systex | db95e3aec90ea8b0def1547174fd4b2589b860b9fa6d28c57de0fb93aead8409

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260709-j76t7afy21
SHA256 db95e3aec90ea8b0def1547174fd4b2589b860b9fa6d28c57de0fb93aead8409
MD5 87c392dbd77092ececa5980de84b02a8
SHA1 9171ce489b329e15a8d096c55cd53a50be1771b6
SHA512 139d384403050763b201bacb0a03b4522d4ec54e63dc0cd6303087805c617a3b8400a406f8713eac537f2b1a2930e33485dbcee842024ad31e85bd2bfadaa2fe
SSDEEP 3072:Nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5968	czurmkecxrpjhbzu.exe
6088	czurmkecxrpjhbzu.sys
1816	CreateProcess.exe
1964	fcxupmhfzu.exe
4452	CreateProcess.exe
4884	CreateProcess.exe
5160	i_fcxupmhfzu.exe
1868	hezwrojgez.sys
4192	CreateProcess.exe
6088	eywrojhbzt.exe
5844	CreateProcess.exe
2992	CreateProcess.exe
4116	i_eywrojhbzt.exe
4224	urmjebwurm.sys
4268	CreateProcess.exe
5148	gbytrljdbz.exe
5784	CreateProcess.exe
5612	CreateProcess.exe
1776	i_gbytrljdbz.exe
3236	ywqomgdbwt.sys
3216	CreateProcess.exe
4500	trljdbwlgd.exe
5092	CreateProcess.exe
1596	CreateProcess.exe
1168	i_trljdbwlgd.exe
4560	ljdbvtnlfd.sys
5684	CreateProcess.exe
4852	idbvtnlgdy.exe
3476	CreateProcess.exe
120	CreateProcess.exe
5412	i_idbvtnlgdy.exe
6040	nifdxvtnlf.sys
816	CreateProcess.exe
4536	lfdxvtqkic.exe
2460	CreateProcess.exe
3336	CreateProcess.exe
3456	i_lfdxvtqkic.exe
4792	nifaxspnhf.sys
5472	CreateProcess.exe
2020	icaxspkifa.exe
1132	CreateProcess.exe
3080	CreateProcess.exe
1476	i_icaxspkifa.exe
4180	spkhfaxvpn.sys
5160	CreateProcess.exe
3596	smcxupnhfz.exe
1048	CreateProcess.exe
2412	CreateProcess.exe
2996	i_smcxupnhfz.exe
2616	pkhfzwupmh.sys
4752	CreateProcess.exe
4808	ezwusmkhca.exe
2680	CreateProcess.exe
1272	CreateProcess.exe
4856	i_ezwusmkhca.exe
2388	gecwuomhez.sys
3732	CreateProcess.exe
1800	mgebzxrojg.exe
2736	CreateProcess.exe
1984	CreateProcess.exe
4356	i_mgebzxrojg.exe
1820	ebwtrpmgec.sys
5416	CreateProcess.exe
4248	ebwtromgez.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1595225609\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1928644992\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1928644992\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_182699955\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_182699955\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1595225609\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1928644992\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1928644992\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1154286842\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupmhfzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtromgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwusmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupmhfzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvtqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxspkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxspkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebzxrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvtqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebzxrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dayvqnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwusmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtromgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dayvqnlfdx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3184	ipconfig.exe
5132	ipconfig.exe
5916	ipconfig.exe
372	ipconfig.exe
4696	ipconfig.exe
3060	ipconfig.exe
1316	ipconfig.exe
5136	ipconfig.exe
1208	ipconfig.exe
2336	ipconfig.exe
2380	ipconfig.exe
236	ipconfig.exe
3120	ipconfig.exe
1232	ipconfig.exe
4308	ipconfig.exe
2484	ipconfig.exe
6064	ipconfig.exe
6072	ipconfig.exe
1876	ipconfig.exe
2136	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280587931244373"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{E43F6318-6FEB-4C45-953A-BA96E31F6989}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5968	czurmkecxrpjhbzu.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5968	czurmkecxrpjhbzu.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5968	czurmkecxrpjhbzu.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5968	czurmkecxrpjhbzu.exe
5968	czurmkecxrpjhbzu.exe
5968	czurmkecxrpjhbzu.exe
5968	czurmkecxrpjhbzu.exe
5968	czurmkecxrpjhbzu.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5160	i_fcxupmhfzu.exe
Token: SeDebugPrivilege	4116	i_eywrojhbzt.exe
Token: SeDebugPrivilege	1776	i_gbytrljdbz.exe
Token: SeDebugPrivilege	1168	i_trljdbwlgd.exe
Token: SeDebugPrivilege	5412	i_idbvtnlgdy.exe
Token: SeDebugPrivilege	3456	i_lfdxvtqkic.exe
Token: SeDebugPrivilege	1476	i_icaxspkifa.exe
Token: SeDebugPrivilege	2996	i_smcxupnhfz.exe
Token: SeDebugPrivilege	4856	i_ezwusmkhca.exe
Token: SeDebugPrivilege	4356	i_mgebzxrojg.exe
Token: SeDebugPrivilege	4968	i_ebwtromgez.exe
Token: SeDebugPrivilege	4812	i_jgebwtrljd.exe
Token: SeDebugPrivilege	5900	i_dbvtqljdbv.exe
Token: SeDebugPrivilege	1788	i_dayvqnlfdx.exe
Token: SeDebugPrivilege	5332	i_daysqcausn.exe
Token: SeDebugPrivilege	5520	i_dxvpnhfaxs.exe
Token: SeDebugPrivilege	4352	i_upmkhcausm.exe
Token: SeDebugPrivilege	204	i_xrpmkhbzur.exe
Token: SeDebugPrivilege	4540	i_pjhezwurmj.exe
Token: SeDebugPrivilege	2136	i_mgebztromg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 5968	476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 476 wrote to memory of 5020	476	2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5020 wrote to memory of 4656	5020	iexplore.exe	91
PID 4656 wrote to memory of 3152	4656	msedge.exe	92
PID 4656 wrote to memory of 5256	4656	msedge.exe	94
PID 4656 wrote to memory of 4544	4656	msedge.exe	95
PID 4656 wrote to memory of 5256	4656	msedge.exe	94
PID 4656 wrote to memory of 5256	4656	msedge.exe	94
PID 4656 wrote to memory of 4760	4656	msedge.exe	96
PID 4656 wrote to memory of 4760	4656	msedge.exe	96
PID 4656 wrote to memory of 4856	4656	msedge.exe	97
