systex | bf97de6449f5dea152dc1922f8e80a8dbf0474d9ada2434d782796449a982dc6

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260707-3ev2rsfz2t
SHA256 bf97de6449f5dea152dc1922f8e80a8dbf0474d9ada2434d782796449a982dc6
MD5 39ec3852fe4ea29c0f6ad760b8b6f7aa
SHA1 b964e65387d6e536861fdc6818e97034d88f5f4b
SHA512 9a4c583852ad60dba919875073875d747e778ac236380c44d2b6fd406e358c846c15ccc26a74180f41d0da4aa30aac35ea7386d4c0361a33bfb93d933a670b8f
SSDEEP 3072:q6uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLW:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2548	vtolgeywqoigbywq.exe
1308	vtolgeywqoigbywq.sys
5832	CreateProcess.exe
940	bywqojgbyt.exe
5244	CreateProcess.exe
4948	CreateProcess.exe
6044	i_bywqojgbyt.exe
5116	ywqoigaywq.sys
5904	CreateProcess.exe
2296	oigbytqljd.exe
1860	CreateProcess.exe
3352	CreateProcess.exe
4708	i_oigbytqljd.exe
4396	fdbvtnljdb.sys
2804	CreateProcess.exe
4692	xvqnlfdxvq.exe
4416	CreateProcess.exe
5668	CreateProcess.exe
3564	i_xvqnlfdxvq.exe
2644	snkidaysqn.sys
1536	CreateProcess.exe
5096	qnifdxvpni.exe
1384	CreateProcess.exe
6096	CreateProcess.exe
4472	i_qnifdxvpni.exe
2700	ifaxspnhfd.sys
2500	CreateProcess.exe
976	causmkfcxv.exe
4512	CreateProcess.exe
5596	CreateProcess.exe
4140	i_causmkfcxv.exe
4772	urpnhfczxr.sys
5188	CreateProcess.exe
4316	zxrpnkeczx.exe
5820	CreateProcess.exe
5176	CreateProcess.exe
5212	i_zxrpnkeczx.exe
2644	jhfzxrpjhf.sys
3732	CreateProcess.exe
3320	bztrpjhcwu.exe
1892	CreateProcess.exe
1988	CreateProcess.exe
5560	i_bztrpjhcwu.exe
3384	ecwuomhezw.sys
1368	CreateProcess.exe
4160	czurmjgecw.exe
4752	CreateProcess.exe
1524	CreateProcess.exe
1624	i_czurmjgecw.exe
4308	zwromjdbzt.sys
2080	CreateProcess.exe
5240	trljgbztol.exe
2864	CreateProcess.exe
2684	CreateProcess.exe
2204	i_trljgbztol.exe
5184	ljdbytqoig.sys
2776	CreateProcess.exe
4716	ligeyvtnlj.exe
876	CreateProcess.exe
5772	CreateProcess.exe
6044	i_ligeyvtnlj.exe
4272	tqljdbvtql.sys
2228	CreateProcess.exe
5844	idaytnliga.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_1233147094\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_481026797\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_870412877\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_870412877\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_1233147094\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_481026797\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_481026797\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_481026797\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2428_261087966\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbztol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaysqcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxusnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqoigbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmjgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztrmjwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligeyvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpnkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaytnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpnkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhczxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztrmjwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjhcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmjgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaytnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaysqcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxusnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztqligebvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgbztol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhczxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztqligebvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligeyvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjhcwu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3516	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2908	ipconfig.exe
980	ipconfig.exe
3748	ipconfig.exe
4940	ipconfig.exe
1308	ipconfig.exe
5176	ipconfig.exe
4380	ipconfig.exe
2608	ipconfig.exe
4544	ipconfig.exe
5616	ipconfig.exe
5088	ipconfig.exe
4768	ipconfig.exe
5616	ipconfig.exe
3404	ipconfig.exe
2404	ipconfig.exe
5828	ipconfig.exe
4872	ipconfig.exe
4744	ipconfig.exe
3136	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279403788029677"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{2888DDB6-F908-48A4-8B49-937081CD00CC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe
