systex | 77c2883a3e5ce5a23527b9eeda013837bd1ca0fb1dddb47535b81859657d88dd

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260706-1wnmxact3s
SHA256 77c2883a3e5ce5a23527b9eeda013837bd1ca0fb1dddb47535b81859657d88dd
MD5 3a44b0e7210253a1faf8a913eca78d8c
SHA1 133a1b8a23f16ce7002d8d5f5cbd7e30914b3d2a
SHA512 cbab2c1ee7a7190039a7a4afd4963e6529c214a85eecb931046263336b83baa13afea142f1b9ae58b0f6bd77b12db975b5e0d7801ed917fbb4bda50f08de03ff
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5900	czuspjhfzxrpjhfc.exe
5792	CreateProcess.exe
5032	czuspjhfzxrpjhfc.sys
940	jhfzxrpjhf.exe
1124	CreateProcess.exe
1268	CreateProcess.exe
5508	i_jhfzxrpjhf.exe
2748	rpjhbzurmk.sys
4416	CreateProcess.exe
4976	wtomgecwuo.exe
716	CreateProcess.exe
1112	CreateProcess.exe
2332	i_wtomgecwuo.exe
2280	uomgezwrpj.sys
4076	CreateProcess.exe
1740	omgeywromg.exe
5368	CreateProcess.exe
1148	CreateProcess.exe
2864	i_omgeywromg.exe
1352	jgbzwroige.sys
5628	CreateProcess.exe
2916	ljdywtolge.exe
4876	CreateProcess.exe
2424	CreateProcess.exe
3464	i_ljdywtolge.exe
1580	igdywqoigb.sys
5648	CreateProcess.exe
4900	dyvqoigdyv.exe
5408	CreateProcess.exe
1648	CreateProcess.exe
1716	i_dyvqoigdyv.exe
4452	ytqoigayvt.sys
4860	CreateProcess.exe
3104	nlfaxvqnig.exe
5884	CreateProcess.exe
1336	CreateProcess.exe
5036	i_nlfaxvqnig.exe
1404	pnlfdxvpni.sys
752	CreateProcess.exe
5776	kigaysqkid.exe
4700	CreateProcess.exe
5020	CreateProcess.exe
3656	i_kigaysqkid.exe
5072	fcxvpnkfca.sys
4224	CreateProcess.exe
2052	hfzxvpnhfz.exe
3412	CreateProcess.exe
5640	CreateProcess.exe
2172	i_hfzxvpnhfz.exe
2388	fzxupmkhfz.sys
108	CreateProcess.exe
4372	urpkhcausm.exe
3632	CreateProcess.exe
1732	CreateProcess.exe
5908	i_urpkhcausm.exe
5048	ezxrpjhczu.sys
3348	CreateProcess.exe
4604	rpmhezwuom.exe
3880	CreateProcess.exe
5072	CreateProcess.exe
5644	i_rpmhezwuom.exe
1488	zurmjebztr.sys
4388	CreateProcess.exe
2460	wtomjecwuo.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1156998620\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_588246398\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2060086425\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2060086425\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_297084638\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_297084638\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_588246398\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_297084638\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_297084638\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuspjhfzxrpjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfaxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdywtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdywtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfaxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxrpjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxrpjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1244	ipconfig.exe
3256	ipconfig.exe
4252	ipconfig.exe
1256	ipconfig.exe
4080	ipconfig.exe
4480	ipconfig.exe
5804	ipconfig.exe
3928	ipconfig.exe
4412	ipconfig.exe
5508	ipconfig.exe
1208	ipconfig.exe
1564	ipconfig.exe
4652	ipconfig.exe
628	ipconfig.exe
988	ipconfig.exe
2548	ipconfig.exe
256	ipconfig.exe
476	ipconfig.exe
5880	ipconfig.exe
4836	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{5F5C70CA-7600-4660-8BCF-0416E5C98B25}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe
5900	czuspjhfzxrpjhfc.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5508	i_jhfzxrpjhf.exe
Token: SeDebugPrivilege	2332	i_wtomgecwuo.exe
Token: SeDebugPrivilege	2864	i_omgeywromg.exe
Token: SeDebugPrivilege	3464	i_ljdywtolge.exe
Token: SeDebugPrivilege	1716	i_dyvqoigdyv.exe
Token: SeDebugPrivilege	5036	i_nlfaxvqnig.exe
Token: SeDebugPrivilege	3656	i_kigaysqkid.exe
Token: SeDebugPrivilege	2172	i_hfzxvpnhfz.exe
Token: SeDebugPrivilege	5908	i_urpkhcausm.exe
Token: SeDebugPrivilege	5644	i_rpmhezwuom.exe
Token: SeDebugPrivilege	4436	i_wtomjecwuo.exe
Token: SeDebugPrivilege	984	i_bwtomgeywq.exe
Token: SeDebugPrivilege	4276	i_wqoigaytql.exe
Token: SeDebugPrivilege	5172	i_qnigaysqki.exe
Token: SeDebugPrivilege	852	i_gdyvqnigay.exe
Token: SeDebugPrivilege	6096	i_vsqkifaxsp.exe
Token: SeDebugPrivilege	2060	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	504	i_mkeczurpmh.exe
Token: SeDebugPrivilege	5700	i_cwuomgezwr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 5900	3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3872 wrote to memory of 1612	3872	2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1612 wrote to memory of 2912	1612	iexplore.exe	89
PID 2912 wrote to memory of 3292	2912	msedge.exe	90
PID 2912 wrote to memory of 3356	2912	msedge.exe	91
PID 2912 wrote to memory of 5704	2912	msedge.exe	93
PID 2912 wrote to memory of 3356	2912	msedge.exe	91
PID 2912 wrote to memory of 3356	2912	msedge.exe	91
PID 2912 wrote to memory of 4712	2912	msedge.exe	94
PID 2912 wrote to memory of 4712	2912	msedge.exe	94
PID 2912 wrote to memory of 2256	2912	msedge.exe	95
PID 2912 wrote to memory of 2256	2912	msedge.exe	95
PID 2912 wrote to memory of 2256	2912	msedge.exe	95
PID 2912 wrote to memory of 2164	2912	msedge.exe	96
PID 2912 wrote to memory of 2164	2912	msedge.exe	96
PID 2912 wrote to memory of 2164	2912	msedge.exe	96
PID 2912 wrote to memory of 2772	2912	msedge.exe	97
