systex | 7c454536460e442d1d14b65f4078f35344949884008e9a3fabb3d02060484e86

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260705-tkga5adx3w
SHA256 7c454536460e442d1d14b65f4078f35344949884008e9a3fabb3d02060484e86
MD5 6f0fbf08ee782e97a5b4519fd2438356
SHA1 7720e0b1f65ff734f25383422b020d96ba069dbe
SHA512 c80175dd367ab5eb59f55cd0a0df76f37eb6fcf979cd4cb341820d297222faefab7d13cd519d645c4a2e643a4489b2d0e54ceda94ea39f13191207c163de3966
SSDEEP 3072:TT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:P6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T101847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3088	aysqkicavsnkicax.exe
5744	aysqkicavsnkicax.sys
4224	CreateProcess.exe
2340	davsqkaupk.exe
3388	CreateProcess.exe
2392	CreateProcess.exe
5836	i_davsqkaupk.exe
3640	nhfaxrpkhc.sys
3376	CreateProcess.exe
5744	zxsphfcxup.exe
2344	CreateProcess.exe
4536	CreateProcess.exe
3484	i_zxsphfcxup.exe
3928	xrpjhczurm.sys
1620	CreateProcess.exe
1356	pjhczuomhe.exe
1724	CreateProcess.exe
620	CreateProcess.exe
3060	i_pjhczuomhe.exe
1392	pjhbzwuomg.sys
1256	CreateProcess.exe
5740	rmjebztrmj.exe
1140	CreateProcess.exe
4472	CreateProcess.exe
1284	i_rmjebztrmj.exe
3836	geywrojgbz.sys
5048	CreateProcess.exe
2396	omjebwtomg.exe
5572	CreateProcess.exe
1196	CreateProcess.exe
716	i_omjebwtomg.exe
3128	dbwtomgebw.sys
5700	CreateProcess.exe
2044	tqjdbwlgey.exe
3552	CreateProcess.exe
2548	CreateProcess.exe
1096	i_tqjdbwlgey.exe
2176	bvtnlfdbvt.sys
5040	CreateProcess.exe
4372	aysqnlfdbv.exe
3904	CreateProcess.exe
2776	CreateProcess.exe
4952	i_aysqnlfdbv.exe
5912	ysqkidavsq.sys
2596	CreateProcess.exe
4504	xvtnlfdxvs.exe
696	CreateProcess.exe
3640	CreateProcess.exe
1492	i_xvtnlfdxvs.exe
3492	idavtnlfdx.sys
3244	CreateProcess.exe
716	vsnkfcxusq.exe
764	CreateProcess.exe
2528	CreateProcess.exe
2076	i_vsnkfcxusq.exe
5860	vsnkfdxvpn.sys
5684	CreateProcess.exe
5984	spnkfdxvpf.exe
2640	CreateProcess.exe
2368	CreateProcess.exe
4180	i_spnkfdxvpf.exe
1980	ausmkecxup.sys
756	CreateProcess.exe
2828	zurpmhecxu.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_76617692\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_76617692\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_76617692\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_1392913986\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_1729055481\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_1729055481\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_2001956593\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_2001956593\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4060_76617692\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkifcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqjdbwlgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfcxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsmhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsqkaupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpmhecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsqkaupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnkfdxvpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsmhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavsnkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfcxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhecwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhecwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgaywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxsphfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqjdbwlgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dausnkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnlfdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnlfdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgaywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkifcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dausnkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxsphfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnkfdxvpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpmhecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljdbw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3152	ipconfig.exe
3548	ipconfig.exe
3864	ipconfig.exe
3664	ipconfig.exe
2960	ipconfig.exe
2064	ipconfig.exe
1508	ipconfig.exe
1876	ipconfig.exe
5712	ipconfig.exe
2076	ipconfig.exe
5448	ipconfig.exe
5384	ipconfig.exe
5460	ipconfig.exe
1320	ipconfig.exe
3952	ipconfig.exe
4540	ipconfig.exe
2384	ipconfig.exe
3940	ipconfig.exe
3152	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277412177700946"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{9DA9F143-4FE8-4E01-8AD3-8ED7D016F476}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe
3088	aysqkicavsnkicax.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5836	i_davsqkaupk.exe
Token: SeDebugPrivilege	3484	i_zxsphfcxup.exe
Token: SeDebugPrivilege	3060	i_pjhczuomhe.exe
Token: SeDebugPrivilege	1284	i_rmjebztrmj.exe
Token: SeDebugPrivilege	716	i_omjebwtomg.exe
Token: SeDebugPrivilege	1096	i_tqjdbwlgey.exe
Token: SeDebugPrivilege	4952	i_aysqnlfdbv.exe
Token: SeDebugPrivilege	1492	i_xvtnlfdxvs.exe
Token: SeDebugPrivilege	2076	i_vsnkfcxusq.exe
Token: SeDebugPrivilege	4180	i_spnkfdxvpf.exe
Token: SeDebugPrivilege	5012	i_zurpmhecxu.exe
Token: SeDebugPrivilege	4560	i_zurpjhecwt.exe
Token: SeDebugPrivilege	4140	i_ebztrljdbw.exe
Token: SeDebugPrivilege	4552	i_mgbytrljdb.exe
Token: SeDebugPrivilege	3068	i_jgaywqolgd.exe
Token: SeDebugPrivilege	3804	i_daysqkidav.exe
Token: SeDebugPrivilege	3664	i_ysqkifcaus.exe
Token: SeDebugPrivilege	1032	i_dausnkicav.exe
Token: SeDebugPrivilege	5756	i_axsmhfcxup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3088	3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3364 wrote to memory of 1860	3364	2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1860 wrote to memory of 4060	1860	iexplore.exe	90
PID 4060 wrote to memory of 6112	4060	msedge.exe	91
PID 4060 wrote to memory of 5276	4060	msedge.exe	92