PID 4656 wrote to memory of 4856	4656	msedge.exe	97
PID 4656 wrote to memory of 4856	4656	msedge.exe	97
PID 4656 wrote to memory of 4968	4656	msedge.exe	98
PID 4656 wrote to memory of 4968	4656	msedge.exe	98
PID 4656 wrote to memory of 4968	4656	msedge.exe	98
PID 4656 wrote to memory of 3872	4656	msedge.exe	99
PID 4656 wrote to memory of 3872	4656	msedge.exe	99
PID 4656 wrote to memory of 5820	4656	msedge.exe	100
PID 4656 wrote to memory of 3872	4656	msedge.exe	99
PID 4656 wrote to memory of 5820	4656	msedge.exe	100
PID 4656 wrote to memory of 5820	4656	msedge.exe	100
PID 4656 wrote to memory of 3968	4656	msedge.exe	101
PID 4656 wrote to memory of 3968	4656	msedge.exe	101
PID 5968 wrote to memory of 1816	5968	czurmkecxrpjhbzu.exe	105
PID 1964 wrote to memory of 4452	1964	fcxupmhfzu.exe	108
PID 4656 wrote to memory of 704	4656	msedge.exe	112
PID 4656 wrote to memory of 6020	4656	msedge.exe	111
PID 4656 wrote to memory of 704	4656	msedge.exe	112
PID 4656 wrote to memory of 6020	4656	msedge.exe	111
PID 4656 wrote to memory of 2072	4656	msedge.exe	114
PID 4656 wrote to memory of 1516	4656	msedge.exe	117
PID 4656 wrote to memory of 1516	4656	msedge.exe	117
PID 5968 wrote to memory of 4884	5968	czurmkecxrpjhbzu.exe	118
PID 4656 wrote to memory of 1464	4656	msedge.exe	120
PID 4656 wrote to memory of 1464	4656	msedge.exe	120
PID 5968 wrote to memory of 4192	5968	czurmkecxrpjhbzu.exe	123
PID 6088 wrote to memory of 5844	6088	eywrojhbzt.exe	125
PID 5968 wrote to memory of 2992	5968	czurmkecxrpjhbzu.exe	128
PID 5968 wrote to memory of 4268	5968	czurmkecxrpjhbzu.exe	132
PID 5148 wrote to memory of 5784	5148	gbytrljdbz.exe	134
PID 5968 wrote to memory of 5612	5968	czurmkecxrpjhbzu.exe	137
PID 4656 wrote to memory of 4788	4656	msedge.exe	139
PID 4656 wrote to memory of 4788	4656	msedge.exe	139
PID 4656 wrote to memory of 4788	4656	msedge.exe	139
PID 4656 wrote to memory of 5716	4656	msedge.exe	140
PID 4656 wrote to memory of 5716	4656	msedge.exe	140
PID 4656 wrote to memory of 5716	4656	msedge.exe	140
PID 5968 wrote to memory of 3216	5968	czurmkecxrpjhbzu.exe	144
PID 4500 wrote to memory of 5092	4500	trljdbwlgd.exe	146
PID 5968 wrote to memory of 1596	5968	czurmkecxrpjhbzu.exe	149
PID 4656 wrote to memory of 5508	4656	msedge.exe	151
PID 4656 wrote to memory of 4464	4656	msedge.exe	190
PID 4656 wrote to memory of 1600	4656	msedge.exe	153
PID 5968 wrote to memory of 5684	5968	czurmkecxrpjhbzu.exe	156
PID 4852 wrote to memory of 3476	4852	idbvtnlgdy.exe	158
PID 5968 wrote to memory of 120	5968	czurmkecxrpjhbzu.exe	161
PID 5968 wrote to memory of 816	5968	czurmkecxrpjhbzu.exe	165
PID 4536 wrote to memory of 2460	4536	lfdxvtqkic.exe	167
PID 5968 wrote to memory of 3336	5968	czurmkecxrpjhbzu.exe	170
PID 5968 wrote to memory of 5472	5968	czurmkecxrpjhbzu.exe	174
PID 2020 wrote to memory of 1132	2020	icaxspkifa.exe	176
PID 5968 wrote to memory of 3080	5968	czurmkecxrpjhbzu.exe	179
PID 5968 wrote to memory of 5160	5968	czurmkecxrpjhbzu.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_87c392dbd77092ececa5980de84b02a8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:476
- C:\Temp\czurmkecxrpjhbzu.exe
  C:\Temp\czurmkecxrpjhbzu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxupmhfzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1816
  - - C:\Temp\fcxupmhfzu.exe
      C:\Temp\fcxupmhfzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxupmhfzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\i_fcxupmhfzu.exe
      C:\Temp\i_fcxupmhfzu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\eywrojhbzt.exe
      C:\Temp\eywrojhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2992
  - - C:\Temp\i_eywrojhbzt.exe
      C:\Temp\i_eywrojhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4268
  - - C:\Temp\gbytrljdbz.exe
      C:\Temp\gbytrljdbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\i_gbytrljdbz.exe
      C:\Temp\i_gbytrljdbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3216
  - - C:\Temp\trljdbwlgd.exe
      C:\Temp\trljdbwlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1596
  - - C:\Temp\i_trljdbwlgd.exe
      C:\Temp\i_trljdbwlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5684
  - - C:\Temp\idbvtnlgdy.exe
      C:\Temp\idbvtnlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:120
  - - C:\Temp\i_idbvtnlgdy.exe
      C:\Temp\i_idbvtnlgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvtqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:816
  - - C:\Temp\lfdxvtqkic.exe
      C:\Temp\lfdxvtqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvtqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\i_lfdxvtqkic.exe
      C:\Temp\i_lfdxvtqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxspkifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\icaxspkifa.exe
      C:\Temp\icaxspkifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxspkifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3080
  - - C:\Temp\i_icaxspkifa.exe
      C:\Temp\i_icaxspkifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smcxupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5160
  - - C:\Temp\smcxupnhfz.exe
      C:\Temp\smcxupnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smcxupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2412
  - - C:\Temp\i_smcxupnhfz.exe
      C:\Temp\i_smcxupnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwusmkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4752
  - - C:\Temp\ezwusmkhca.exe
      C:\Temp\ezwusmkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwusmkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1272
  - - C:\Temp\i_ezwusmkhca.exe
      C:\Temp\i_ezwusmkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebzxrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3732
  - - C:\Temp\mgebzxrojg.exe
      C:\Temp\mgebzxrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebzxrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1984