PID 2912 wrote to memory of 2772	2912	msedge.exe	97
PID 2912 wrote to memory of 2772	2912	msedge.exe	97
PID 2912 wrote to memory of 1760	2912	msedge.exe	98
PID 2912 wrote to memory of 1760	2912	msedge.exe	98
PID 2912 wrote to memory of 1760	2912	msedge.exe	98
PID 2912 wrote to memory of 1988	2912	msedge.exe	99
PID 2912 wrote to memory of 1988	2912	msedge.exe	99
PID 5900 wrote to memory of 5792	5900	czuspjhfzxrpjhfc.exe	102
PID 2912 wrote to memory of 3028	2912	msedge.exe	105
PID 2912 wrote to memory of 2328	2912	msedge.exe	106
PID 2912 wrote to memory of 3028	2912	msedge.exe	105
PID 2912 wrote to memory of 2328	2912	msedge.exe	106
PID 940 wrote to memory of 1124	940	jhfzxrpjhf.exe	108
PID 2912 wrote to memory of 3192	2912	msedge.exe	112
PID 2912 wrote to memory of 5880	2912	msedge.exe	115
PID 2912 wrote to memory of 5880	2912	msedge.exe	115
PID 2912 wrote to memory of 3728	2912	msedge.exe	116
PID 2912 wrote to memory of 3728	2912	msedge.exe	116
PID 5900 wrote to memory of 1268	5900	czuspjhfzxrpjhfc.exe	117
PID 5900 wrote to memory of 4416	5900	czuspjhfzxrpjhfc.exe	121
PID 4976 wrote to memory of 716	4976	wtomgecwuo.exe	123
PID 5900 wrote to memory of 1112	5900	czuspjhfzxrpjhfc.exe	126
PID 5900 wrote to memory of 4076	5900	czuspjhfzxrpjhfc.exe	130
PID 1740 wrote to memory of 5368	1740	omgeywromg.exe	132
PID 5900 wrote to memory of 1148	5900	czuspjhfzxrpjhfc.exe	135
PID 5900 wrote to memory of 5628	5900	czuspjhfzxrpjhfc.exe	139
PID 2916 wrote to memory of 4876	2916	ljdywtolge.exe	141
PID 5900 wrote to memory of 2424	5900	czuspjhfzxrpjhfc.exe	144
PID 2912 wrote to memory of 468	2912	msedge.exe	146
PID 2912 wrote to memory of 2304	2912	msedge.exe	147
PID 2912 wrote to memory of 2052	2912	msedge.exe	148
PID 5900 wrote to memory of 5648	5900	czuspjhfzxrpjhfc.exe	151
PID 4900 wrote to memory of 5408	4900	dyvqoigdyv.exe	153
PID 5900 wrote to memory of 1648	5900	czuspjhfzxrpjhfc.exe	156
PID 5900 wrote to memory of 4860	5900	czuspjhfzxrpjhfc.exe	160
PID 3104 wrote to memory of 5884	3104	nlfaxvqnig.exe	162
PID 5900 wrote to memory of 1336	5900	czuspjhfzxrpjhfc.exe	165
PID 5900 wrote to memory of 752	5900	czuspjhfzxrpjhfc.exe	169
PID 5776 wrote to memory of 4700	5776	kigaysqkid.exe	171
PID 5900 wrote to memory of 5020	5900	czuspjhfzxrpjhfc.exe	174
PID 5900 wrote to memory of 4224	5900	czuspjhfzxrpjhfc.exe	178
PID 2052 wrote to memory of 3412	2052	hfzxvpnhfz.exe	180
PID 5900 wrote to memory of 5640	5900	czuspjhfzxrpjhfc.exe	183
PID 2912 wrote to memory of 1468	2912	msedge.exe	185
PID 2912 wrote to memory of 1468	2912	msedge.exe	185
PID 5900 wrote to memory of 108	5900	czuspjhfzxrpjhfc.exe	191
PID 4372 wrote to memory of 3632	4372	urpkhcausm.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_3a44b0e7210253a1faf8a913eca78d8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Temp\czuspjhfzxrpjhfc.exe
  C:\Temp\czuspjhfzxrpjhfc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfzxrpjhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5792
  - - C:\Temp\jhfzxrpjhf.exe
      C:\Temp\jhfzxrpjhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfzxrpjhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1268
  - - C:\Temp\i_jhfzxrpjhf.exe
      C:\Temp\i_jhfzxrpjhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Temp\wtomgecwuo.exe
      C:\Temp\wtomgecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\i_wtomgecwuo.exe
      C:\Temp\i_wtomgecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4076
  - - C:\Temp\omgeywromg.exe
      C:\Temp\omgeywromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1148
  - - C:\Temp\i_omgeywromg.exe
      C:\Temp\i_omgeywromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdywtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\ljdywtolge.exe
      C:\Temp\ljdywtolge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdywtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2424
  - - C:\Temp\i_ljdywtolge.exe
      C:\Temp\i_ljdywtolge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\dyvqoigdyv.exe
      C:\Temp\dyvqoigdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1648
  - - C:\Temp\i_dyvqoigdyv.exe
      C:\Temp\i_dyvqoigdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfaxvqnig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4860
  - - C:\Temp\nlfaxvqnig.exe
      C:\Temp\nlfaxvqnig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfaxvqnig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1336
  - - C:\Temp\i_nlfaxvqnig.exe
      C:\Temp\i_nlfaxvqnig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:752
  - - C:\Temp\kigaysqkid.exe
      C:\Temp\kigaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5020
  - - C:\Temp\i_kigaysqkid.exe
      C:\Temp\i_kigaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4224
  - - C:\Temp\hfzxvpnhfz.exe
      C:\Temp\hfzxvpnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\i_hfzxvpnhfz.exe
      C:\Temp\i_hfzxvpnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:108
  - - C:\Temp\urpkhcausm.exe
      C:\Temp\urpkhcausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Temp\i_urpkhcausm.exe
      C:\Temp\i_urpkhcausm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhezwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3348
  - - C:\Temp\rpmhezwuom.exe