PID 4060 wrote to memory of 1880	4060	msedge.exe	93
PID 4060 wrote to memory of 1880	4060	msedge.exe	93
PID 4060 wrote to memory of 1540	4060	msedge.exe	94
PID 4060 wrote to memory of 1540	4060	msedge.exe	94
PID 4060 wrote to memory of 1540	4060	msedge.exe	94
PID 4060 wrote to memory of 5776	4060	msedge.exe	96
PID 4060 wrote to memory of 5776	4060	msedge.exe	96
PID 4060 wrote to memory of 5776	4060	msedge.exe	96
PID 4060 wrote to memory of 5916	4060	msedge.exe	97
PID 4060 wrote to memory of 5916	4060	msedge.exe	97
PID 4060 wrote to memory of 5916	4060	msedge.exe	97
PID 4060 wrote to memory of 2996	4060	msedge.exe	98
PID 4060 wrote to memory of 2996	4060	msedge.exe	98
PID 4060 wrote to memory of 2996	4060	msedge.exe	98
PID 4060 wrote to memory of 2288	4060	msedge.exe	99
PID 4060 wrote to memory of 2288	4060	msedge.exe	99
PID 4060 wrote to memory of 2288	4060	msedge.exe	99
PID 4060 wrote to memory of 5952	4060	msedge.exe	101
PID 4060 wrote to memory of 5952	4060	msedge.exe	101
PID 3088 wrote to memory of 4224	3088	aysqkicavsnkicax.exe	104
PID 2340 wrote to memory of 3388	2340	davsqkaupk.exe	107
PID 4060 wrote to memory of 5712	4060	msedge.exe	110
PID 4060 wrote to memory of 5712	4060	msedge.exe	110
PID 4060 wrote to memory of 476	4060	msedge.exe	111
PID 4060 wrote to memory of 476	4060	msedge.exe	111
PID 4060 wrote to memory of 764	4060	msedge.exe	113
PID 4060 wrote to memory of 1392	4060	msedge.exe	114
PID 4060 wrote to memory of 1392	4060	msedge.exe	114
PID 4060 wrote to memory of 2836	4060	msedge.exe	115
PID 4060 wrote to memory of 2836	4060	msedge.exe	115
PID 3088 wrote to memory of 2392	3088	aysqkicavsnkicax.exe	117
PID 4060 wrote to memory of 6024	4060	msedge.exe	122
PID 4060 wrote to memory of 6024	4060	msedge.exe	122
PID 4060 wrote to memory of 6024	4060	msedge.exe	122
PID 4060 wrote to memory of 6092	4060	msedge.exe	123
PID 4060 wrote to memory of 6092	4060	msedge.exe	123
PID 4060 wrote to memory of 6092	4060	msedge.exe	123
PID 3088 wrote to memory of 3376	3088	aysqkicavsnkicax.exe	124
PID 5744 wrote to memory of 2344	5744	zxsphfcxup.exe	126
PID 3088 wrote to memory of 4536	3088	aysqkicavsnkicax.exe	129
PID 3088 wrote to memory of 1620	3088	aysqkicavsnkicax.exe	133
PID 1356 wrote to memory of 1724	1356	pjhczuomhe.exe	135
PID 3088 wrote to memory of 620	3088	aysqkicavsnkicax.exe	138
PID 4060 wrote to memory of 4644	4060	msedge.exe	142
PID 4060 wrote to memory of 4644	4060	msedge.exe	142
PID 4060 wrote to memory of 4644	4060	msedge.exe	142
PID 3088 wrote to memory of 1256	3088	aysqkicavsnkicax.exe	144
PID 5740 wrote to memory of 1140	5740	rmjebztrmj.exe	146
PID 3088 wrote to memory of 4472	3088	aysqkicavsnkicax.exe	149
PID 4060 wrote to memory of 4088	4060	msedge.exe	151
PID 4060 wrote to memory of 804	4060	msedge.exe	152
PID 4060 wrote to memory of 700	4060	msedge.exe	153
PID 3088 wrote to memory of 5048	3088	aysqkicavsnkicax.exe	156
PID 2396 wrote to memory of 5572	2396	omjebwtomg.exe	158
PID 3088 wrote to memory of 1196	3088	aysqkicavsnkicax.exe	161
PID 3088 wrote to memory of 5700	3088	aysqkicavsnkicax.exe	165
PID 2044 wrote to memory of 3552	2044	tqjdbwlgey.exe	167
PID 3088 wrote to memory of 2548	3088	aysqkicavsnkicax.exe	170
PID 3088 wrote to memory of 5040	3088	aysqkicavsnkicax.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_6f0fbf08ee782e97a5b4519fd2438356_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Temp\aysqkicavsnkicax.exe
  C:\Temp\aysqkicavsnkicax.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsqkaupk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\Temp\davsqkaupk.exe
      C:\Temp\davsqkaupk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsqkaupk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2392
  - - C:\Temp\i_davsqkaupk.exe
      C:\Temp\i_davsqkaupk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxsphfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3376
  - - C:\Temp\zxsphfcxup.exe
      C:\Temp\zxsphfcxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxsphfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Temp\i_zxsphfcxup.exe
      C:\Temp\i_zxsphfcxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1620
  - - C:\Temp\pjhczuomhe.exe
      C:\Temp\pjhczuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:620
  - - C:\Temp\i_pjhczuomhe.exe
      C:\Temp\i_pjhczuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1256
  - - C:\Temp\rmjebztrmj.exe
      C:\Temp\rmjebztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Temp\i_rmjebztrmj.exe
      C:\Temp\i_rmjebztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\omjebwtomg.exe
      C:\Temp\omjebwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1196
  - - C:\Temp\i_omjebwtomg.exe
      C:\Temp\i_omjebwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqjdbwlgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5700
  - - C:\Temp\tqjdbwlgey.exe
      C:\Temp\tqjdbwlgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqjdbwlgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2548
  - - C:\Temp\i_tqjdbwlgey.exe
      C:\Temp\i_tqjdbwlgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnlfdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5040
  - - C:\Temp\aysqnlfdbv.exe
      C:\Temp\aysqnlfdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnlfdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\i_aysqnlfdbv.exe
      C:\Temp\i_aysqnlfdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlfdxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2596
  - - C:\Temp\xvtnlfdxvs.exe
      C:\Temp\xvtnlfdxvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3640
  - - C:\Temp\i_xvtnlfdxvs.exe
      C:\Temp\i_xvtnlfdxvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfcxusq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3244
  - - C:\Temp\vsnkfcxusq.exe
      C:\Temp\vsnkfcxusq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfcxusq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2528