  - - C:\Temp\i_mgebzxrojg.exe
      C:\Temp\i_mgebzxrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtromgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5416
  - - C:\Temp\ebwtromgez.exe
      C:\Temp\ebwtromgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtromgez.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_ebwtromgez.exe
      C:\Temp\i_ebwtromgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebwtrljd.exe ups_run
    3⤵
    PID:5532
  - - C:\Temp\jgebwtrljd.exe
      C:\Temp\jgebwtrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebwtrljd.exe ups_ins
    3⤵
    PID:3644
  - - C:\Temp\i_jgebwtrljd.exe
      C:\Temp\i_jgebwtrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqljdbv.exe ups_run
    3⤵
    PID:5572
  - - C:\Temp\dbvtqljdbv.exe
      C:\Temp\dbvtqljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqljdbv.exe ups_ins
    3⤵
    PID:1684
  - - C:\Temp\i_dbvtqljdbv.exe
      C:\Temp\i_dbvtqljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dayvqnlfdx.exe ups_run
    3⤵
    PID:1820
  - - C:\Temp\dayvqnlfdx.exe
      C:\Temp\dayvqnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dayvqnlfdx.exe ups_ins
    3⤵
    PID:5132
  - - C:\Temp\i_dayvqnlfdx.exe
      C:\Temp\i_dayvqnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysqcausn.exe ups_run
    3⤵
    PID:4408
  - - C:\Temp\daysqcausn.exe
      C:\Temp\daysqcausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysqcausn.exe ups_ins
    3⤵
    PID:3360
  - - C:\Temp\i_daysqcausn.exe
      C:\Temp\i_daysqcausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnhfaxs.exe ups_run
    3⤵
    PID:1316
  - - C:\Temp\dxvpnhfaxs.exe
      C:\Temp\dxvpnhfaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins
    3⤵
    PID:2640
  - - C:\Temp\i_dxvpnhfaxs.exe
      C:\Temp\i_dxvpnhfaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkhcausm.exe ups_run
    3⤵
    PID:4472
  - - C:\Temp\upmkhcausm.exe
      C:\Temp\upmkhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkhcausm.exe ups_ins
    3⤵
    PID:4720
  - - C:\Temp\i_upmkhcausm.exe
      C:\Temp\i_upmkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmkhbzur.exe ups_run
    3⤵
    PID:5852
  - - C:\Temp\xrpmkhbzur.exe
      C:\Temp\xrpmkhbzur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmkhbzur.exe ups_ins
    3⤵
    PID:4816
  - - C:\Temp\i_xrpmkhbzur.exe
      C:\Temp\i_xrpmkhbzur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwurmj.exe ups_run
    3⤵
    PID:2576
  - - C:\Temp\pjhezwurmj.exe
      C:\Temp\pjhezwurmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwurmj.exe ups_ins
    3⤵
    PID:5952
  - - C:\Temp\i_pjhezwurmj.exe
      C:\Temp\i_pjhezwurmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebztromg.exe ups_run
    3⤵
    PID:5576
  - - C:\Temp\mgebztromg.exe
      C:\Temp\mgebztromg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebztromg.exe ups_ins
    3⤵
    PID:688
  - - C:\Temp\i_mgebztromg.exe
      C:\Temp\i_mgebztromg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc1467c188,0x7ffc1467c194,0x7ffc1467c1a0
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,10249900138587258005,8620164013961155423,262144 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,15152045852626630518,1111268324105790078,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
      4⤵
      System Time Discovery
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,10372465265056514871,2028306837810075281,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,16346392843388582219,2529542699717192010,2097152 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,7519098640649652909,4999228518399018760,2097152 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5960432221584108995,18290258300992201087,2097152 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,17482717970183362965,17310340960056604206,2097152 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,8014962962497255207,11513425892777643438,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,11742775047209307089,2920730286871099648,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,13723467042427525493,17405143632290658580,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6645092594357803680,1797257043367212498,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6645092594357803680,1797257043367212498,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17054801896185424855,12699783966274005544,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,2367629154619828917,13309730714944856856,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4832,i,6401080908158438935,17919077197332073957,2097152 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3580,i,6738269704151647036,6213260566476524491,2097152 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,18351805390699373627,8456073077445186317,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,4869410607596791851,251248409660184381,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,347910157111963748,134483860279522213,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,12003221721200128697,9152402422762005096,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9811937493328416007,12880145126293901801,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7203868541820271924,5872687361574525822,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2948,i,17985821754877490893,4268468702149425541,262144 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:10
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7115251108570941965,10409261832172673849,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,11834502094132849634,8896291398137426440,524288 --field-trial-handle=2528,i,12554124019189482976,14473801577287294039,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4180