      C:\Temp\rpmhezwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhezwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5072
  - - C:\Temp\i_rpmhezwuom.exe
      C:\Temp\i_rpmhezwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4388
  - - C:\Temp\wtomjecwuo.exe
      C:\Temp\wtomjecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomjecwuo.exe ups_ins
    3⤵
    PID:3916
  - - C:\Temp\i_wtomjecwuo.exe
      C:\Temp\i_wtomjecwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    PID:5048
  - - C:\Temp\bwtomgeywq.exe
      C:\Temp\bwtomgeywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    PID:1712
  - - C:\Temp\i_bwtomgeywq.exe
      C:\Temp\i_bwtomgeywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run
    3⤵
    PID:932
  - - C:\Temp\wqoigaytql.exe
      C:\Temp\wqoigaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    PID:2488
  - - C:\Temp\i_wqoigaytql.exe
      C:\Temp\i_wqoigaytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    PID:4436
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    PID:4652
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqnigay.exe ups_run
    3⤵
    PID:1432
  - - C:\Temp\gdyvqnigay.exe
      C:\Temp\gdyvqnigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqnigay.exe ups_ins
    3⤵
    PID:5252
  - - C:\Temp\i_gdyvqnigay.exe
      C:\Temp\i_gdyvqnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkifaxsp.exe ups_run
    3⤵
    PID:3088
  - - C:\Temp\vsqkifaxsp.exe
      C:\Temp\vsqkifaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkifaxsp.exe ups_ins
    3⤵
    PID:1668
  - - C:\Temp\i_vsqkifaxsp.exe
      C:\Temp\i_vsqkifaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    PID:6040
  - - C:\Temp\pnhfzxrpkh.exe
      C:\Temp\pnhfzxrpkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    PID:960
  - - C:\Temp\i_pnhfzxrpkh.exe
      C:\Temp\i_pnhfzxrpkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurpmh.exe ups_run
    3⤵
    PID:4136
  - - C:\Temp\mkeczurpmh.exe
      C:\Temp\mkeczurpmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurpmh.exe ups_ins
    3⤵
    PID:4508
  - - C:\Temp\i_mkeczurpmh.exe
      C:\Temp\i_mkeczurpmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomgezwr.exe ups_run
    3⤵
    PID:852
  - - C:\Temp\cwuomgezwr.exe
      C:\Temp\cwuomgezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomgezwr.exe ups_ins
    3⤵
    PID:2796
  - - C:\Temp\i_cwuomgezwr.exe
      C:\Temp\i_cwuomgezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebwu.exe ups_run
    3⤵
    PID:4368
  - - C:\Temp\bztrljebwu.exe
      C:\Temp\bztrljebwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4412
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff981ebc188,0x7ff981ebc194,0x7ff981ebc1a0
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2323063181600644765,7501290295892996309,262144 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10674178252376826610,14516635384494761889,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      System Time Discovery
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,8919359888437796110,106251094496957916,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,10179635468755588805,18065924131945136868,2097152 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,5537287558622624584,330269613562775503,2097152 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,17846292231262234289,5616048448726966062,2097152 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,15671982379973502173,16035508946137103030,2097152 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,15784554686764470989,9235770205109629803,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,3647597275375042824,6120686931156213664,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,15372925302611760316,6958202917817236130,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2005146381237877452,6898349644553003763,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2005146381237877452,6898349644553003763,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,17088025341535881629,2618984152860804287,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,17087874972298874228,9127196214668115899,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,2095378711238210541,8084073648418601956,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,10409699275685023942,5437318359191025806,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4726663501496788721,4882479633599051540,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,10225785073307748534,13763315566093882048,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:14
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,4195987231631890545,10551029934335656150,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,13614062776878570606,14688712883989153982,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9513132407632669352,16749802547072517407,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,4891507752201876156,3591824828817731014,262144 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:10
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3200728485366317004,3408326232985727406,524288 --field-trial-handle=2364,i,17565799336733007898,14545429113767336572,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2544