  - - C:\Temp\i_vsnkfcxusq.exe
      C:\Temp\i_vsnkfcxusq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnkfdxvpf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5684
  - - C:\Temp\spnkfdxvpf.exe
      C:\Temp\spnkfdxvpf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnkfdxvpf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2368
  - - C:\Temp\i_spnkfdxvpf.exe
      C:\Temp\i_spnkfdxvpf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpmhecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\zurpmhecxu.exe
      C:\Temp\zurpmhecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpmhecxu.exe ups_ins
    3⤵
    PID:4496
  - - C:\Temp\i_zurpmhecxu.exe
      C:\Temp\i_zurpmhecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpjhecwt.exe ups_run
    3⤵
    PID:3128
  - - C:\Temp\zurpjhecwt.exe
      C:\Temp\zurpjhecwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpjhecwt.exe ups_ins
    3⤵
    PID:2244
  - - C:\Temp\i_zurpjhecwt.exe
      C:\Temp\i_zurpjhecwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrljdbw.exe ups_run
    3⤵
    PID:832
  - - C:\Temp\ebztrljdbw.exe
      C:\Temp\ebztrljdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrljdbw.exe ups_ins
    3⤵
    PID:1392
  - - C:\Temp\i_ebztrljdbw.exe
      C:\Temp\i_ebztrljdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgbytrljdb.exe ups_run
    3⤵
    PID:1044
  - - C:\Temp\mgbytrljdb.exe
      C:\Temp\mgbytrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgbytrljdb.exe ups_ins
    3⤵
    PID:2772
  - - C:\Temp\i_mgbytrljdb.exe
      C:\Temp\i_mgbytrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgaywqolgd.exe ups_run
    3⤵
    PID:2504
  - - C:\Temp\jgaywqolgd.exe
      C:\Temp\jgaywqolgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgaywqolgd.exe ups_ins
    3⤵
    PID:5164
  - - C:\Temp\i_jgaywqolgd.exe
      C:\Temp\i_jgaywqolgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysqkidav.exe ups_run
    3⤵
    PID:2692
  - - C:\Temp\daysqkidav.exe
      C:\Temp\daysqkidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysqkidav.exe ups_ins
    3⤵
    PID:2104
  - - C:\Temp\i_daysqkidav.exe
      C:\Temp\i_daysqkidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkifcaus.exe ups_run
    3⤵
    PID:4816
  - - C:\Temp\ysqkifcaus.exe
      C:\Temp\ysqkifcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkifcaus.exe ups_ins
    3⤵
    PID:3280
  - - C:\Temp\i_ysqkifcaus.exe
      C:\Temp\i_ysqkifcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dausnkicav.exe ups_run
    3⤵
    PID:5548
  - - C:\Temp\dausnkicav.exe
      C:\Temp\dausnkicav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dausnkicav.exe ups_ins
    3⤵
    PID:5360
  - - C:\Temp\i_dausnkicav.exe
      C:\Temp\i_dausnkicav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsmhfcxup.exe ups_run
    3⤵
    PID:980
  - - C:\Temp\axsmhfcxup.exe
      C:\Temp\axsmhfcxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsmhfcxup.exe ups_ins
    3⤵
    PID:1628
  - - C:\Temp\i_axsmhfcxup.exe
      C:\Temp\i_axsmhfcxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run
    3⤵
    PID:1348
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x14c,0x300,0x7ffc1cbcc188,0x7ffc1cbcc194,0x7ffc1cbcc1a0
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,15374146609183981696,8704617993803233446,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,12920725209426033608,7701739058083252483,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,4828726098904019028,17464345781501723399,262144 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3002393920852748051,9974869821587911704,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,11097865013810143235,17174499520244401456,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,7322038728272412498,16371355995531978132,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,16606015063962844045,1063129575820919071,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,555835549540313001,15127937876593515511,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13408985770467121639,3445520961348686353,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,11353794315588425125,379346597666285881,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1421913485310245709,12418985535430932427,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1421913485310245709,12418985535430932427,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13409901016232195216,6032643438277772793,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,4845661279780205713,9545762695219119340,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6600,i,939041996331789605,16201415305361169214,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3592,i,1514419958789348614,7186544230614582000,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6292,i,13058931072225134553,12294611173453372097,2097152 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,16226968114750103595,10747007369733471604,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,4419449096371660727,1596824683000622455,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,2113696646108760348,8461918285364471015,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12143795855354356714,16144671584591194554,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8716080245675726594,2762562213922217520,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11690533610363223847,4950156751291512849,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,16684802822144888420,18327725658356989300,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4448,i,16126846452686762700,3987140023442787661,262144 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:10
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,3604631608928879525,13624281970971305400,524288 --field-trial-handle=2296,i,1780177073153069851,12297978821279574706,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5860

