805664348813,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3522632711274173658,12271996134203950284,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3522632711274173658,12271996134203950284,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,18124733119093034603,14795193142895512705,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,16246687617517879798,6674451121085469026,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1500,i,9159175185931650359,14289141881654161095,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,17832889675132277220,17745462601005800077,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1516,i,10408516829044497612,8943204346903211132,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,712376157848557957,15647128993852567548,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8116965628140351214,7095732373062073606,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7337145262802837713,11927639025363525580,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,18225282979412435063,2453609863062688716,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6876,i,4218221941137086476,5654138416987323815,262144 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:10
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,6499330186050665241,17435563824988553615,524288 --field-trial-handle=3056,i,6753020085038350042,3534842859495087640,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

C:\Temp\dyvqnigaysqligay.sys
C:\Temp\dyvqnigaysqligay.sys
1⤵
- Executes dropped EXE
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4416

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\xspkhcausm.sys
C:\Temp\xspkhcausm.sys
1⤵
- Executes dropped EXE
PID:596

C:\Temp\spkhfzxusm.sys
C:\Temp\spkhfzxusm.sys
1⤵
- Executes dropped EXE
PID:5796

C:\Temp\mjhczusmke.sys
C:\Temp\mjhczusmke.sys
1⤵
- Executes dropped EXE
PID:2776

C:\Temp\jhbywtomge.sys
C:\Temp\jhbywtomge.sys
1⤵
- Executes dropped EXE
PID:3960

C:\Temp\bvtolgebwt.sys
C:\Temp\bvtolgebwt.sys
1⤵
- Executes dropped EXE
PID:2316

C:\Temp\yvqolgdyvt.sys
C:\Temp\yvqolgdyvt.sys
1⤵
- Executes dropped EXE
PID:3712

C:\Temp\nifdxvqnif.sys
C:\Temp\nifdxvqnif.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\nhfaxspnhf.sys
C:\Temp\nhfaxspnhf.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\xspnhfcaus.sys
C:\Temp\xspnhfcaus.sys
1⤵
PID:3076

C:\Temp\fzxupnhfzx.sys
C:\Temp\fzxupnhfzx.sys
1⤵
PID:5872

C:\Temp\czurpmhezx.sys
C:\Temp\czurpmhezx.sys
1⤵
PID:1480

C:\Temp\mjebztrmje.sys
C:\Temp\mjebztrmje.sys
1⤵
PID:1800

C:\Temp\wtoljebwuo.sys
C:\Temp\wtoljebwuo.sys
1⤵
PID:2412

C:\Temp\ljdbvtnljd.sys
C:\Temp\ljdbvtnljd.sys
1⤵
PID:3724

C:\Temp\fdyvtnlfdy.sys
C:\Temp\fdyvtnlfdy.sys
1⤵
PID:2784

C:\Temp\vsqnifdxvt.sys
C:\Temp\vsqnifdxvt.sys
1⤵
PID:4776

C:\Temp\xsqnifaxsp.sys
C:\Temp\xsqnifaxsp.sys
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axsqkicavs.sys

Path C:\Temp\axsqkicavs.sys
Size 293KB
SHA256 e7b7ed0788a42d572f864806b129a2aca5de51f790fa608608fe0bab7dbaaf53
MD5 c3847f57f23dec852ea11b99028449ab
SHA1 b0f1972c0cf0a42d865acdf446596baa16be339b
SHA512 5aea6d8233531ddf038d7cdf887f1b6848246aeba1b8cd6bc21a5ac95d774fa83b5317c0de3f402a6cd0359dd0d67f7f60f0b281edfcba16e9127da43687099e
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzwromjecw.exe

Path C:\Temp\bzwromjecw.exe
Size 376KB
SHA256 a8cb03a15dfb4e36628517f61b488ba6b8fad752a3f128a39072a3f48f53ba73
MD5 3d52a54f3031cc4ec35e8af7e36ce3ec
SHA1 c7d7be6f0e37c1245d069a4ecd2e5e6d5eb9a461
SHA512 24a2b745d17c62a87039f39fb9ee98de74e4614b962e587a88469b3eb760e26ea6ff588926194ae2824874276d33c39be3edefce252967853a1fb3c37104e873
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnigaysqligay.exe