C:\Temp\czuspjhfzxrpjhfc.sys
C:\Temp\czuspjhfzxrpjhfc.sys
1⤵
- Executes dropped EXE
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3104

C:\Temp\rpjhbzurmk.sys
C:\Temp\rpjhbzurmk.sys
1⤵
- Executes dropped EXE
PID:2748

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:2280

C:\Temp\jgbzwroige.sys
C:\Temp\jgbzwroige.sys
1⤵
- Executes dropped EXE
PID:1352

C:\Temp\igdywqoigb.sys
C:\Temp\igdywqoigb.sys
1⤵
- Executes dropped EXE
PID:1580

C:\Temp\ytqoigayvt.sys
C:\Temp\ytqoigayvt.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\pnlfdxvpni.sys
C:\Temp\pnlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\fcxvpnkfca.sys
C:\Temp\fcxvpnkfca.sys
1⤵
- Executes dropped EXE
PID:5072

C:\Temp\fzxupmkhfz.sys
C:\Temp\fzxupmkhfz.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\ezxrpjhczu.sys
C:\Temp\ezxrpjhczu.sys
1⤵
- Executes dropped EXE
PID:5048

C:\Temp\zurmjebztr.sys
C:\Temp\zurmjebztr.sys
1⤵
- Executes dropped EXE
PID:1488

C:\Temp\bztrlgebwu.sys
C:\Temp\bztrlgebwu.sys
1⤵
PID:2124

C:\Temp\wqoigdyvto.sys
C:\Temp\wqoigdyvto.sys
1⤵
PID:5612

C:\Temp\ywqoljdbvt.sys
C:\Temp\ywqoljdbvt.sys
1⤵
PID:2548

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
PID:1240

C:\Temp\dausnkfdav.sys
C:\Temp\dausnkfdav.sys
1⤵
PID:1980

C:\Temp\usmkfcxupn.sys
C:\Temp\usmkfcxupn.sys
1⤵
PID:4256

C:\Temp\upmkecaxsp.sys
C:\Temp\upmkecaxsp.sys
1⤵
PID:3276

C:\Temp\zxrpmheczu.sys
C:\Temp\zxrpmheczu.sys
1⤵
PID:2416

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

czuspjhfzxrpjhfc.exe

Path C:\Temp\czuspjhfzxrpjhfc.exe
Size 376KB
SHA256 1510ab8246aa113ce6fbfa1786d367bc63c8305d396483e5eb4ac47714b0bc55
MD5 d1642cec285bb4a50c35b60d1e2999df
SHA1 b29d356c89c248ad3704d52b875188d8a132aad7
SHA512 f1740bdd668732ad37688d5b0a2e446268ebec5a65a2c791203bf33e57b640e3b67c73da760a6872f60be61a4b00d573f66fbbb00e88524f66d45846e55c30f6
SSDEEP 3072:lFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czuspjhfzxrpjhfc.sys

Path C:\Temp\czuspjhfzxrpjhfc.sys
Size 293KB
SHA256 9cd0265aa608346d7fd5c04b46222c2d6f6196f5d7ef76b16f12ce097fe10037
MD5 7fa5e8a8aa5bec1bdae4774d32d0662f
SHA1 f7968f6253cb13809cbaee53db2b519837d7e7e3
SHA512 76ae2c0955fea258a418fe5c9522583070e4cde54f3dd4f3b0c2c8ff2910e2c33be41d0a72c72f720ddc0fa157bcac7a3ecab3e5ac523419397d6a6132f77196
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigdyv.exe