C:\Temp\czurmkecxrpjhbzu.sys
C:\Temp\czurmkecxrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5100

C:\Temp\hezwrojgez.sys
C:\Temp\hezwrojgez.sys
1⤵
- Executes dropped EXE
PID:1868

C:\Temp\urmjebwurm.sys
C:\Temp\urmjebwurm.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\ywqomgdbwt.sys
C:\Temp\ywqomgdbwt.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Temp\ljdbvtnlfd.sys
C:\Temp\ljdbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:4560

C:\Temp\nifdxvtnlf.sys
C:\Temp\nifdxvtnlf.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\nifaxspnhf.sys
C:\Temp\nifaxspnhf.sys
1⤵
- Executes dropped EXE
PID:4792

C:\Temp\spkhfaxvpn.sys
C:\Temp\spkhfaxvpn.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\pkhfzwupmh.sys
C:\Temp\pkhfzwupmh.sys
1⤵
- Executes dropped EXE
PID:2616

C:\Temp\gecwuomhez.sys
C:\Temp\gecwuomhez.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\ebwtrpmgec.sys
C:\Temp\ebwtrpmgec.sys
1⤵
- Executes dropped EXE
PID:1820

C:\Temp\hbzwtoljeb.sys
C:\Temp\hbzwtoljeb.sys
1⤵
PID:5984

C:\Temp\wqoljdbvtr.sys
C:\Temp\wqoljdbvtr.sys
1⤵
PID:5036

C:\Temp\qnlgdxvsqo.sys
C:\Temp\qnlgdxvsqo.sys
1⤵
PID:2888

C:\Temp\ysqnigdxvs.sys
C:\Temp\ysqnigdxvs.sys
1⤵
PID:1192

C:\Temp\pnkifaxvsq.sys
C:\Temp\pnkifaxvsq.sys
1⤵
PID:6040

C:\Temp\khfzxspnhf.sys
C:\Temp\khfzxspnhf.sys
1⤵
PID:3236

C:\Temp\spjhfcxusm.sys
C:\Temp\spjhfcxusm.sys
1⤵
PID:1168

C:\Temp\ecwuomkecz.sys
C:\Temp\ecwuomkecz.sys
1⤵
PID:3760

C:\Temp\hbztromjeb.sys
C:\Temp\hbztromjeb.sys
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 f0b78e6e64141cad4cdf7ac5acc00f719c0ce0757e0f0366f5ace67aba441efb
MD5 35ed61a3ba18cf94d56d23d79fed9774
SHA1 67aaa77c7cb377116dbe2d64e55dcaddc3a86799
SHA512 8acb245190308bc66021877ff2a6a813880278ffc16166ecd1e5d8e69d230be43db7dda2b1c02ab46a1a38b37c2c08e9350f049ced7e5115efd3403c52727c47
TLSH
T1DA71238356B8C9F3C1DF9BF002835604F1FF22380B23702407555546AB30A7E28B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