C:\Temp\aysqkicavsnkicax.sys
C:\Temp\aysqkicavsnkicax.sys
1⤵
- Executes dropped EXE
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2664

C:\Temp\nhfaxrpkhc.sys
C:\Temp\nhfaxrpkhc.sys
1⤵
- Executes dropped EXE
PID:3640

C:\Temp\xrpjhczurm.sys
C:\Temp\xrpjhczurm.sys
1⤵
- Executes dropped EXE
PID:3928

C:\Temp\pjhbzwuomg.sys
C:\Temp\pjhbzwuomg.sys
1⤵
- Executes dropped EXE
PID:1392

C:\Temp\geywrojgbz.sys
C:\Temp\geywrojgbz.sys
1⤵
- Executes dropped EXE
PID:3836

C:\Temp\dbwtomgebw.sys
C:\Temp\dbwtomgebw.sys
1⤵
- Executes dropped EXE
PID:3128

C:\Temp\bvtnlfdbvt.sys
C:\Temp\bvtnlfdbvt.sys
1⤵
- Executes dropped EXE
PID:2176

C:\Temp\ysqkidavsq.sys
C:\Temp\ysqkidavsq.sys
1⤵
- Executes dropped EXE
PID:5912

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:5860

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:1980

C:\Temp\wuomkebzxu.sys
C:\Temp\wuomkebzxu.sys
1⤵
PID:3004

C:\Temp\mjhbztrpjh.sys
C:\Temp\mjhbztrpjh.sys
1⤵
PID:1556

C:\Temp\oljgbzwqoj.sys
C:\Temp\oljgbzwqoj.sys
1⤵
PID:3900

C:\Temp\gdbvtrljdb.sys
C:\Temp\gdbvtrljdb.sys
1⤵
PID:5988

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
PID:1984

C:\Temp\fdavtqkiga.sys
C:\Temp\fdavtqkiga.sys
1⤵
PID:1384

C:\Temp\cayspkicau.sys
C:\Temp\cayspkicau.sys
1⤵
PID:5720

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
PID:3724

C:\Temp\spjhczurmk.sys
C:\Temp\spjhczurmk.sys
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkicavsnkicax.exe

Path C:\Temp\aysqkicavsnkicax.exe
Size 376KB
SHA256 8d91a18faab45c151ced29f0031e5179a58a608c7706f4c261d2f94904e306a7
MD5 c288ac6cad76fcd1aafec604ef0429d5
SHA1 76426123d013f9ca5d018d029a34c8025d445fb1
SHA512 9050271e1059c8aba5aec1752224f86cfae9649d4b5335da5e57829bc5ce0088833897227599baaa680c89b16da75d2dee4eab779433ba0a714253611859b4b4
SSDEEP 3072:OT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:k6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkicavsnkicax.sys

Path C:\Temp\aysqkicavsnkicax.sys
Size 293KB
SHA256 7ce3dbd64ddf6322986e0430cc65d51b75e73cb111ea5b3fd4f2074898f49485
MD5 2b601126d4be02c8f942e1049d2a68cf
SHA1 8d1994968df7b18bc38c227e6adc9b7040a022f1
SHA512 7de6f8a32e809a174a3f56db03183f658b33c147a9288506b3f2d7e1a96ac35a0ec13aa64970f3d86b38d89663d6418c0e9c5f5f79dc1fd64357726777ee5d74
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsqkaupk.exe