2548	vtolgeywqoigbywq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	i_bywqojgbyt.exe
Token: SeDebugPrivilege	4708	i_oigbytqljd.exe
Token: SeDebugPrivilege	3564	i_xvqnlfdxvq.exe
Token: SeDebugPrivilege	4472	i_qnifdxvpni.exe
Token: SeDebugPrivilege	4140	i_causmkfcxv.exe
Token: SeDebugPrivilege	5212	i_zxrpnkeczx.exe
Token: SeDebugPrivilege	5560	i_bztrpjhcwu.exe
Token: SeDebugPrivilege	1624	i_czurmjgecw.exe
Token: SeDebugPrivilege	2204	i_trljgbztol.exe
Token: SeDebugPrivilege	6044	i_ligeyvtnlj.exe
Token: SeDebugPrivilege	1712	i_idaytnliga.exe
Token: SeDebugPrivilege	1104	i_ligaysqcax.exe
Token: SeDebugPrivilege	4788	i_faxusnkfdx.exe
Token: SeDebugPrivilege	1344	i_spkhczxusm.exe
Token: SeDebugPrivilege	3608	i_mjhbzurpmh.exe
Token: SeDebugPrivilege	2196	i_cztrmjwuom.exe
Token: SeDebugPrivilege	4272	i_trmjebwuom.exe
Token: SeDebugPrivilege	4704	i_ztqligebvt.exe
Token: SeDebugPrivilege	5016	i_dbytqoljdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 2548	5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 5664 wrote to memory of 1340	5664	2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1340 wrote to memory of 2428	1340	iexplore.exe	90
PID 2428 wrote to memory of 2828	2428	msedge.exe	91
PID 2428 wrote to memory of 3516	2428	msedge.exe	92
PID 2428 wrote to memory of 2436	2428	msedge.exe	93
PID 2428 wrote to memory of 1400	2428	msedge.exe	94
PID 2428 wrote to memory of 2436	2428	msedge.exe	93
PID 2428 wrote to memory of 1400	2428	msedge.exe	94
PID 2428 wrote to memory of 1400	2428	msedge.exe	94
PID 2428 wrote to memory of 1812	2428	msedge.exe	96
PID 2428 wrote to memory of 1988	2428	msedge.exe	97
PID 2428 wrote to memory of 1812	2428	msedge.exe	96
PID 2428 wrote to memory of 1812	2428	msedge.exe	96
PID 2428 wrote to memory of 1988	2428	msedge.exe	97
PID 2428 wrote to memory of 1988	2428	msedge.exe	97
PID 2428 wrote to memory of 1056	2428	msedge.exe	98
PID 2428 wrote to memory of 1056	2428	msedge.exe	98
PID 2428 wrote to memory of 1056	2428	msedge.exe	98
PID 2428 wrote to memory of 3088	2428	msedge.exe	99
PID 2428 wrote to memory of 3088	2428	msedge.exe	99
PID 2428 wrote to memory of 3088	2428	msedge.exe	99
PID 2428 wrote to memory of 1016	2428	msedge.exe	100
PID 2428 wrote to memory of 1016	2428	msedge.exe	100
PID 2428 wrote to memory of 1016	2428	msedge.exe	100
PID 2428 wrote to memory of 2196	2428	msedge.exe	102
PID 2428 wrote to memory of 2196	2428	msedge.exe	102
PID 2428 wrote to memory of 1508	2428	msedge.exe	105
PID 2428 wrote to memory of 1508	2428	msedge.exe	105
PID 2428 wrote to memory of 1508	2428	msedge.exe	105
PID 2548 wrote to memory of 5832	2548	vtolgeywqoigbywq.exe	106
PID 2428 wrote to memory of 2516	2428	msedge.exe	108
PID 2428 wrote to memory of 5100	2428	msedge.exe	109
PID 2428 wrote to memory of 2516	2428	msedge.exe	108
PID 2428 wrote to memory of 5100	2428	msedge.exe	109
PID 940 wrote to memory of 5244	940	bywqojgbyt.exe	111
PID 2428 wrote to memory of 2840	2428	msedge.exe	115
PID 2428 wrote to memory of 3412	2428	msedge.exe	116
PID 2428 wrote to memory of 3412	2428	msedge.exe	116
PID 2428 wrote to memory of 1088	2428	msedge.exe	119
PID 2428 wrote to memory of 1088	2428	msedge.exe	119
PID 2548 wrote to memory of 4948	2548	vtolgeywqoigbywq.exe	120
PID 2548 wrote to memory of 5904	2548	vtolgeywqoigbywq.exe	124
PID 2296 wrote to memory of 1860	2296	oigbytqljd.exe	126
PID 2548 wrote to memory of 3352	2548	vtolgeywqoigbywq.exe	129
PID 2428 wrote to memory of 3228	2428	msedge.exe	131
PID 2428 wrote to memory of 3228	2428	msedge.exe	131
PID 2428 wrote to memory of 3228	2428	msedge.exe	131
PID 2548 wrote to memory of 2804	2548	vtolgeywqoigbywq.exe	134
PID 4692 wrote to memory of 4416	4692	xvqnlfdxvq.exe	136
PID 2548 wrote to memory of 5668	2548	vtolgeywqoigbywq.exe	139
PID 2548 wrote to memory of 1536	2548	vtolgeywqoigbywq.exe	144
PID 5096 wrote to memory of 1384	5096	qnifdxvpni.exe	146
PID 2548 wrote to memory of 6096	2548	vtolgeywqoigbywq.exe	149
PID 2428 wrote to memory of 6060	2428	msedge.exe	151
PID 2428 wrote to memory of 1096	2428	msedge.exe	152
PID 2428 wrote to memory of 1676	2428	msedge.exe	153
PID 2548 wrote to memory of 2500	2548	vtolgeywqoigbywq.exe	156
PID 976 wrote to memory of 4512	976	causmkfcxv.exe	158
PID 2548 wrote to memory of 5596	2548	vtolgeywqoigbywq.exe	161
PID 2548 wrote to memory of 5188	2548	vtolgeywqoigbywq.exe	165
PID 4316 wrote to memory of 5820	4316	zxrpnkeczx.exe	167
PID 2548 wrote to memory of 5176	2548	vtolgeywqoigbywq.exe	170
PID 2428 wrote to memory of 6048	2428	msedge.exe	172