Path C:\Temp\dyvqoigdyv.exe
Size 376KB
SHA256 1db155bef4be10fa4c9663d7fa6f0ccb680153ea857b8dac19846708da13a2d7
MD5 ce88d29218b161356ab8c173f80d9758
SHA1 30930d71d6d9f92570e14b95c120f5f7f76e2605
SHA512 fbd84ddd6cb2d88432e4b441ebf0412aa48e8ce6997f8aee6de9f4dce76b994cd3a431dde08695d4e2e24af730a4cb51e8afe1fac7890a4e69fc151f31ac567f
SSDEEP 3072:NFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqoigdyv.exe

Path C:\Temp\i_dyvqoigdyv.exe
Size 376KB
SHA256 f448c0ee542577687944a60348255e0057335183966574b4510bf351b6ccaf77
MD5 c8db48db9cbcf7586d2af6e0ce6865f4
SHA1 cb3f434ad8f050071c4b2c8199be2e2ccd2a5390
SHA512 e20111a5b82c57b0ff6490cb52b82b9d4f87ebd85b7f8d1657b71a4c906b48a52e5c5b64f2ad881a2866207ebf575d8ba9afda26700e7d8a57f9c389c80f26ab
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhfzxrpjhf.exe

Path C:\Temp\i_jhfzxrpjhf.exe
Size 376KB
SHA256 3d3eab0765f5bdf9266b5a91fb646c443f076a5a06bde215493228a37d369953
MD5 2358ae5d8738f621ccdc0b112ad89299
SHA1 102a151f0af83597660eb72dc622e0cb68547be0
SHA512 b95997f1abf5901774db32ed220b781aed908fa6d353d6e126500201e332d9cae237be9e517952c7a81856d40dedaddd9c57234ef831d24f487e7bb78757858a
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdywtolge.exe

Path C:\Temp\i_ljdywtolge.exe
Size 376KB
SHA256 d0455e68d32eb5bbc57210e631ca319bdadaa1241e1c6051902bb08fb9dc8468
MD5 b082e3827a7d84d2d5cf9cfb6384971b
SHA1 94c6492ec70649e2ef56bb0404d0e66223ae6c78
SHA512 8e0c7da1d398d42c541c52677a00fb1c67019930c018f83b7e8908b96002fea3da1615b9e5f72638466bcba59b267b386b1bf4f787eadf4443e756629257376b
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywromg.exe

Path C:\Temp\i_omgeywromg.exe
Size 376KB
SHA256 246a100d132dd553e9a050ddb98b1b6d2574e5ef66ce52fd57891727c66ae9ac
MD5 5ea60bd62429575726c7b904f1d799fa
SHA1 bbf5184d9a65a54109c2af3b74c854b7e20bfa61
SHA512 fe6ba8360d4a7bae4ab30b7223e32f41942e54ab4742c59bb9718ee905bb133e87650005dcf5105bc32a42dd1aa07d0f0cee7bdf9a0b045ed0740334cee9ac06
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtomgecwuo.exe

Path C:\Temp\i_wtomgecwuo.exe
Size 376KB
SHA256 13636544bb19745ba16ca840abfa062759347e9a4bad5f6095121780e4c8c27f
MD5 ef4edc79fc953be445b8fb6cece834f1
SHA1 3cafcc00fdfe786dfea39ea0790aca53053915d5
SHA512 09b768115390db71b46da9500b7bd47d3d93ff595e2a2c1ab17b953475f5618c5d0e93273837b8c438692bffc97070b7821a294ecf37c81f303315452d459a9b
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoigb.sys

Path C:\Temp\igdywqoigb.sys
Size 293KB
SHA256 22a2a0cb7f65e3652cbed1dcf323802e8ce84e104f844b2c5400c578ca97d0a5
MD5 5a154cca749fed6648a6b60c34199784
SHA1 f6e018f04d907f9da5e6e9efc95084128f02ce80
SHA512 0936fb9984c905baf92a871a168aa970219ba383642df7c4826662575b18945fe58b48a4bdb078d7fc50b556f4d7d779af312df20c5636f5607f85a72dcb6512
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbzwroige.sys

Path C:\Temp\jgbzwroige.sys
Size 293KB
SHA256 d567ca741f578c20bd637595b04cc75345d17904423b1713f62a887726981660
MD5 9a37d2e4e4e868ddca0bc2135a75d86c
SHA1 f72d3517971ebe3cdff842d320559ce092472b61
SHA512 05a8d0f5a3174e07cb70915dd7d450d949a094ecfdb10b71cc50ebb690a0dbbafc412a148623172b1e6a94f72d13436471f21374dd8879937c98a65564f1314a
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfzxrpjhf.exe