czurmkecxrpjhbzu.exe

Path C:\Temp\czurmkecxrpjhbzu.exe
Size 365KB
SHA256 ef44cbb68a7a467fadcacb35ee7306f19eda8caa593f3de0e83735ace195d936
MD5 51b4dc354531003342d17c73c2fd3e8a
SHA1 113a7a0be7089883002640ef95d385d5132ef2de
SHA512 4b51e39fd3a6febcbb9734484cfdf5f9ea1c2eeb01a2eb751bd7aabfed3d6e9a9d89430c008221a6d3b986ffed5e147513d16eca2b9d5d0df81e7cbc32a3d943
SSDEEP 3072:guxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:guxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecxrpjhbzu.sys

Path C:\Temp\czurmkecxrpjhbzu.sys
Size 293KB
SHA256 e4c8d4e51ecb6cdb206920840343495c59281440e5a3bfc3cef1657491bdd317
MD5 8a7ca0b88a4aa5a85bf398713287d84c
SHA1 c3b4299bd94914d38fac1af5e92574f3c77f5af2
SHA512 548b44b5cd73c164f622bae545920a8343210042c472ad9b9c444081baf0a0fb6e89552db66b65c847a02384d8f720e1178a82db98891bcd490daa0f76933ca9
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojhbzt.exe

Path C:\Temp\eywrojhbzt.exe
Size 365KB
SHA256 4c53067ad4d30fec16924ed463512b53fa2e78a102b888a332de0d2047a9fc94
MD5 7f0b196ae0874d17be1d805f8e43dc64
SHA1 463d9e0b1b854e722b44a02f146342eed61470e0
SHA512 d0829147a3811a1dbcfec573027e623dcc5756ec92ac73a320a6157c59e0bbdc1a2750efef7b3e8f6bb4a33c1b9c05e4dd4f70e32bfefed844d774083e4890ae
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupmhfzu.exe

Path C:\Temp\fcxupmhfzu.exe
Size 365KB
SHA256 841e314d3d80965510ee100dfb5b6b6a0307d916cbcd68d1da99e556c4dbd65b
MD5 60842b84a4cdd0e9e9a42180dbe813c8
SHA1 5f0ce424a112d6d625282c3ee8900d493760378b
SHA512 e74029721a12d4f5e9d15c3ad00faade8a874313308ce1637aeaa4bfca2f089a97fde035dec048f660dafc423b441d1368837da01198dd243456e910a6d6ecb6
SSDEEP 3072:buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbz.exe

Path C:\Temp\gbytrljdbz.exe
Size 365KB
SHA256 de2e81168b738ecf2bb300fe80e6a2acc1a5e7c8c03c64e74e2c060ca19b88c8
MD5 e3262d085bbd716ee2fa5f391c9e2a5d
SHA1 7f4e809c9cd83fe8a03d51f803484021d3d29d21
SHA512 8d3f9effc1bc77aa753a005441a9907e889b170360c0e916c6652915840e90d2c03e1c02fe3b8cb675432e0d03c1a1db981f0110b6907a4c53e0a7abd4125f08
SSDEEP 3072:buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwrojgez.sys

Path C:\Temp\hezwrojgez.sys
Size 293KB
SHA256 fe650978751530512c418571dff918a7e7a7b0be5a61c59334c8e51233201291
MD5 32705cf374893bf46288a82dc06b55ef
SHA1 bf983340c1aae7992a93dac0834c7156a37e56e3
SHA512 8da2e3c6de03068d77e8590dc45d5e21281eedea3c707d38b4222831f999b09edf0848d24eb21c2f20578af8e3869008923fec40fae50f857ae69bff759663c3
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywrojhbzt.exe

Path C:\Temp\i_eywrojhbzt.exe
Size 365KB
SHA256 254a45fa3de54cd070c0eac4dd2b88b8943cb65ba55946b22436ebf1a78ec21d
MD5 5a42038966be411303da1ca76c95a5e6
SHA1 65a7c6f25f54bd624819fd60abd6f4092c248c10
SHA512 c2fd2c022a993b5a9b781fb81577948278e1cf23bd95f46d9f49639340f9fb14e989f33aebfc6195376e1b9df7c35aaf6a8fb182ec026c2c92500ada2174a735
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T198847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxupmhfzu.exe

Path C:\Temp\i_fcxupmhfzu.exe
Size 365KB
SHA256 19b01784d9ceb01e9ff86c6db740bdc03abd7be57f7ba33eedfdc4d7c8aa1c85
MD5 6637b450f077cd0d0cf6444e5c61fd9d
SHA1 ce2bff08908cf294cb1ecae9eba5c325758a5ec0
SHA512 b07104be7e9d50f55982c7ba4243a32c63f3207a36259f6acb9fff0ac0765ce8e69c4403671d2d35d5eb74dd0fffef33e17c58c18e8c3094dfe193677792c930
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbz.exe