C:\Users\Admin\AppData\Local\Temp\2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_39ec3852fe4ea29c0f6ad760b8b6f7aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Temp\vtolgeywqoigbywq.exe
  C:\Temp\vtolgeywqoigbywq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqojgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5832
  - - C:\Temp\bywqojgbyt.exe
      C:\Temp\bywqojgbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqojgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\i_bywqojgbyt.exe
      C:\Temp\i_bywqojgbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5904
  - - C:\Temp\oigbytqljd.exe
      C:\Temp\oigbytqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3352
  - - C:\Temp\i_oigbytqljd.exe
      C:\Temp\i_oigbytqljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2804
  - - C:\Temp\xvqnlfdxvq.exe
      C:\Temp\xvqnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Temp\i_xvqnlfdxvq.exe
      C:\Temp\i_xvqnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1536
  - - C:\Temp\qnifdxvpni.exe
      C:\Temp\qnifdxvpni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6096
  - - C:\Temp\i_qnifdxvpni.exe
      C:\Temp\i_qnifdxvpni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2500
  - - C:\Temp\causmkfcxv.exe
      C:\Temp\causmkfcxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5596
  - - C:\Temp\i_causmkfcxv.exe
      C:\Temp\i_causmkfcxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpnkeczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5188
  - - C:\Temp\zxrpnkeczx.exe
      C:\Temp\zxrpnkeczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpnkeczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5176
  - - C:\Temp\i_zxrpnkeczx.exe
      C:\Temp\i_zxrpnkeczx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrpjhcwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3732
  - - C:\Temp\bztrpjhcwu.exe
      C:\Temp\bztrpjhcwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrpjhcwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1988
  - - C:\Temp\i_bztrpjhcwu.exe
      C:\Temp\i_bztrpjhcwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmjgecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1368
  - - C:\Temp\czurmjgecw.exe
      C:\Temp\czurmjgecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmjgecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1524
  - - C:\Temp\i_czurmjgecw.exe
      C:\Temp\i_czurmjgecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgbztol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2080
  - - C:\Temp\trljgbztol.exe
      C:\Temp\trljgbztol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgbztol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2684
  - - C:\Temp\i_trljgbztol.exe
      C:\Temp\i_trljgbztol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligeyvtnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\ligeyvtnlj.exe
      C:\Temp\ligeyvtnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligeyvtnlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\i_ligeyvtnlj.exe
      C:\Temp\i_ligeyvtnlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idaytnliga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2228
  - - C:\Temp\idaytnliga.exe
      C:\Temp\idaytnliga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idaytnliga.exe ups_ins
    3⤵
    PID:5072
  - - C:\Temp\i_idaytnliga.exe
      C:\Temp\i_idaytnliga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligaysqcax.exe ups_run
    3⤵
    PID:4260
  - - C:\Temp\ligaysqcax.exe
      C:\Temp\ligaysqcax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligaysqcax.exe ups_ins
    3⤵
    PID:4172
  - - C:\Temp\i_ligaysqcax.exe
      C:\Temp\i_ligaysqcax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxusnkfdx.exe ups_run
    3⤵
    PID:2160
  - - C:\Temp\faxusnkfdx.exe
      C:\Temp\faxusnkfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxusnkfdx.exe ups_ins
    3⤵
    PID:4400
  - - C:\Temp\i_faxusnkfdx.exe
      C:\Temp\i_faxusnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhczxusm.exe ups_run
    3⤵
    PID:3444
  - - C:\Temp\spkhczxusm.exe
      C:\Temp\spkhczxusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhczxusm.exe ups_ins
    3⤵
    PID:2144
  - - C:\Temp\i_spkhczxusm.exe
      C:\Temp\i_spkhczxusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhbzurpmh.exe ups_run
    3⤵
    PID:4972
  - - C:\Temp\mjhbzurpmh.exe
      C:\Temp\mjhbzurpmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhbzurpmh.exe ups_ins
    3⤵
    PID:416
  - - C:\Temp\i_mjhbzurpmh.exe
      C:\Temp\i_mjhbzurpmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cztrmjwuom.exe ups_run
    3⤵
    PID:796
  - - C:\Temp\cztrmjwuom.exe
      C:\Temp\cztrmjwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cztrmjwuom.exe ups_ins
    3⤵
    PID:2876
  - - C:\Temp\i_cztrmjwuom.exe
      C:\Temp\i_cztrmjwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjebwuom.exe ups_run
    3⤵
    PID:3392
  - - C:\Temp\trmjebwuom.exe
      C:\Temp\trmjebwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjebwuom.exe ups_ins
    3⤵
    PID:1140
  - - C:\Temp\i_trmjebwuom.exe
      C:\Temp\i_trmjebwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztqligebvt.exe ups_run
    3⤵
    PID:2780
  - - C:\Temp\ztqligebvt.exe
      C:\Temp\ztqligebvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztqligebvt.exe ups_ins
    3⤵
    PID:5336
  - - C:\Temp\i_ztqligebvt.exe
      C:\Temp\i_ztqligebvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqoljdb.exe ups_run
    3⤵
    PID:1888
  - - C:\Temp\dbytqoljdb.exe
      C:\Temp\dbytqoljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqoljdb.exe ups_ins
    3⤵
    PID:5572
  - - C:\Temp\i_dbytqoljdb.exe
      C:\Temp\i_dbytqoljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffca3bbc188,0x7ffca3bbc194,0x7ffca3bbc1a0
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,4353392076231865950,9632397196279742948,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
      4⤵
      System Time Discovery
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,18047775736408143422,5694800882732057188,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,15768469133304459402,1683677851411755329,262144 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:2
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,5080619268991769879,8894860163053254539,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,4697663237600888039,18200038304919438074,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,2654377586128538013,15236540125273326401,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,13410151541151736513,13894622138598773249,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3820,i,5657558837592627568,15750512093957803210,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,5538164167315792428,5827220295990933676,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3680,i,9502997449019616768,5227623256105543249,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2926612432898479045,8356305696495646345,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,15942402533207509515,7466800958800530059,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8780502477410215046,10876148902042338393,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8780502477410215046,10876148902042338393,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,8835016805510836377,2762812205382784132,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,3453700751525214485,14248292925456519508,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6336,i,1007719847031272434,3923020220217410071,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,10218241055741723622,13339597776517896380,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,13460173266363453693,737525514646256866,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,12265152905673265719,13829951798132092324,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3620,i,14112536599062786610,12744963786235772793,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3891754138967880603,1275622947085698436,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,18310471355175125777,10408646196355164906,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,1851907831844297983,9025623986388184813,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6824,i,18291790075490858975,14996346695136373038,2097152 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,8663463210108173903,5887499209150242975,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5700,i,14550157841975710713,17353839439018684217,262144 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:10
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17086670949728905360,8996269322617254809,524288 --field-trial-handle=2704,i,9793968527186615442,835982656713178331,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3596