Path C:\Temp\davsqkaupk.exe
Size 376KB
SHA256 3f7aaa82c391224b901a6e140bc02349f8c77143e054492d58137c896c37fafd
MD5 3b587e3b3a8da200765ea5ec5b84d51b
SHA1 a60010d435e4cc0f9d26e5a6e09c61d56466bb5d
SHA512 c1e273a3b1d92db179f800637b6b46becd015e3cecb5b62783a5ff44ca46008a2db510759ee34f1de441fe1376bf12ac739fabcbb200485579dce66ad87fa678
SSDEEP 3072:ZT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:N6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CE847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgebw.sys

Path C:\Temp\dbwtomgebw.sys
Size 293KB
SHA256 f6ff6410f49d57082d23cbfe08741934eaa66378137c7c5f46e8ddfd394c8ecd
MD5 d411f6004ef463c3eb911fb00cd873c4
SHA1 6a5f565a3379a89570481f1701b058aa8b157c18
SHA512 b14bf89c76448349db567fbbf8b09f2f51cd3d9cfc4e70e1f67c3edbe2bd5313200c4af6e453eb2911df31c8ff6cac24c3832083d05536bc44ae9b391e7619b6
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojgbz.sys

Path C:\Temp\geywrojgbz.sys
Size 293KB
SHA256 039693dd43dc38cb686f82fcc19c0c1f6fb655f707c3ba6287ce430d7394b6a5
MD5 41c1b00b524ca3bf9e663eb39b604abc
SHA1 0577c5350052fc47dfe8eeefed4c958a7be4d7e4
SHA512 0847910b9548b493d9ddb283739f9cc524ad25ad1203851673f9d8a2a043d3803e42b07422ff4a78002cf88dc55cbfd68fcb13472feb8bf7b5cb1ec993814478
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T122545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsqkaupk.exe

Path C:\Temp\i_davsqkaupk.exe
Size 376KB
SHA256 76a73935d3806a15baa8646ee11d43ca33697b09316299ee08c903b5540750b3
MD5 862bfde28148439a4973f578e0b1f275
SHA1 e741341707c39e21856f04cf462b6895c7ac53fc
SHA512 0c75ff51268a978c64a90d44616b63622f060dd73396a18110f720a5418805afe773fe64b3d8d2b1a687f331c9153071a2fc351706bd791abea4a5b9e06ac908
SSDEEP 3072:9T6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:B6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjebwtomg.exe

Path C:\Temp\i_omjebwtomg.exe
Size 376KB
SHA256 e26cb883c35f42385d4f6dac6a04feeed1498706cdcca2ff43e1aebceb278996
MD5 9895e80bfc0007f39231e902ca37f6d3
SHA1 60c840d97127c426d2310bc0ed76f7829583d80b
SHA512 93de3061afe3a0c9f013a0d5232900fe0a5470aee39496ecd2db0890b6e9e2d53e6b7104ab789972d0f24d11173b0069295c6872812eac979c0b2599679e3a7e
SSDEEP 3072:ET6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:i6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhczuomhe.exe

Path C:\Temp\i_pjhczuomhe.exe
Size 376KB
SHA256 efbbdfa001774a3514b68d0e9d2d64cb44f7e59411a9b8b77002af95d866dce3
MD5 a20e102c307d5f5a2433cdcfaa7ae76f
SHA1 ea7076a5f5ee3be192c6a2cbddaaca3f433901dd
SHA512 ea10b5ee5f51e81ec3c3c7c93f5dee8703292b760f78da9bb3b64d75495b9de27af44ea955de08bfa831d43df500ee4f8e47d3e4556b5b104c3e69a102f6a681
SSDEEP 3072:UT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:S6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjebztrmj.exe

Path C:\Temp\i_rmjebztrmj.exe
Size 376KB
SHA256 c8a7b6c41f341741d346190aded12b8aac62172520ac714e58e2dc7969090c0b
MD5 8b0bd7235905adb717a2bade11a02460
SHA1 1a544f4ef6c4762cef3614587c5ca32f37b9780e
SHA512 a1ead532f8b5c04c67b521de18900646e2483bb820c119a644b63d7354a395889bc9c39ff58b599b08e4538c30d9e9c92d6421f7fcbbc1c72f222199353fde85
SSDEEP 3072:wT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:O6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxsphfcxup.exe

Path C:\Temp\i_zxsphfcxup.exe
Size 376KB
SHA256 d235059a83a7a9fd62a793a2228eb5f7a4f72f7b6f3a06f4b5efc9058ee12d11
MD5 ff16ca449a7f0b74ce8bc63d21fb7b5c
SHA1 e416140035a220c44f7cf2dcdc51923e795d80ab
SHA512 ed580f587138f771cd14704108e0975c5947fe30ec10d49d8491226d8518b314d81e2f7b6b20ed4684f94787a791a7d67202b76dcc24d9746c104a406f891255
SSDEEP 3072:tT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:R6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxrpkhc.sys

Path C:\Temp\nhfaxrpkhc.sys
Size 293KB
SHA256 e9a63074d25fb41fb1d0c13aec21d91583521020fd1959fb76f2ceb1041648e9
MD5 faec3664909c339f60554ee566240af6
SHA1 481451af3e96dfe5e5d18666e35a9fa20892a10a
SHA512 25948ae5efae916f671e1b8f341fd25010d2020d755444a607f9553c8ae561b83254de090428537255bcd7237a3b0d90ae100d1c0c6d0ac8e5b0dc757a29b9a6
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T192545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebwtomg.exe