Path C:\Temp\jhfzxrpjhf.exe
Size 376KB
SHA256 f937cf4c0d3947d54bf8eec7d323c9112143dc49428fb35fd3b0df132ee450a7
MD5 3bf8a74966418c4897d77e182e16f259
SHA1 965ccb0508fa662976986da5ef00f12b4bd2f9b3
SHA512 5cc671e73d542f868b5e9565bc41b4b0fdee79e347a53ebff41e796d8f26d496ef5ab8128c7e1a4ec1b436d9acb2eacc2414fe81427425c7625ea6aa795b0c36
SSDEEP 3072:rFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdywtolge.exe

Path C:\Temp\ljdywtolge.exe
Size 376KB
SHA256 0f39b715c1c681d9de209398b877dd47510205c37757f4aba9827303b230c66b
MD5 c159b94905972d5c29d00e79d462c75d
SHA1 5c81c6c4d8ce989355be87a2afa4f4b5aeea999d
SHA512 576df32be7499124d1a8e7ad2fc581ba70f04549aa14461f96577912965ec5f1e408ba99bc0530fc5473ee2b61ca73a7fe443122f08d525643a098d42bda13a8
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfaxvqnig.exe

Path C:\Temp\nlfaxvqnig.exe
Size 376KB
SHA256 007ea3c607ef726001b4a7f9a6ca0810352697c71788ff41b5ac7a18f881f645
MD5 49a24b73b4024f94f6748a3c8be4e348
SHA1 e8850b2af48870c8c1999961e1e5af922626771f
SHA512 0ce904eeba65ca220c2222ad87fc89e93f70278e3f195b6609aefb95e71b83afa7f187120cd2894420e0b787820beecf336c2c565fbb4f65b66275b12e855b47
SSDEEP 3072:DFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywromg.exe

Path C:\Temp\omgeywromg.exe
Size 376KB
SHA256 39e7a381694405a26318ed642e553106a3c40030875b779e931ef5f3a9d1c444
MD5 933d7cd5c3bb45722a2d1f8a7bbc20d1
SHA1 74eec02ad97c076bc5f91f8ebb946edf717a0536
SHA512 6cce647be480fd0b8800bfcabe17d8b98adcb0f715108365646c7572fb734c4ac96de1f32dfce0de92cecac0746d000182fe15954424c9a4bdb6ed4a0d644d7c
SSDEEP 3072:TFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T107847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzurmk.sys

Path C:\Temp\rpjhbzurmk.sys
Size 293KB
SHA256 459fc5fd9ffba678756eed058344130a59214eaac98b6bed52a44fc22b88da66
MD5 43d78ceaab90d535db080211afd4e0b7
SHA1 33088e116ca00a1b5fcec0013880a2a22461d624
SHA512 e3627c5dcf09e587d861c540153f3320d8530ad1f69debbdd20b875cd9de2052e62a35b218c6e31270726e9fd276eb94a9fcdfd94a199f35e66d9ab8814abb78
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrpj.sys

Path C:\Temp\uomgezwrpj.sys
Size 293KB
SHA256 ac183d0c022a9bfc3d3da85002e63e52286be17a4ca024d91b6bdce5f8827165
MD5 c4c959abfa280056e1ab5aa3cb48b456
SHA1 1b75e07644a8242f604dce5575b7262ddf392224
SHA512 2907b8928e99879d58502ec07929db5e2cc2f19064913075d561631f9eeb8afd45130b8f45ca614062ec035d75a6ea74a61788f4a7cd84891a579ebae34d59ad
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgecwuo.exe

Path C:\Temp\wtomgecwuo.exe
Size 376KB
SHA256 7d26e0d5d21550939d8613ecf071821117e021e220635c5de0624ebd5edd1ac0
MD5 f238d62c526f52f61e61142f6df6464a
SHA1 fac4e1710dc0c04e13d1715281d10033557b7a2c
SHA512 7af5f94109c19efa5fcca5e2b0cd8b6039dd0904c3602d831df026550df4d08de29c201399ae86de77f339cea419dda51e46f066445fe04c04b48191b6489c3a
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigayvt.sys