C:\Temp\vtolgeywqoigbywq.sys
C:\Temp\vtolgeywqoigbywq.sys
1⤵
- Executes dropped EXE
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3452

C:\Temp\ywqoigaywq.sys
C:\Temp\ywqoigaywq.sys
1⤵
- Executes dropped EXE
PID:5116

C:\Temp\fdbvtnljdb.sys
C:\Temp\fdbvtnljdb.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\snkidaysqn.sys
C:\Temp\snkidaysqn.sys
1⤵
- Executes dropped EXE
PID:2644

C:\Temp\ifaxspnhfd.sys
C:\Temp\ifaxspnhfd.sys
1⤵
- Executes dropped EXE
PID:2700

C:\Temp\urpnhfczxr.sys
C:\Temp\urpnhfczxr.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\jhfzxrpjhf.sys
C:\Temp\jhfzxrpjhf.sys
1⤵
- Executes dropped EXE
PID:2644

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\zwromjdbzt.sys
C:\Temp\zwromjdbzt.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\ljdbytqoig.sys
C:\Temp\ljdbytqoig.sys
1⤵
- Executes dropped EXE
PID:5184

C:\Temp\tqljdbvtql.sys
C:\Temp\tqljdbvtql.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\idavsqkigd.sys
C:\Temp\idavsqkigd.sys
1⤵
PID:2372

C:\Temp\nifaxsqkhf.sys
C:\Temp\nifaxsqkhf.sys
1⤵
PID:1068

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:2508

C:\Temp\xrpjhfzxjh.sys
C:\Temp\xrpjhfzxjh.sys
1⤵
PID:5496

C:\Temp\jhezxrpjhb.sys
C:\Temp\jhezxrpjhb.sys
1⤵
PID:5572

C:\Temp\ztromjecwr.sys
C:\Temp\ztromjecwr.sys
1⤵
PID:3104

C:\Temp\qoljdbvtol.sys
C:\Temp\qoljdbvtol.sys
1⤵
PID:3224

C:\Temp\ligbytqljg.sys
C:\Temp\ligbytqljg.sys
1⤵
PID:1740

C:\Temp\nlfdyvqnli.sys
C:\Temp\nlfdyvqnli.sys
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bywqojgbyt.exe

Path C:\Temp\bywqojgbyt.exe
Size 365KB
SHA256 7aa700b513386d3bc16d2eb0695338acace38054f3bbd5646669a3527eea9b78
MD5 47f38ef61e38980a9fd93937f728124f
SHA1 e331eb29a6a218c2d3e397b36d5695fe7cfa1e36
SHA512 797e9aff1f9c268c0dae2898767876600e9db2e018b2ef59723d42b61689e3235f12aa3c2bb2abc5363c8e0888506e5e42eecaa95170f0f0795b478efe91cfba
SSDEEP 3072:XuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcxv.exe