Path C:\Temp\i_gbytrljdbz.exe
Size 365KB
SHA256 9327b3bfcabffec4050893f956e90eb9276db6af11604f5e3839189251c6138b
MD5 073509d318e4d5c5c4075b91ea90f6ca
SHA1 cd2ff014a40d45272ebfa92535d33ff575a79206
SHA512 79cba6a55a120c7f8863287587002e1d16a38dcf3e79f071a3708a58ee9df419db474c15771fcf809205eb38f62f7d54e35d9a6fe5743bef545c915474394fa6
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlgdy.exe

Path C:\Temp\i_idbvtnlgdy.exe
Size 365KB
SHA256 bfa7dc4b5338cfdbf902a891490f3c0548dae7419a9ee49d17408c75bbf97e9f
MD5 36793e1f44b04fa2e40566814a19a9ea
SHA1 2bb759e6b9f4801a1ad11539ebb0f9df9f5d6999
SHA512 d088f218bbbc9913ece45f1b2fc2b6231066ab23ce6d0ef423cb903425070c976f80b0155247ec0cf0cd3219598b0e985e3251c610198ff538d0040baffaab85
SSDEEP 3072:zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwlgd.exe

Path C:\Temp\i_trljdbwlgd.exe
Size 365KB
SHA256 cf5011b83aa731ea33c8d855bfbd1d3194e37a353f02b84dfb28e6991a4710e9
MD5 fafe056055548e5dd13b1f897381a483
SHA1 1d8e916abe50d685d622a13a0123b171d5b32931
SHA512 f770abc960d5a191cf913595e75db4b8449aa498e4df069877a4209b152f57158c3c20fe3fbea986ebcb33dce36e15373678950ea115c98dd4304d9691da8003
SSDEEP 3072:Euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgdy.exe

Path C:\Temp\idbvtnlgdy.exe
Size 365KB
SHA256 0d1a16d2c232964ebaeddf69f9952a13416d1971be03f20e8ed82be572418bc9
MD5 9e229c58e17b80e9941eca62bc9460fa
SHA1 a6d44b4691122d87a63a562747a27fe74917dbcf
SHA512 735890e56633233874e395b9708b1d3ec25172d337346c409957441111d7d02e4f535981f5ecb7ee26d86dd37c3aaec3380b0961531d5e715878b0e8170b766e
SSDEEP 3072:Buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvtqkic.exe

Path C:\Temp\lfdxvtqkic.exe
Size 365KB
SHA256 fa1812b57e83d7844531b2df0b4479d56a360fa785fad2c836ce3d597e9cdfa5
MD5 91ca7c566a24f24c2936ca0302a532d9
SHA1 f76989f54996ea09754a627640a70fe9e548e7e7
SHA512 7fd55fd512a4eef3589dda49db1af7d1501fee4f2f29698c136cb9a85ca0e0e842da369260af13de6f0584970cd543a274e36cccefc70e1185e255290cc2ad55
SSDEEP 3072:Duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlfd.sys

Path C:\Temp\ljdbvtnlfd.sys
Size 293KB
SHA256 8d39ca61e731292145277e834988e5abc4f2e8b82e3d59e80077d6faf10d4e0c
MD5 48057865f7baa4783329a10e3befa088
SHA1 a9f7c819126232a6725ff5691b837878c91cb14f
SHA512 22c571cb024fa8ab89096c2d71acad71b233f0e862eb208d4de89c0e467f8e08ea046e2343cc495f88af1e389c37ee035b354b4f331d4eb5278f5f2790fbb8d6
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvtnlf.sys

Path C:\Temp\nifdxvtnlf.sys
Size 293KB
SHA256 fb5636c1529a4a571ddf44547d17a76a0a234ab10f4f84fc39aeea5668aa7fdd
MD5 153abeefbba3bebc31d93a77ab14a6b2
SHA1 b0653e53c0d67e19bf67fca232003eed46e477cd
SHA512 8fae7b885d807a4255bbf9b46259a0ecc3e22ddc7b3bbaf8e62ea489e580cd8d6b2bcd26e537e5f726c2ca6bc80f128cb6bbcfbe9488a086763efc497e5c186c
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwlgd.exe

Path C:\Temp\trljdbwlgd.exe
Size 365KB
SHA256 810467bcd3cbd935061c087291547eebc54f27e44aa3a1264066b4f8e33435c8
MD5 edcb22e73728ed1454147e436294ee33
SHA1 22bf0a0dc5b0100bb19800575c7dd726ec8e0460
SHA512 76d0adcd328cde498f8027a89aba93bfda88c57c5917ddb8561e81f76cf99e652a364776581ed2baeddfd7efc1908d3ee3b171079b48fe29e15a0ca0ab4d8f4f
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjebwurm.sys