Path C:\Temp\omjebwtomg.exe
Size 376KB
SHA256 ae13b22fb09c0208b1615b324b963f0768ea7d91548e4f46e49d722fce2fbf6d
MD5 16c1d900a9d9b0c10751a6609ab43eb5
SHA1 e0c90c736ff143a934596f7b781bc1782b460881
SHA512 6cfa7722215d3ab70b95a9e69b81f7e98737cc923b6e3010735676325d89bc4f7cdb40da1673a780813f343639623474d19b8c72858146175a683e5a3248d0c6
SSDEEP 3072:RT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:l6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T120847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzwuomg.sys

Path C:\Temp\pjhbzwuomg.sys
Size 293KB
SHA256 fbfaf6152908795e5169a0d80fe43b0579eb41c56a4afbe151f2b80561278968
MD5 66cd0b330c6ea5e6c8071ef9e52f0d37
SHA1 6ba0e32ad56bf50628fd8abf1cb6aa79c019efd7
SHA512 3ff4c4540be4c10adcc7244b522b3ca5a5871a3442edf611633b3b2f2e58d99e7199f462472591411ae4bbd00a1dc0f1b55dde80da6b4418349968153cd8475e
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczuomhe.exe

Path C:\Temp\pjhczuomhe.exe
Size 376KB
SHA256 2ebaad5b6467a5cb342eae972c570f0ba42109fa097460870f3708d5256faed9
MD5 f772e0bfc3bf0dddbd15cd26916a0494
SHA1 c6b4ddd7f932baf2416c171e7b555b5ef278f3fe
SHA512 be8b6b6102f2625e5b217c7bbe22800138e45eda56471e4229ac0a314e67809a495146633787f1d56e2bdcf8144a5ccf029fbfc6ffc954d3b2d9175bf555cdc1
SSDEEP 3072:rT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:H6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebztrmj.exe

Path C:\Temp\rmjebztrmj.exe
Size 376KB
SHA256 ff1aff3d9a427b0de4221d81c3decd10748c4944153bf377b46e3fe2add4c5fe
MD5 1ff0d22cf46d234cc6295a50112f04aa
SHA1 6f6c2f86e2f47995df637244245194bc72d9bfe3
SHA512 fcea0bb55faee68f2b84f0b5bbd8095985eb21789d81b465fc5e615cc625e7a4f870da7c1bfc2f88cd112bd3578326ae9d02a0fec804098c653b9a3860de370f
SSDEEP 3072:aT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:g6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqjdbwlgey.exe

Path C:\Temp\tqjdbwlgey.exe
Size 376KB
SHA256 8280db18d32af2aa5c57066eeb895035c1d630b782ec0ab885fe367458b93cb6
MD5 42ebd1a4be443dba61115ca60b2e9ecb
SHA1 10758c35f1a91cc299f9cef567d28cdbb30cf890
SHA512 19f9ae8e5219ead9f3ba0bffb1fa3cdb7708169e10c58bc14dab99d157e98f66f6e66416a50f775b446cf256c5c186f927d3fc30591f28859cd5649b4ba91a45
SSDEEP 3072:IT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:m6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T108847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczurm.sys

Path C:\Temp\xrpjhczurm.sys
Size 293KB
SHA256 9f33a8b7f4d4d6af80744b78867a0fe489ef689036e6d13940d34745a378d411
MD5 4a53425801db68f652b8b61f5699641d
SHA1 0ec962c8e3d9137ed30a1eedf8938101d5e2e398
SHA512 9d92643a248a6549ddae38d13d151e684d85afa1adca60bb5857e1191c560581e7c9c05c177982b9d565f924070e5c7344a32d9dabd672c6de28fd9f353d6616
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T11D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxsphfcxup.exe