Path C:\Temp\causmkfcxv.exe
Size 365KB
SHA256 5dc2f0295f9e5d899dbefc1ce2f00e04f4fa8408b9d714d6b56520817d16cd69
MD5 dec042970a6ba598697677e8e42773b2
SHA1 ea7814af5aa29e00714a75604f14326755bbbbf7
SHA512 8fdb8449cfb0c1618deb30b32619c78e6b7c90e2beaadf1cf83cab4720c34b02996f669e2fb27a4880fe32899cf9aecf647ecfdb41e03dc6058f7f852648a62d
SSDEEP 6144:lTuxUxtXlIJjiJcbI03GBc3ucY5DCSjXP:lTuxUxiGjSGecvXP
TLSH
T139847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdbvtnljdb.sys

Path C:\Temp\fdbvtnljdb.sys
Size 293KB
SHA256 849b7b59972f08baafe62bd147b4f13e84c98af3883d5cd2e80e8bc112f3dbd0
MD5 4320ffbdeee2eb43d70e8b74a01ae1cf
SHA1 489863a318650a08c70e97e3d50b480df33647f0
SHA512 c333b686643202fab0678d20075b241df84ac3768c76bd3fa6cf2e5620c6b9dbabed65cdc52825c1cfd8048d25a5091d0a07ec0d2247c510d431aa267a7dabd3
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqojgbyt.exe

Path C:\Temp\i_bywqojgbyt.exe
Size 365KB
SHA256 00aadc829b8094eae220eadef32ac53b2a76ead93f0362938027ef3f1bf300f2
MD5 3b2665b12a3ff5c16270d5af2e21c7e1
SHA1 930d00816d6c117dfc10e62ac7caf4c44bd135bf
SHA512 9b36a433b350161587d34f53b8ec087ef0042b8a10c2e0d6ad818ee63c6e076f042703c38b306fe4b4f475699d244d0293dbdb58ba5a0c99e2f8154776b35d15
SSDEEP 3072:AuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkfcxv.exe

Path C:\Temp\i_causmkfcxv.exe
Size 365KB
SHA256 c302fc6bb51077750fde4cfc8fe88de46910c0a4504a7c527336faf34ff1a797
MD5 beb10535f71b79f2247c093f13596cc3
SHA1 584d424e35e733e98666ae3e07513897d6ad6361
SHA512 f661a353903b280e4e9366f46eb92449bb3562666b9c5618695a9baea4fa54ce7ac3b6b56182b77febb5d3ef4b0d8fbbee482e860fff6b67531ef66d153af047
SSDEEP 3072:XuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytqljd.exe

Path C:\Temp\i_oigbytqljd.exe
Size 365KB
SHA256 41ff9ec99509f5eb23fc6e79730430ee6a140a95bd853b44b77294b9b1aa6eac
MD5 89c19b3a13adad80fe361f0eebaddfad
SHA1 7d278c4a3d0e5a03a72e766c417381d709feec12
SHA512 8d55d05f70a5af5c8080371ed184a3bc65e31fa50762ff8bf0a3013d547b88acce4c71d4bdbd3d843c998c217fd22b2d53496914a7a04b64c11a48b153c81230
SSDEEP 3072:5uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifdxvpni.exe

Path C:\Temp\i_qnifdxvpni.exe
Size 365KB
SHA256 5953a3d607516f2040d4ed18ac8d93d26d64114fcac31ca18247468baa75ce3e
MD5 e6ba5dd492a14b0501e2dfe17041483e
SHA1 8e6c320cf729406fdb71c8fb0850f4efc9e2c7bc
SHA512 1ad923128ff7f280dd3a1af6c09b48a51cf26dfdc64a1075d8414d092e208cecd546718ca3115e5a861ca09e4534de9536000c59299b71db15a310de09ab6dcf
SSDEEP 3072:5uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnlfdxvq.exe

Path C:\Temp\i_xvqnlfdxvq.exe
Size 365KB
SHA256 487326b5a5d6423731c7085cf5250f750ec17740b83c1813162f1119a45c8965
MD5 78e7719874b5b6c4cbb715769e6822e4
SHA1 a5d27909fee01246399f9bfbe4ce61cb6e9288f5
SHA512 1ba7816fa7bd5d3ce110282d76dfb798d070bdfa937fccc76f453123f1633727506b9c3dfdd64374d25db1afd26c268c0d5c2344d10827ab7a00d46dbb0c688a
SSDEEP 3072:fuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxspnhfd.sys

Path C:\Temp\ifaxspnhfd.sys
Size 293KB
SHA256 a18e67e7a1c63ebf8e81d498deeecbee1e52a3aad1c64b4ac490e69764efa0dd
MD5 07eb42327f3d81ca4140551fff7b0e53
SHA1 d48352ed24d4a645230e8bec03dede5ebddacc53
SHA512 e62d5c6e0c7c9ac69a12986e47a97185a14456a4065fcdd04484833d237cfda8357db7f963f23da5bfa3ef3ac997e7595ebb3a999d2f786ff007ada069c77817
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytqljd.exe