Path C:\Temp\ytqoigayvt.sys
Size 293KB
SHA256 2c859fda416e259d8a1bc63cb38f94c08ea5bddf54bb6b20402d775f24de9869
MD5 08ac2190d8a8bb0f81ff84d8e0db9f7a
SHA1 cffd44fb8b1a1ec63858c9f9d8df3e8e284d8fbe
SHA512 41cd02d1f238975cf36e33266040f1f8ca99d90c0ea91ca5af848d3124880992d5f211b2e60405c9dd4e52c31c6a0107ad35087750b883034d2742731b715ac4
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bec8a3abdcd2976f409e6ab03e6ba4e69998342ff5097a55c9fbaf29ffdbd16a
MD5 f9ee6bfbafa38cab5eae75966039fba6
SHA1 8036d2b8e64edfd5748b911442094096653d4570
SHA512 e0356e371992fc497ffe8ba67fc258249bd7e59ec954351bad1a2a05475eeb4de44a8c91e3065289d1b9587e47d05f011ffa50dfe5daf27242e35b6c4eaef04b
TLSH
T1DE519650037579D2E7E941BDEAE809DA3E7CAC6A31E76EE814807C3B8D3A3245351034
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596018.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596018.TMP
Size 2KB
SHA256 f19191a0fb21b11b1b3ad07e6019db97a8df61493c68e7d51f1039e354d661d7
MD5 f74b9781ebfd4a699da5babde60e5f10
SHA1 5dcd432427737b8f8bd05b4c12c587c039289773
SHA512 0d9619edb90524cb5bfe55b670437d580b6f94413fcf940d89ac5f2b4d728b8038e3356bc80bdd6340b00d49dd24ec925b2af5b6581fec705fe4b6f694e82785
TLSH
T13B519650037579D2E7E941BDEAE80ADA3E7CAC6E31E76EE814807C3B8D3A3245391034
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1223bb5c2ec161cb1aeee0515e580d6023154a80bd8253db40de7893aaafd299
MD5 9dbb39e3a0e296f4f36f0b1ac446c465
SHA1 510394a506eaae565ceee1b05429c5bbad77c988
SHA512 029d68eec10eb66bb6f9a7ab5e09862af43adf3ff3dd723a06f737ab8ff1dc30695e39c8e94905f1fdc9f22bf34e4adcefeabc8d8f3deea368cd3ba9c2fca344
TLSH
T17A41B0F3C3E4856EC91195F0AB186E2BCE1D0915432C3D5AC5E4EE5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 61236cea49b42505b379b06d050136da53476c830fc3ef4dba78d8931687c3a7
MD5 49c09e163648dab2bcbbbbecbbf4f1b9
SHA1 41bef526b24d3c0585f4ba6ac7dd89df3776ba36
SHA512 c563f0b6976241db4380c0b94ab89cfbbfd9163e995cabe6e9a9d6005a8290497e829f479d0ee6291db0fa39dae0bf36a97dd139b1d73aa91b7272e977a137c6
SSDEEP 192:sxR/RVyM/jK1Ml8wC2/frsSfFBeZVyA8xlzoA8p9u/g6+WNCJm/YDpmGLIgtJ:sxR/R82/frsSNBYVyA8xIg/55/63
TLSH
T13F62D905AA3499378CDBD219FA557F53D6F81573A2901E44AAFCCA0C01EBAED6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cd441099e17263fac8433e5ca139b1a48858a5ebd06eac5cbc37bfb723084155
MD5 f75a069d610f9cd6563984a52cde85f3
SHA1 83557f1b2fe9934718a83ee615f6d0df885d8513
SHA512 cab88877dc1984e67e0cde90f7b58672c8ca46deccd18751b8a4fe3d2ad0bc6e418e3e538fe156e2170c7ee1d2dde66cd65636e5f55a1c4a31a017562e5133b5
SSDEEP 192:sxR4RVyM/jK1Ml8wC2/frskfFBeZVyA8xlzoA8p9u/g6+WNCJm/YDpmGLIgDtJ:sxR4R82/frskNBYVyA8xIg/55/6z
TLSH
T11962E905AA3499378CDBD219FA557F53D6F81573A2901E44AAFCCA0C01EBADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 93f703461ab5fb1b73b2ecf235428a2561fbe18e7b60519d0b7b9a5615797a02
MD5 8de0c5204597b740093542ffbec04c06
SHA1 bbea383801dd5c0f2b4f611533e063877d520312
SHA512 c5822dc66e7694ef65ea2ebfca1434f559843e524f25e12b55e09282a6768c694e47a5d72bf80ffadd7d2907b616e34f0284253dd4b8bfe07c297c0d2f1ad0f8
SSDEEP 192:sxR4RVyM/jK1Ml8UQIC2/frskfFBeZVyA8xlzoA8pru/g6+WNCJm/YDbmGLIgDtJ:sxR4Rqv2/frskNBYVyA8xIq/55/+z
TLSH
T10A62D915AA349937CCDBD219FA557F63D6F81473A2901E44AAFCCA0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d2946e9e38dee465e3e1bf5ffd918de69e1b91538f47de0e9f90cba363abca5b
MD5 0be8f07b36e6d8f241fa1bdc16fd708b
SHA1 071a58151a66ff982bde244cbfa0fa79d6830a93
SHA512 6bb40160a783a16668470a84a9542865b858efdb9e8325c877f6561334c19418b5750f9e4038f47868d618e981d011c8d46b98c50dc590fe03cfff5add7e06f2
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OValDIn2Kro71Wf:f+4+zBE7eDWgb/fPIu1jaRlDw2h7of
TLSH
T13AE2EB7B680CCB7F4F404A9DEC29BD9E6DE801CB9698C95447EA890C03C7AEB51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 60fe40424dd5495575ae437cdc0da1b82ad29ae7bbb948f6ff61b58557c8b03c
MD5 ac0a2ace4c93b5adc10b8620a8da4e5a
SHA1 5da2e470a850a4170ce7afb775b683a1460117a2