Path C:\Temp\zxsphfcxup.exe
Size 376KB
SHA256 2e31e0d75dbc76000837c90e33091ad124526239363c138eeb73a1d920ec75dc
MD5 cff2decf5fae53281d2a8b686b2cfea8
SHA1 9be233c1cf789a09bdfc2f565823b345eda51bef
SHA512 42cb5f2711954532427397a8257a257432fe0f571da0c84dc2a45a7015da44ffd26c11c72e49d53e747a773749b9d82f364415dedf271e7544ea67c9dbfb94ee
SSDEEP 3072:NT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:x6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
MD5 0a273f57544ca9c385c90abd2fb2f8b8
SHA1 663d351037054236aaa58a924f66180602045244
SHA512 8a731bd22460fb3b026847be48aab957fe90f0ad7e2dcb291305580f3553409cfdff67355886d3d2f95cd8f8ff1d2726447bc2b96bce2cdcc51a8a15cbcb9d0c
TLSH
T1CFD0C010324DB00CC040203214210360F2309610602B47084020F02CCC78DA173466CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
MD5 b694af012c621426ee8e90a8ed586333
SHA1 e839cf90b93d2693f8046fc19ae1373628f0cf99
SHA512 b9142bc76c532d8974de0c5db727ec4870a44225dc222a9fdc138b1278d0f4cb8cef786ed6b936ee6b436177a50e31c07b489d69dd8d25de345ea17638a55e56
TLSH
T188D08055364DB40CC151253254615365F6749651B42B57185460B01CDC78DA173576DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8edbe445254486c32943f223a5bb03fb7bd633003132cefa5f2515630deb0e57
MD5 e33ffa48dc60388017bdc0e91fd73cf2
SHA1 0fba6a1cf00704606c31040e9cccebff42655549
SHA512 094afd5f0a2a342859b8deb836062b1916309e843631ab240d4394f5b9e1eeab464ed8c0b5dcb9b51cb76118c181f93daf709cc4ceb1c2e5697da5e9411cc451
TLSH
T1D0510A1536620E22C735E27101DE209BFFB4BF92C5276EA9B8F5B1748A1672C5CF2710
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592cc3.TMP
Size 3KB
SHA256 c261d22a611ea77ae1a89f759cad988b1bebd55811c2ae09c456dc3881b9d577
MD5 2faf8e413e1b11d2ff2fdcfb28e945e4
SHA1 5fff5b8aae480f528002cb8b38da0cf047411de8
SHA512 61bf3e76a0a050e36b2e8878df9ac7244674711f84fcd13296308a5159e8f40355fbbf142bc92663e6deb78e3d1d3e65f9f57e461806db1452bab323232c2c60
TLSH
T1A4511B1536620E22C735E17101DE219BFF74BF92C5276EA9B8F6B1748A1672C5CF2710
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