Path C:\Temp\oigbytqljd.exe
Size 365KB
SHA256 68e9c601a4b5b8022f0c5d456d3c4abe884f41b912f943a3396dcb4b84828ab3
MD5 91c358c8399195be2cf7f5dccf6432f1
SHA1 ee7813aa7351407e931061b6075b3982667e8d9a
SHA512 9360a5e49f6c014c1cf3bb1e5ec60bc0373241c3cf3f3a758c038de33e472609c65ed546b32f062b1b2365a5e0a406ad8e8bd0cb958e5dc8330dda0ea3478325
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T119847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifdxvpni.exe

Path C:\Temp\qnifdxvpni.exe
Size 365KB
SHA256 6e3c408a07a01344ab10c75b034aec68102c82b8cbbac5f736eafed0a26a6de2
MD5 5c972747a84ed508ecf87e7df0d67cb0
SHA1 cd740ee23c62ef053024cb6c3924465080dc1b0a
SHA512 a6130d009cc177b46e39121aa5ce8580baa70a3e4e634d5883359f011981dadf061ed3afd14fe0b3184f1d64dcc42015650221fe87e16323c9957cb943c96744
SSDEEP 3072:VuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkidaysqn.sys

Path C:\Temp\snkidaysqn.sys
Size 293KB
SHA256 cd635f2ee501ffe8bba0046113f5479c347aaf25d656ca16ec96529fca2abebe
MD5 416dc5fbfca733ce7ec2ccef625ba4f9
SHA1 90b121b4f4a92c00133601f58c3f97caa439ecd5
SHA512 c4d161dc0fa32e6daa30267cff0163092ab21fb379841c8cf10dd0342d00d3c2ab1d76098d64197394284fd1d72caace8d2bec54893e5a845b2b938202d36711
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpnhfczxr.sys

Path C:\Temp\urpnhfczxr.sys
Size 293KB
SHA256 c63df3a5b62f523b9b3f95016ed0ddbeaeb1ed5c4a1461b7496572013eec6a62
MD5 c385ec688a8bef045c73035f06801e82
SHA1 d9fe12c72dd2cc0ac7d5ed7948f1dfd3815423bd
SHA512 6ab9dbe5c1458b17446fb0f9613947864e863fd06ac10c3ce829bf6d46d95f6ff3acb8ca0d0777884fad654bd01c90aa4d18317e7ce3ce3cd4c09d2b13896870
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqoigbywq.exe

Path C:\Temp\vtolgeywqoigbywq.exe
Size 365KB
SHA256 e661f6338086f6901818fab21e0f917709ca40600be5af129fa751c1b02a4602
MD5 18acd178298acd24130b4b7641230c1f
SHA1 a6a1ac4ad21391eeab0123185c0e3fd1a5035402
SHA512 0d62f8eaf7da2da5f5323e95e3959aa75019f0987fac243695c48878556fdb28281defbaff3cefdcc668af495232b2c81dd14ef369a2ad8c2a3e9e4d474a3215
SSDEEP 3072:fuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeywqoigbywq.sys

Path C:\Temp\vtolgeywqoigbywq.sys
Size 293KB
SHA256 0f1466545cfdb61de6d246868a36520b412559ea0d54d3913067abf3e9799d1f
MD5 dd488301d13f08b3260c489308cdb923
SHA1 f921af5c471315bd1c6dbab86fcaaef12dbf016f
SHA512 39fdac9b254d3327819ecb1f3fd78f53f2d8104731cadbcbaa49f54a936160c7fee8516a9241b50126bbca4064e70ba617b35daf788cb813eded6d32ae091db6
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnlfdxvq.exe

Path C:\Temp\xvqnlfdxvq.exe
Size 365KB
SHA256 ee34ed57496c9b19ab9cb63c85bef01972d7f5dc0dd975ff6622ac7f4ccd46dc
MD5 614c9d5c0fff16b2e0f6994f89d84d4a
SHA1 11f7acba9e357c0bbc90e2409a667da3afbb42a6
SHA512 211c1e3e8a64d3fbb8c81718debddd78e1151d74a9fd764afb7bb4a6fa5a98705e730b36335ce2e136a68663e88c7d413249a7b94cd04150edffde6fdc61ac8f
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaywq.sys

Path C:\Temp\ywqoigaywq.sys
Size 293KB
SHA256 82b389d5acd828180151d2d9fd691606db758140c32426f96ec0295ad140bbd9
MD5 a1028f601a79fbb8a070b2df5b601841
SHA1 0383fb1444cf0bf8e5eab63ae9dc927f5a460d75
SHA512 346e98a0033a55ad03e58f2420c65ad38ff347c2a5f5b864121746537868d317d0ae6cf5325af402a9f5fc561791676babe6687e5ab8b198ef1609a1de0e74d8
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpnkeczx.exe