SHA512 0ef494cf6a0b33edd7ce120537183ddd98a2e1e0fa55919f13d690c3b496b37633f1fb441d4ea1e04b45e7f9def2fa853f9c790358786b6ecfdf08d664fad4f7
SSDEEP 96:KR1i7Pj5J1WdSIg91K4EgT1c7j6dJOHm7KmgIIOW4tVgGOK47g0OcOGlkWGbqGAN:C1i7Pj5JAdSp9/EgTK7j6dJOHm7KmgIy
TLSH
T1B2914914327B02C0393E349882BC8C57D5C274637017B86B3BE855D66F66D06AEFE9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fb3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fb3e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 c14f2fd45181acbd9520bb0f3847c52d33c9e1e9692b2ea0d46cda90487e7362
MD5 eef8a12b9914f4036d0f5a9f30595adf
SHA1 94a8e162512903c86a64003de07f2c6293b898c5
SHA512 bc3c096360c0b5482dc59d1da84605d90038db347d7ef9e60d4f4299691b931c581b040b12863652f3ae0b872bafd3ab1a60a0c7b948de16ea7216ec5695dff8
SSDEEP 768:kF1j+9h3gwgt6lS7rtaHuVboPzkZLNx9OF08b9M2:p9h3rkroHOawZLNq7b+2
TLSH
T1AC1316F5A8D38937D89E4787A33D2D46AEFCD163B5841984BBC85E0CCC961BFC60A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4f0cc72faba4d3af1000e58a51ff1c8696f2cab30373118f2d049a4eaf63cdb
MD5 96d2066ef53dd45f7c037db11231fd15
SHA1 3f2dfaf1b200e77bb7a344762227f941b42e01cf
SHA512 753d770ad17ea156b2ab2645bea3004794aa22dc98ce0974ef539fa28a3d6866d728004fc2af781c0e40409a20b5fadde4dbe31c6e3e9a67e8d3d2d4cfd8eab4
SSDEEP 768:0rv+4UNbdC3iU2xwifRaHuVboPzkZLNx9OZkUik4K:0bsbs3iUjjHOawZLNq6UVr
TLSH
T17803BF36A4749C37CDE79289B24B79477FF4211385C40B88C9EC2B4D46AB4AD270BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bcfca173b7aeb29c835546c0b4e177c1498ed4e7f0f9bb13d199dd13579d67b4
MD5 ea1834a34de192793b96a09477a9621f
SHA1 54d8d568ef78791ef1549ceff46100589fcaad2e
SHA512 46dfea91b03365018877a9bcf115e9fb3bd5fcb5aaf796307389ff5aeef58241ff48b052e54a75b7787b7b7e374b2e934c9008ecb0b80f9b2ac7bb2ca5ee5afb
SSDEEP 768:7rv+4UNbdL3r6vfwifS/haHuVboPzkZLNx9OF08pl:7bsbF3+gF/cHOawZLNq7f
TLSH
T1BF03AF31B474DD378DEB9689B14B3A837FF4215389C00A88D9D85B4D056B5EE2B0BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9047aa8ab3af3c6d4fca0ec6e1bb4fcf1b80284348c810b10ef891ddf7266c6f
MD5 1294a44318deb1aa5f6b5a26c29313d3
SHA1 819ba3b6d4fb3aaa68c8a443f792fe36b4e55093
SHA512 7a25a8413ae80ecfed93b8e91da1cf42c229317a225263d19cab06b47ec8b8563435b9d5580afb14d090efc864187af98be0d4f2fbd8536e24dfa0b9d8c9bab7
SSDEEP 768:Qj+9h3r6+fwifS/haHuVboPzkZLNx9OF08b9M2:v9h3+5F/cHOawZLNq7b+2
TLSH
T14DF2BF71B861DD338CAB9799B24B3A93BFF0216389C00E48DDD86F0D05975AD1B1BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

dfad63b0-c99d-4b1f-9b29-9dfe0835066c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dfad63b0-c99d-4b1f-9b29-9dfe0835066c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2912_430413773\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0ebbe16b17a88f9700f34e745833fc911b51d6dacc182c0444af00e28408334e
MD5 76074c47e3de4a87b2c401ddd3ab2171
SHA1 ab2135e6cbc9129cf9b5b39d55a83ab27dd59540
SHA512 044192d06583a9226ea023979d9002549590259c088f430a6a5336ab1b086bccae4f7a1a5c1584e74ffb7c61c112fc7ba9cc16e62c08915c978bf97fe04887d0
TLSH
T16D7123835AB9D5B2C1DE5FF002835648F5FB2378072330614B915546AB34A3E54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1240-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1352-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1488-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1580-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1980-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2124-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2280-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2416-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2548-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2748-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5032-67-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5048-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5072-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5612-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download