Path C:\Temp\dyvqnigaysqligay.exe
Size 376KB
SHA256 ee0790f46eddb27bde801c9d96abae34142a2700bb7c7d4aaf6ed8f44c8c9609
MD5 3e832ddfe1e6a42c2bc7785a2f913022
SHA1 18e98f85050d16bbc3c08e8068a03d96ad3fc256
SHA512 f07952472bb02a547d3d2b9dc4f8dc93ab44b4aa8f28b2a8aa48ea1b224aa85d07fa55cef684aa80b507cb2d879a2346afab109354468461fc97c90e01c5349f
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnigaysqligay.sys

Path C:\Temp\dyvqnigaysqligay.sys
Size 293KB
SHA256 19ba40c7547087ffe0e14d6b730e2bad80e2f11cca3c29f642ec69b161a4979d
MD5 a71796faeea178c21c074a72343bfdae
SHA1 f646e38eefbb35e47d7602f1f0a618d40ea24766
SHA512 d31f6e4bfb2a163d0d0f64646ddf7dceb0b26686a5cded0bff19a84d7c2dd407156f891b47b553d33b5a1694c1d3393bec2d8e2dad0609ac3a0e4399c94d9aae
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T19B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqigvn.exe

Path C:\Temp\i_igaysqigvn.exe
Size 376KB
SHA256 55f90a693c518ecda8879cc478fbf0938c1cba0b925234e8b6aa5697e9a4b083
MD5 17b2bd6382ffac2a047b21ca71c086d9
SHA1 e9ac50f5967b94bcadf120d1e6b6fc6c54582d43
SHA512 cbd7cff2dc1d349ca332b56637ab41f141d83dbfe45021502c565bde75f24f82c9b2e59d9c284b2e517a0b28dca7340d5e075dea58f577bc38cfa40e79519acf
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzxrpmhe.exe

Path C:\Temp\i_jhbzxrpmhe.exe
Size 376KB
SHA256 76e43d17c50c64e9ba48e64c1303f2cdcb59bb1319cb1def81fe2fe549531eb9
MD5 8c1ede752feb767f0a86750968501c81
SHA1 bccaf9d29cb9c69b5ec20736c0584dcb1594cfe0
SHA512 c02d467a67a9586aa464796a2967af6b360c72dc518bab1d7f1c78c895a477c87f6c71ca356e5eb638fb7c00d72f44b33d9d08596a882db8d79eb42898e84d9d
SSDEEP 3072:qFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhczxrpjh.exe

Path C:\Temp\i_mkhczxrpjh.exe
Size 376KB
SHA256 3420001965fa51119f46bef8583837c7b097bb94734d9be8b0df55c903446220
MD5 fe10abe8ca5bb1767e2af8d0c83879a3
SHA1 605ecac21151bbf54d9f516f678582cd1018a546
SHA512 43bb75e6910cbe477a7113abf6457fcf2bd84f2ef71101c9b82082f16a5ffd2979a1179bd982d866030512eef9846f7b5bf787eeb7ad4ce278f9ff456215431e
SSDEEP 3072:LFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhfzxvpnh.exe

Path C:\Temp\i_pkhfzxvpnh.exe
Size 376KB
SHA256 662079c9426b8a27076ed8af2bd98b90e73d3e94d38b3cf1bc280219cd1cfd46
MD5 f70c5adb7b9293b2eedbe58c7994da04
SHA1 26c9af4611315b92059c8ebf6280941b43e2fcd1
SHA512 f9614f24024f549aef14902c241843f363141504a3ab64bed89cd7d25e713131498b4589c1b459defd8060c50786903018d02cce0a263715052d7464c34f1327
SSDEEP 3072:/FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvsqlfdxvs.exe

Path C:\Temp\i_xvsqlfdxvs.exe
Size 376KB
SHA256 a228c8e3420a52b2f5ff561e9ac4418d4dc4655ef499bcc0788761efc757ba68
MD5 1a3618c5499b8afc56a76bb1a25b996a
SHA1 d2dff135dad20c61df2161c4573b02871206a530
SHA512 8fb890d7305c92d0d502722af51c518bce7e0526afb8e6f558ecd167936785e95ec6872fe7e1e6779518a06ce00c6805c8855969b355589b6acae880fe04b376
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqigvn.exe