Path C:\Temp\zxrpnkeczx.exe
Size 365KB
SHA256 afa08115ebcd4f774049f09b5b122c4257bd2d5a191e6d2f429b8b66b9faecf3
MD5 2f78460eab01020736dc4cac47e575c5
SHA1 a5029c1c4ef9854ab7039f4f00f410a5f47a6295
SHA512 420ab1864a21647b5c9a3d54055ee85eab8e88255f825a46b9a759fd7977f973ed2b29ecaab894d176ee656dec45a8f2fd1b8449d836213ef31c17c74e3c4f25
SSDEEP 3072:OuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

61861ff8-1f50-4b9d-8260-aca9d7f26525.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61861ff8-1f50-4b9d-8260-aca9d7f26525.tmp
Size 14KB
SHA256 7e446fafa85ed1a472dc4a4a15aa5ab51347847a3ca04468a5846684882470de
MD5 1c870e8508969aea4b2b0f2229c4550e
SHA1 9598f59df39233adcd4c10a95eed359bb25d4b84
SHA512 ebfe7252ffe5c0dcd4c3bd8ae2ab559e7c0bca3872dfb232ef008959da39c002182716aed683775a0c7e741f4dccf603ae9e7506b8d93a6eaf55072f3cd57ec0
SSDEEP 192:sxR6REyM/jK1Ml8wCb/fas749oHJJZIkQA8x0zoA8p9//g6+WNIYDQbGxIgDUJ:sxR6u8b/fas74mHJHvd8xVJ/5ISU
TLSH
T18952C916AA249977CCDBD20DFA557F53D6F81572A2901E44AAFCCA0C01E76DD1213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5ca8e46b196002c3dcecf498e3612b4b117e1dfe680cbf2cd70ccc95823eeb4c
MD5 c478acf34ab7780499582babec600618
SHA1 22b06ce623b59f81eea2f3b40387dbb86294b856
SHA512 6291ff29a0745e95b5a0ef0c8b5ecc193c55dda06a64087dd35fce89c53b2763a95152f8791ff3517ccecbbfc7c2267bbfe8a6a6e5bc13175704d8ae450fe823
TLSH
T14E510B75B392099BCB1675F2E2D316EDB67C445672C3AE200690AD3CCD7AF04BD01532
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b7fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7fc.TMP
Size 2KB
SHA256 0338fecc9068abdf9ab52ffc6045f6e396dee006b1e48b829a68b858900e8404
MD5 cd9586f3118daad65487452d9565164e
SHA1 a5dfb0aa5a5e86a15525b27076a0ff2254f3d166
SHA512 1943171e1b9127dd6360479e54cd8e72c1bf235800324ba2ff182d7b39d7984f79e2c49121fa633320c743ee685c0ffb2ff7b903cd67b46497cebbedaff5255c
TLSH
T199510975B392099BCB2675F2E2D316EDB67C445672C3AE214690AD3C8D7AF04BD01532
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 aab4002273cec0d2878272998254f562258a3fbc992731501396c04e87960c59
MD5 6657daf45220492c561d8463b898e1c5
SHA1 6e518af74006182e23795cc19f78d0e2f9f2d9f8
SHA512 96cc5cd99f365ad3f8736cd46c01d7c32fa0ac754a5049403572bcd3ec1a5f8f0809cd447b45e45235d0cd683a04328884571ad68672b64f6fed034af5c402c2
TLSH
T14F41BDF3C3E8856DC90156F4AB146E1FCE1D0914432C3D5A89E4EE1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 073ae57824b208c3b0e8976ab0d67d4334ae40dcaadfd7a133f23acec341ea5c
MD5 6cfdf5bf10bd303c78a50bb33768c755
SHA1 2055bd704202873655bf1139f232ceed0d70dfa8
SHA512 03347cd3efb9a4f6d9f92bb0a56303325fc0bd9948c7b60dc6620a0ee87df208c89b10f1683bb1300a74ff0c9acc91d0ab84179545ec52da97f7b5d3d6f3db17
SSDEEP 192:sxR9REyM/jK1Ml8wCb/fasn49oHJJZIkQA8x0zoA8p9//g6+WNIYDQbGxIgtJ:sxR9u8b/fasn4mHJHvd8xVJ/5IS3
TLSH
T10B52B8166A24997BCCDBD20DFA557F53D6F81572A2901E44AAFCCA0C01E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a0def6fddee110a07d7a705f348fc0059fffa39447c608f43b3e6546aa66514a
MD5 50c9aaf51de34aa139a2e653ff3fefad
SHA1 13fb2b59aef2d8e9ea0ed5e199ab6f237d823aa8
SHA512 75fc3e7b4f3981905beb120600d99cf4189e958208f34dc99745f41a120018a926462f225de364c02b05b8ac615f07af04819353dc9838ec34d3f8dfe5e535e8
SSDEEP 192:sxR6REyM/jK1Ml8UQxCb/fas749wHJJZIkQA8x0zoA8pr//g6+WNIYDz6bGxIgD2:sxR6uqob/fas74+HJHvd8xVT/5I0ny
TLSH
T12F62B816AA249977DCDBD20DFA517F53D6F81572A2901E48AAFCCA0C01E76DD1213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 dea7be71b9d9a0627889aa275181377fd44b78b7ba574275394eb58e1183473d
MD5 9977342811c944f89712f55610e06a4f
SHA1 d2987e8a097472a4b7442a0d21038ca5d80796ab
SHA512 7235a466bbfab710b78ab2dfe4050e48cb9d7f2c2e0544d629cb347a0aee4eceab87cb36c44f75831450452952b3494f1f37e793aed7f019482fa5c8de692a6b