Path C:\Temp\urmjebwurm.sys
Size 293KB
SHA256 72692548a2852431e8b6338e76e4c8b2b53852d5971fd10ac23a15c3efbe0938
MD5 4a97949d9b09232b32b106e9a1c92005
SHA1 16100177763f8d0034fd999dcba374fde3c77a60
SHA512 b34a1e8a4c6e7e87db0140a95f8c85278d779a84fc870809dd6d57bf72f3e907ae4dfee6d060d7dcd9a4e370f8e03017b9d49acb2fa02d84c73ee96af8b66a80
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgdbwt.sys

Path C:\Temp\ywqomgdbwt.sys
Size 293KB
SHA256 039838aec909d7e208de38d467200cc95d520faa5e2412ec67ff85e658c952c3
MD5 24f1a2cc3aa805f931e7d9891eaf5cb4
SHA1 ff18ed56d3b22c9adbb6778e9dffa497a75b6cc5
SHA512 7ffeafbcd207d6f1345ad0b3b3aa336938d949904d5960dbcf3da9f424ef31cc70581317b475a77143de093a87af84e288f6d9430eb7ac6d4d2f00298928ce28
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72e3c96821e1675fe949371f7dde093aa987ba73e13ac2053add5929be3baca6
MD5 785d9c5f85abbfdfbe09037d227db1e7
SHA1 0096e95c62308b282ed47d2f60a384f36687fa31
SHA512 07cf1d30000bf8cf9e0ee474ff4d5515875ec99388cd206cbc4071d2bc97a23a79f2ba8ba2622e0924d8f4e6f66c366c744539041db9061c9cca43f498638a4b
TLSH
T1ADD09BF162744956DC80703534F1536572545E31445556544590F0B89867381121B49D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f520caf991803ff7a4b9b24a234e8d45e2d7ebcd034bd29be158a277c90d557
MD5 953849921ea6bc8b5ea99349afa1d1a1
SHA1 8a4859d6b2c80f8b9293d2e3e3e747b2c856e54d
SHA512 77b8de5cd35c575619cc81161c080816dfe4ee2b2f370917274f423b17812abac9d16b25797cb03e038779495870aae086ebf6eff2ca53f64fe59585826e8ba1
TLSH
T1EBD09BF562744956DC80703534F1536572545E31985556544490F0A89867381121B4AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 186c3a6f9e55e7edaba01fc1bc7df473881780793ce24564a0f6b1f3c68b0891
MD5 7b7edf21378317e5a9e41665f9ed7c6d
SHA1 b126dbc1c314e0d4e54060b12eb9b61338fe0ab2
SHA512 7f23ff1f891740607325af997ff5b197f8a5aa09245c68045d6130a11d149454343a255caf1b67653a42b73e76362459c1631186adb2a09774fb1a53e3e85a8e
TLSH
T1EF6151760336C7F2EBE99EB9D1E350F4397044A5822B1D84E084A1B7B40335A933E49B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596a78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596a78.TMP
Size 3KB
SHA256 9b3b0ceca7d9ff65b2eb7fce728c08f3d88e3d96aa1666f359f7883fff70f15b
MD5 5171b05551245a16aa796c1a9c3d6736
SHA1 f3a3ecc47248fa50832157303ce43e7584d1b8d5
SHA512 21c40954cbfc5839036d94a72b6d5c89fc5c5dd0ba7a4f81f224fff2110ff68c8c8a559bc8f7a7f9bd2433216c5ae7f313d5cc3050ba2cb43936d20beef67b71
TLSH
T1FD6152760336C7F2EBE99DB9D1E350B4397044A582271D84E084A1B77403356933E49B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 99280ec019f30c28bb31a1362a3049448fe81be22e93372c2d2f6eb77be29f9c
MD5 917f3dd83582b685b71fb48cdcb8445f
SHA1 e964a3d6b6dcd30660ca1c57ca9e29279f069e25
SHA512 34f9d84ce2c6fc58edd2d1efd7494e876527b405170309fb304cc717291b56b83de1578d5468569914b37f7a9c2bdc484b2228af0d878a35d88a650b6adb42f7
TLSH
T10B51ADF3C3E8866DDA1155F4BA187E2BCE1D0914832C3D5A89E4AE1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ca7e93c45dea4d082b55ab3b3a4bf44dab27682397337062d2db2737025c2215
MD5 eac63731868cc82aec2a0cf25bd59827
SHA1 e7203ac5c353e73e3e21a03c727dfbc17ecc7ce7
SHA512 6e79553db91247e7f81c9ce331a5c157e7209fd4b1d24ed6fb6b649f9a22f6e39254c8e29fa22d65f9f2630889f7058709a07d1c4bf227e625414b6a658b5ac8
SSDEEP 192:sxR8RfyM/jK1Ml8wCr/ftssw4sTZQoqMrzoA8pi/g6+WNIYPpGNUgGMIgtJ:sxR8L8r/ftsDDdQoqMKi/5IRN33
TLSH
T1E452D9156A38993B8CDBD208FA557F53D6F91573A2901E44AAFCDB0C04E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4b8bf7570829ef2726245e14727dec3497b65395b21cf6248b628b4a51135bbf