Path C:\Temp\igaysqigvn.exe
Size 376KB
SHA256 212f169b9635c275dbc82aad20f043f6ed1a423aaccbfa60fafd02ff323c4bde
MD5 83f5248410aeaa6a43815bf9a852fac0
SHA1 c9df01e5f0e895416c6e5352d91f9f6d122e18f9
SHA512 054526cede34f2cb2d047c30ac3880ee71da74e8b3f1c803b736063dd743a4b08f6dbf327de2755a7cb7fc84521d0d8b26dc363dd65b602051ee38911eda7476
SSDEEP 3072:GFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzxrpmhe.exe

Path C:\Temp\jhbzxrpmhe.exe
Size 376KB
SHA256 298717c1994a1fe245bddd3cb43a1a0ce68ce7bdeef18fe03243f879e5600c84
MD5 e94314c376dd0a1329d4a342a5dae210
SHA1 854af688b7d9fb7327330a1a2addf46b8936590b
SHA512 8ac80472eedc6ba74dd72d50820f23721bf8e6fa105d65b93c0cc14b30b0c4d67fddca185db4fa2ce7e7fd8de93cd3e1491f347be2f3dc108ec636079a4ef0e7
SSDEEP 3072:TFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhczusmke.sys

Path C:\Temp\mjhczusmke.sys
Size 293KB
SHA256 0af36cfab2df8e2c1c3347ae25123c1620e51c53ad3bc91fe1b212ee042ccd82
MD5 b20a41fa0b461d86143539c5199aff95
SHA1 9d14173c1e53d239099090a7537fc8ccad7ecb5f
SHA512 d1a286bff40c936606f2e564a626627028797d64d56864ef497e70d682a356dcfd6c6a486bc214c66951c616313dbc61a5fa5ad39c67ee33ef9bae8ed201eab4
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T100545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczxrpjh.exe

Path C:\Temp\mkhczxrpjh.exe
Size 376KB
SHA256 d2569fc522e0fe8630d0f4c75865bb86936b6145c1c86260c3c55a2420e69cfd
MD5 f1ac7289d08ba106ee5d1d51bc5da6c1
SHA1 47652f98d2cdbf5f60d6adb524e401c7e91154cd
SHA512 9590ae79d54049eeefab5fd3886a7de6553c64f176e603a88e042f9197c3aa0b6e4af747e051851f30384a464d17c7067eabfc22a79938cb7f60fb73a8f12dc4
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhfzxvpnh.exe

Path C:\Temp\pkhfzxvpnh.exe
Size 376KB
SHA256 a8d7f12e6d18e7b51ee15ea5f8238eda775417039a26fb347e8183ff668641d8
MD5 5c75b67df4141843910b6840e1df86f4
SHA1 21502ac8c1c35b147be806bece0bc5263ad9aacc
SHA512 f90320bd545477f3520345cb506b136e08185592c28e4601e2607909becd4b4b8f7e6a82c1e660b836d8402c16b68b1bddaddc03b22fee3fa6140f200c7f4705
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfzxusm.sys

Path C:\Temp\spkhfzxusm.sys
Size 293KB
SHA256 ac44aa847d410c51da0eb52db34ebff69591d684fe0c9a4b627a4a48c8bd0f9c
MD5 6c9f4bc78aefd5dba6fe0f1e8db52b9b
SHA1 dbda63ad9d8a589f7d605d8af1009f46870debf5
SHA512 bc4aa6f312ebe8e47cd21f490e39e151ccd73c7edc8e3ba3a580b0e4d00d19403c482dda780baff1db0505e8f029d55dfff964231b44a174f0eb8db7f6093f5d
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcausm.sys

Path C:\Temp\xspkhcausm.sys
Size 293KB
SHA256 0534b2dfbdef47bc1b092376475a2dc4dd29be7308ec7c8ef569572abca387be
MD5 89c635861789805f51b550c6ba029fdd
SHA1 834ddf42b55c3bcf9d935baf4b9062e2cc12c529
SHA512 436e149ad6079dd1cc51e5da790423dffbf183dcd7bc9729d50dd662585be96019ba4a901080b8fb6afcc2b053dd3a61573ae71d8851efc3b1b24843540bd16f
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T18F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsqlfdxvs.exe