136bb2e5-87ce-450a-8d4d-22cb52f46f32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\136bb2e5-87ce-450a-8d4d-22cb52f46f32.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 78215ecfc9386ca5129cb2ae797ddeb2b1a7b6eb05811de73aca3896fb192204
MD5 f16a7b5be3ada1984d1617667b44d6ba
SHA1 f6cd7a2400c959707b265404b6c66847edaee434
SHA512 8767775ffab86d822e8abecea10037321071c826a80374f91ed9290475d5f3b19ad769a67c3faf98b62288acfb7fdc9ca10fff26a5c1beb9c8651a243b1eaff2
TLSH
T1AE41ADF7C3E4856DC90196F4AA187E2BCE1D0915832C3D5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 62e5fb32607d699b6c6cb8a5b1d09dbabfa72b4d1fc911575f14986f8daefc77
MD5 0e89934f77b40687cf828358c16ad2cb
SHA1 ec9fc0ea67277e8557928342e159ce9feacf386c
SHA512 00d0de8cb0fdb21cbc6860503cbc75243cb66b2e918610bfd47ae88923b71d775bd79998dc5f0cb396a2cb3647522974ca02d9387dad083024326ad7b748e855
SSDEEP 192:sxR5RHyM/jK1Ml8wc1/fbs2r/2ZOPzoA8p93/g6+WNIYH1HMb+GRIgtJ:sxR5DC1/fbs2bAOm9/5Ioi73
TLSH
T18352FA056A3899778CDBD209FA557F53D6F81533A2905E44AAFCDB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cee2065455c601b3776f22cf8ea275ba2a8e039ef1cb0d214ec0ff3dcef62f1b
MD5 631921e468715912dbc06a0be7af5e52
SHA1 ad12dea361be043bb3784c24e439ee490d98de94
SHA512 595181b1baac62d7932e1b46928dc096342cd501cc4ee5100da05d9b24ee56a9498d6f6caa172d219e10938fd95c070e2dfaa954857a8aab6ea99df183775412
SSDEEP 192:sxRqRHyM/jK1Ml8wc1/fbsyrf2ZOPzoA8p98/g6+WNC5W/YH3HMb+GRIgDMJ:sxRqtC1/fbsyjAOm6/5B/+i7c
TLSH
T1DA62EA16693859778CDBE209FA557F53D7F80563A2901E44AAFCDB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 83d20b8a5225ba30da3ebd7c7dfaaec8b22c033effc5cb7dfa404242b2fd4804
MD5 07fd20d249fc8a4c2ea526275fe6ae5b
SHA1 b92b84c9bb712a10e95cacd6459075369219ae60
SHA512 b838757306bb7526b9aabe2834ff492bc926237d7b7774ddf7d6246a9ad537fe9447adb3c3af07201b576335abdfce5bdb6c291f15a8ea8350d457899bdbe1d7
SSDEEP 192:sxRqRHyM/jK1Ml8UQjc1/fbsyrf2ZOPzoA8pr8/g6+WNC5W/YH3HMb+GRIgDMJ:sxRqtqo1/fbsyjAOmg/5B/+i7c
TLSH
T1D062EA16693899778CDBE209FA917F53D6F80573A2901E44A9FCCB0C01E76DD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99365d9aeed4dd28f926715797079bcc6e1c3353e0f919db1d588b81dd59b041
MD5 64f393e21cdeefd39917cebd2580f73c
SHA1 219bf7e028e8117e643538b069bc8dc9b8da2c8f
SHA512 9db8a2808f6c97a8ef36cb317ff93c5856d69245e02e8377d885923e55fb7bdf6795d2e0a2a259e25696c18b6ebf873087bf1cc42e526a6bc0dd120cc627171c
SSDEEP 192:sxRqRHyM/jK1Ml8wc1/fbsyr/2ZOPzoA8p93/g6+WNIYH1HMb+GRIgDqJ:sxRqDC1/fbsybAOm9/5Ioi7C
TLSH
T1FD52FA166A3899778CDBD209FA517F53D7F80573A2901E44AAFC9B0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2be198153bd982a9a8bcc614fe805efd18665451fc34e01619e5f17e33eb0a81
MD5 0b5c3ce6bb39bd62c9eb1968b6001a35
SHA1 6addd18f6fc9e27cfef470aca484e2b28d2027e5
SHA512 793659a4a36892456415428a31b5a73d2928d11d84ba7065b459b6a41a8ca834418e6676f94d573c68adb7f333b1e9d706037ca850b8ec7e9034f215dfeae0e7
SSDEEP 768:JOVPHO7pLuL7E1WgesfvQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVq7jPE+wroXIhz+:JOVPHOE7E1WgesfvQu1ja17jc+biz+
TLSH
T1DFE2FB3B680CCB7E4F804ADDEC2D7D9AADE802CB56D8C95447EA880C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c819.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c819.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 233cecd2e0270a05fad883aca32b5b97863da3a222688392fa9d65f08cef4499
MD5 bf6b2587c7b98ca4e612aba695637b9b
SHA1 54b3c145359f0d9197deabb36ec8aa0209fc0b31
SHA512 5a0a9eb935b3c44bf7ebae1abccc63f99b00226b3b853837af7536b7874d957fc574443d3252e610be0e93e61ab73e584d7f953b2d264d6e9ebc1b6bc4959058
SSDEEP 768:bj+9y3u/pR2BHGlZPYyDPm6MGjzJUZb9M7:O9y3uzoSZQyDnMiMb+7
TLSH
T134F2C031EC94AEB35CE2D689374B3BD76FE461A785840F84D9DA5F0E0287B2D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b427664e46565b327f9e8919abc5d751fdb58a7537063682c38cb207d63a19a1
MD5 92098dea0eecaf27bf1daac6b502025b
SHA1 7f382a5f01f0f50874a4ef23edc9118373e615ea
SHA512 d510cbde5c2530f113e5724c8cc8d31c648966863cb0e75ca6d48272f761ea915843689e26abf3ddc5df7fbc29d54073b24b831a7017120d8e65ee01a8f75489
SSDEEP 768:Vrv+4UNbdl3nvR2BHrPYyDPm6MGjzJ8T+8rY0n:Vbsbn3ZoLQyDnMi2DrY6
TLSH
T14C03C0319C946A736CF2CA85364B7A477FF4919396C40F8499DE2F4D428F96D130B8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d8a66a3724c976cd477bcd5b9d62014b6c244691ba2db45b2fd056db199e995b
MD5 74f4fd1ef3e986b1af60c1946c50dd8a
SHA1 67f77047e45b67b3b48e75f20ede963a71bb3d55
SHA512 3fb89e6d98949907c9325dd5f970942f34307ea9089d81a8e3fc5f94407e75fd8e3e4eaeb1885eebf94e9cb589df1e0c52c9259c47259a52e6cd4695b88a491c
SSDEEP 768:wj+9y3hyipR2BHGlZPYyDPm6MGjzJUZb9M7:P9y3hy2oSZQyDnMiMb+7
TLSH
T1DBF2C031AC94AEB35CE2D689374B3BD76FE461A785841F84D9DA5F0E0287B2D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 d95505ea5f7aba523354845e5c4cfb1ded2ecbff906a61563d3db16efc22fc80
MD5 1e1abb28dbdcd449a570825a98f6da07
SHA1 db360e2c6e16608807bf9361cd6022a924c9120d
SHA512 74ab2c41b4220e3c83007aa5b0b957f888b95a860cc3a13c5057b9047b76e9f8115d995b064d0833de9b5f6eb8bed1b7bbab7806347408763db11e3adb2e8abf
SSDEEP 768:wF1j+9632wg6yAYRBHGl4PYyDPm6MGjzJUZb9M7:d963LynS4QyDnMiMb+7
TLSH
T1981338F198D39A76E8AE8787737E2E469EBCD163B5881984B7C50E0DCD8357FC206811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4060_1294358055\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 2caebbd95752f607e5fc82385786764b498b0a37ba42d7f58112bd00acd12168
MD5 e098942993f65e53ac5eb36a4f1f1376
SHA1 bf229e63e625d91e5fe0da9fa2e40dc6c71b2f63
SHA512 840d3721756e5183200bd99467a9bf228f7f832996914379f5b296c21497cb6f6913784830dd539f0cad97753d4687a001374bbc9d9f64fe6ca449f61a3e2fd3
TLSH
T16A71008356A8C9B3C1DA5BF402835244F1FB223C476330200BA15986AB70A3A68B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-518-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1384-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1392-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1556-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1980-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1984-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2176-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3004-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3128-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3492-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3640-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3724-514-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3836-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3900-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3928-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5744-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-355-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5912-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download