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWSkIn2Dro7IIU:f+4+zBE7eDWgb/fPIu1jalSkw2w7IIU
TLSH
T1F4E2EB7B680CCB7E4F404A9DEC29BD9AADE801CB9698C95447FA880C03C76EB55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5296.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5296.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9a13a79cec71cacc2db2e84bacbb8ebf34d0f2f69f8b18889b9c72944b961125
MD5 a1ff3f4712f02f87626057ce1ed13594
SHA1 6a0c4ecf3521dc54d85439ad8bc5ce39bf30fb20
SHA512 17cd70ec9bab4fae9e1fd475b75960cae6f1aeb13d5aade7318b456091276f60a68aecbbd9530926e37cafd1222805b2febb6efbcbf0ddacedac7615986fc072
SSDEEP 768:Arv+4UNbdL34n+SzQwifyoC7aHuVboPzkZLNx9OFlLMjE:Absb134n+S6HOawZLNq3Ln
TLSH
T17D13BF31B8659C37DDBB928DB2477693BFB4206388800F88D9D86B4D459B4AE170BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1cc099e2c74074fb9be14acf6b7cf36747d144239136c430dc69d395ebdec15b
MD5 811a8782a62e1e9d55891d65e176fdfb
SHA1 c3b92687c78387faa857a42f4f6bf46f9e6a9fcf
SHA512 b24e65a6af2f82bff6aa5b06b8399a296190225d7abc3b9880ec4c60dd73b1cacf231b721b40cdb0f82aa74ccd4fb93873d7c737d54727367115c2537d9eb718
SSDEEP 768:Zj+9534nrWzQwifyoCQaHuVboPzkZLNx9OFlLMjH:E9534nrm1HOawZLNq3LU
TLSH
T14EF2AF31A8629C279DAB828DB3073797EFF0116388800E88DDE86B0D05D75AD1B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a2a0cac0419fcdc6e6752ffedf92b078cfe3f0e271bd1d777cc785a9a44b6bd8
MD5 f8488995f0eb3763b83538fd1844e449
SHA1 8be0668807400ca15883c317dad013f46500430a
SHA512 7f97d62ecd2dbe0235aa421a6d73141347be79423a803c3c49f415d7f324d65edf727bc498d36b4c4c08c797f3040d5aab82821d7473ab0ccc422eb532e526db
SSDEEP 768:0rv+4UNbdC3iyI+wifyoraHuVboPzkZLNx9OZxUik4K:0bsbs3iRlHOawZLNqTUVr
TLSH
T1BB03BF35A8749D37DDF79289B28B7A477FF4101385840B88C9EC2B4D46AB46D170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1318c5a18a0d0127687e0f5e774849b2b7e1f96873a5cc8753f0300e97df53c9
MD5 b6e7ffb26ba68246016518e90aba64f2
SHA1 79957723950258b388f461eea797ac41d98bfd00
SHA512 bc2e126852808394bb948234ebf840b448df67d877a0caa273b0a1c1bd6bb0d565ffd41f37a3f2bffadf6c92209ca4d70ca33fde99cde6e880b95ab4a5b66523
SSDEEP 768:0F1j+943NwgznrWzV9oC+aHuVboPzkZLNx9OFlLMjH:Z943fnrmHOawZLNq3LU
TLSH
T121037D76E861CD2BADE787CAB3067686EEF0116389C81DC8D9D86E4D00D75ED070BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

339353ad-1804-47b9-8ece-f3501b55b312.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\339353ad-1804-47b9-8ece-f3501b55b312.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2428_475811672\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 19d4ae581b8baf15563a6350c302426fdf00b3435c9a941056398def9eab7732
MD5 6649fb6addd56e6f6bbcee558c593aba
SHA1 a7d9b86069bbc382cb36825ab7e2a47f244b1e1a
SHA512 036a6967d50e221e8933d3c1f5d1f007341eeda9d941971086d52d5e232b363bad98305f2c517e6ca3b8396912c3f86e623504ba70173370d37b67be2fb1a5b5
TLSH
T13471238357A8D5B3C1DE5BF002835244F6FF227C072370240B92598AAB30A7A64B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1740-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2372-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2508-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2644-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2644-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2700-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2860-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3104-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3224-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3384-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5116-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5184-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5496-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5572-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download