Path C:\Temp\xvsqlfdxvs.exe
Size 376KB
SHA256 ab75a9c0e635363fbee13d8bb09720d722954f712de4ab2881e9b34ed008a36e
MD5 419ecc847c4bb357d78a68960531fb8e
SHA1 8dc9fc0b745ed2b84c3f022741fb53c8f56482c1
SHA512 1b52b9a86abf9e0d7b2f6fb614d9a336d4f4c95e22969e007a52bb0f922c5dbb0a89c88ffb3ea0384c3404647a301fcb7135e1e4a396c8dfee31f6b969448313
SSDEEP 3072:BFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6bafd8c61e3dabc927270efdab622c62ede31757b5b9bdd53c8207dceb20e53f
MD5 53fc647aa154631c2b6416974654d29f
SHA1 c5bdca1485f8d938820fa3ab51705acd80b93694
SHA512 f80366ff1bdcbde0f63ceae17e90387ff6694dcff3ea73da96f8065a0ac24a5ea29cb2e57fe6e4fc3148c87fa04f0624bdd85b2d9486c953663726a8fa1be50b
TLSH
T13B51ED6546252972C726C2BDC3E112D873B0E9BF82876E493CD4A9BD995AF08F373170
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5a2ca4d058d4795d98a7cadf4149f1335e6dcc48d08884c5fab71dfca27cdf85
MD5 d15aa0c129b835fdc9475cd0df34b281
SHA1 c5941dbacca1ab5cf466fcd82b55cebee97b4daa
SHA512 7224107f69816173ed069402a749979f290fb409677c226419835f4d479c13e0900dfabce67f7bc4f3f74420eeaf9b1dfc26c4f74aba1eb0c7c357026209a7e3
TLSH
T10F41DDF7C7E4862E890196F0AA186E2BCE1D0915832C3D5AC9E4EF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 35fcb6d471d44565d523596e1635e650c695d00c3b0d2f4b100ab13d27cbbc9a
MD5 21f269febddee9e660725f1007c7c4a6
SHA1 febec0ba0a4da01915d40c8165b5228a554cc191
SHA512 1e6bd8f86049d9ab3c7325ae38bd210e8c8086cc3258d20568cf1e7d34d970935bf16d7aea5c32293e22921454b83b959c3fbe6185eb67d653ec4894ee03d52a
SSDEEP 192:sxRVNARImyM/jK1Ml8wcYO/f4euWsYDJvG1tZEG/MYZzoA8p9Vk/g6+WNCVCv/Yg:sxRQ/CJ/f4ehsE1sDEDg/5x/cFEh
TLSH
T16E62D916AA345D378CDBD219FA95BF53D2F91573E2501E48A9FC8A0C01E76EC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 70c75d274c2b8524d00b1c7e24d53f07999167ca93b9b80b9d04ba1b2789dab0
MD5 57fd0c591062199a4f32433aa0a1e7ae
SHA1 9a3a50e7b09a1405adf9d8010ae630a31fa75bcc
SHA512 09b1e452d5704d032d17029354f4bb5ce4480992d35b5898794e5514ea43799b885eca245a9f56ec2c1f371b32def7f9c35b47684c88a81459a306a9a9ae4b78
SSDEEP 192:sxRVNARImyM/jK1Ml8UQYRcYO/f4euWsYDJvGvgtZEG/MYZzoA8prVk/g6+WNCVf:sxRQ/q1J/f4ehsE1pDEDG/5x/xFEv
TLSH
T1C662D716AA245D378CDBD219BA95BF53D2F95573E2900E486AFCCB0C01E76EC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 853b92df44c42af0548ab2cf8450012f8f1f5c38646ce82b2ad06b3cd475b78c
MD5 0285ed053814f3b8c67766afd7c793b9
SHA1 261423cdd7902c3c71b257b656c31036726aee85
SHA512 487c0855939def4ed10d316d1640a4a2567a52c7f24c0b7207e5d7264a0656d7fc8ec4929d81fb417708a808d4d0f013f6cd52f5dc11409e6cb854fdba7871eb
SSDEEP 192:sxRVIARImyM/jK1Ml8wcYO/f4euWspJvG1tZEG/MYZzoA8p9Vk/g6+WNCVCv/Y+d:sxR3/CJ/f4ehsp1sDEDg/5x/cFE3
TLSH
T18762E9166A245D378CDBD219FA95BF53D2F91573E2500E48AAFCCA0C01E76EC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 06541be48566e88dc50bc23fa964fa50cdb173a36e4abe95ff037ae139c64485
MD5 96d49d9b4580177010e96436de4e8718
SHA1 d1ba693efbfd7936b708eb8f2f38dd738aaa082f
SHA512 4da8388042afd18b268a4f29f7f195bd2d583b46c30b347a9c11e3e7cb7ae1fff4cb89486704f6ebe8087c094e11a4da08f663ebb29c7c3244029eecbc58e464
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxyGe0GrroddBq:7dUhBHE7tgWgEyf3wu1jaSyGRGYdjq
TLSH
T130E2EB3B680CCB7F4F404ADCE829BD9A6DA901CF9698CD5447EA840C03C6BEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1b2803cec2175f253a54bdd739bc01972cebd4dc9f8d6ec6bafa695e9233c601
MD5 e8daeebfdd3fe5979dd75c64be60b8a6
SHA1 c1011d7b9da938b0a721541c17395e67531a39c0
SHA512 9c92af32dde10b2427447c31a374b83c3915aee10d9a87fc0286c617f40f30344d2009384f531e7484f397eae26b83b5ac40b8b84044b84171bbd33d0416a5d1
SSDEEP 96:KwVuKOYSeleKWwioZs4q26gWeDzgggK41gCgcwgziItH0VAE+imkz:MB1VoZs4q26neDsgU1gC/wgziItH0VAw
TLSH
T132916504757E1B5438BE740DC3A8D46A428231B631DAA93F3B9861E32F66D065DFCACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5998ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5998ac.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c078e482ab129d618dc4ee1a3b086edc24a31efef126f58fc4becb294dcd8ca5
MD5 c940aa22ecb2f2f2015dd05283fad79a
SHA1 a4c237f644f315ff023966bb15f6802f76ed1e34
SHA512 1f80c149e6176fec6675caece5d6e7c62605d03858aa496f538db323ab9abc20c394757663760036c66cd9c5cc4b8c3711ab0320f7b580b80540612a09a7d904
SSDEEP 768:6F1j+9b3XwgZo7PH/GMcvnWgWWR+2SrXH78tRMPc8KzfJ+:f9b3voqJPWg1bSroWctzfJ+
TLSH
T1751317F298D38976D8AE8783633D7E42AEBCC193B5885984F7C45D0CCD862BFD606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 47fc70ddb08778ba4122a8cb0964474d5abcf8e4f8f7c7c4821f904ba6a351d6
MD5 090f2fad8d95e273deb2cd30333f2101
SHA1 05b70b7f6b67acd6b73dc5ada540a760ec02b44f
SHA512 7d10242c0bd310a3c02e4b66d702cc5f48fac93b0f036d1c61bf4d2410ca4a4e70cebcb96cb6453dbbcbb768ef6688d3fb29b77f714315128dd5fbcd99b4f8f3
SSDEEP 768:0j+973+o7JF5zgMcvnWgWWR+2SrXH78tRMPc8KzfJ+:j973+oaJPWg1bSroWctzfJ+
TLSH
T17CF2BF3168658EB38CF2D694B3067793BFF051A3D5895F88C0D95B0D42877AD2B0B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6cb244ce02a83e6cf4bbc0dfd988247e3e82e288cd08a5dc3ae0606182618981
MD5 bd19331a4e990fde871f09c45dcb6feb
SHA1 f078d2ed8a6b19fcf597f71f52791db16e84b9f0
SHA512 a4869a676d7f6971c49dc0a736e698c646f503cb5b20ee513ff068186f488a47971eb8acedffd37252b208970d52850831b034563e30f26f78a61750d0da38cc
SSDEEP 768:Orv+4UNbdp3qm5IMcvnWgWWR+2SrXH78tRk5+8rr6F:Obsb/36JPWg1bSrogDr6
TLSH
T16903BF32A8688D73DCF2D685B20A72437FF44193D5C91B88C4D91B4E429B9DE270BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

bc0e617f-9179-40ee-b0a7-8865794ec5d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc0e617f-9179-40ee-b0a7-8865794ec5d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2196_682992393\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 cc9cd53285e1f01be5936eea3a9be9bf0daa1205c0f729d0068979e575dc20d5
MD5 2bff6070ea13c2c08bf3d540bab97020
SHA1 3ee5ebf8b9e00999a83d4bc0a01fa1ee401cb44e
SHA512 0a1c4e4dad596055cc4cca031f09e8574c3c1b301929f71781be72b4d90d66fd6d651ddcb40cf74dcf00164589036592c056175cccef39fc9d37e8d56e875f82
TLSH
T16B71008356A9C9B2C19E5BF102835244F2FB22384763206007965586AA30A3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/596-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1480-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1800-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2316-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2548-490-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2776-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2784-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3076-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3168-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3724-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3724-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3960-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5796-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5872-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download