MD5 7a54bbfcb8ac99089ef74f77a17d822d
SHA1 f6c3d2760a2ac8d83d3679e2904b2fbfe259ee83
SHA512 271d175a69f644399ced05fedec4419a44c770527c847332576521a847cb673aa55f5c5c472e35551f964a777ced6a63aead1379ac3c98f81d2ebd78760ec911
SSDEEP 192:sxRDRfyM/jK1Ml8wCr/ftszw4sTZQoqMrzoA8pi/g6+WNIYPpGNUgGMIgDMJ:sxRDL8r/ftsEDdQoqMKi/5IRN30
TLSH
T1AA52D9156A38993B8CDBD208FA557F53D6F91573A2901E44AAFCDB0C04E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66cbe09947b7699ee5c8d098bb9feb296c58f1f91cc3c62202c0363fa86a1a02
MD5 b0e53b63c825b79b6822ab5f1036dcfa
SHA1 510e37fd6198c888a3c173dfb9edf2097ff07e4f
SHA512 46a56050293db4fd08b4e2ed424a3fab00c66d3b2e76c88101d0d764e6e7a877bbb48d939035228e57a2798bc959eeaf101d987ed7c570a7cfa6a99061b0d13e
SSDEEP 192:sxRDRfyM/jK1Ml8wCr/ftszw4FTZQoqIrzoA8p91/g6+WNCiE/YP+GNUgGMIgDCJ:sxRDF8r/ftsE2dQoqIKn/5Q/eN3S
TLSH
T10062D8166A24997B8CDBD208FA557F63D6F91573E2901E44AAFCCB0C00E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d1e75ea814bd2aae191c8bdb6a3c38ee6a8ea2f5a16a01a9737b7245e390ccb
MD5 2b54ab59a3e1f688c190fbd8248b027b
SHA1 409fe2938a3948c66a11f76024f47b1ebcfa2432
SHA512 b1879d238292b1dd064c02cd6ca8cd62a94b6bc76bd85cc5d219e2168efc07548777b32052fbd19ce29efebad69bb120093711db773697c8130a717455a36cb0
SSDEEP 192:sxRDRfyM/jK1Ml8UQ0Cr/ftszw4FTZQoqIrzoA8pr1/g6+WNCiE/YP+GNUgGMIgS:sxRDFqjr/ftsE2dQoqIKR/5Q/eN3S
TLSH
T14762D9166A2499778CDBD208FA557FA3D6F95573E2941E04AAFCCB0C00E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5f204a0cc4ebdfdca68f7d7dc9732e215354481daa99f477b628ad7910e2706c
MD5 391160296ba9aac03bd074f9e9670e47
SHA1 532a5ff5f5901e2150a90909ec8389c63772dfa0
SHA512 af22df3d5232e16d4b5594d505ea6347a088f1431e256b601b77f05ae5fb87bbfb3bb379623004240e3c21d889409352497517a932c8cede375d8c302f40eb5c
SSDEEP 768:VroBVL6d7pLuL7vOWgy8fcl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtZl3zEOErocA:VroBpME7vOWgy8fclu1ja2H3YOPcV0P
TLSH
T168E2FC3B684CCB7A4F804DDCEC29BD9AADA902CF96D8895447F9880C03C67EF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30f08fb8-4926-4bd2-b896-68c481db4930.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\30f08fb8-4926-4bd2-b896-68c481db4930.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60dff6eb84816c792f5649e2495a1ee32793037c4660cafd286d5eff4d6166bd
MD5 49afa64035350fdc7cc8cc1ec5b487aa
SHA1 761725b0d86fe45d219bca50efa9254bc31e51a9
SHA512 c1657f249175b55727ce9490c2c9bee35ff77c8315b7f9a1f041000f35b4d2284e54738dd643259768bbc81ff890364318bbbee4f4e63465d1529b7529895bc4
SSDEEP 768:+rv+4UNbdt3CxavgUZ+VCrh0yAJDQfADHUiW+J:+bsbn3MgSWh0SfSU7e
TLSH
T1AE03D032F8A48D738CE6C2C5718B36577FB8502396C90694D8ED6FCD068769D234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3027508abfad04784991bc49c1b698e0d40e9e79d9615b9659a3f1fee6406339
MD5 9c8cb937c415604302ddad62e26d7b7a
SHA1 ada655b1347b4eb463b7529369db040662c102c0
SHA512 50b9dd30e8f650bf253f600c28fd7f8dc8c498fb842531df39cf0acc4d4776f7627d733087dea62564d941f0d6807ede5a6f8abb8ec29fcfb308b34dbc483dfd
SSDEEP 768:srv+4UNbde3YI0av5UUZ+VCrh0yAJDQfQLUiW+t:sbsbY3YjoSWh0Sf+U7O
TLSH
T14813C071B8A4DC338DE6D185B14B37D36FB8207399C90A98D8D95F8D068769E234BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a8b3d8030fac3632e415076ff05c17d049014ffc1da288c659dc1cefdc2f9c49
MD5 4da42fb7f19dad00666e7f03d157d313
SHA1 7b7b0428c7e842c878cbf8f6cfd6512d792ebc3c
SHA512 02c6b1b67518773e41de29f3c5766d734314fcfe6944ae39dcbfa90c9e4288db4fc76b6e3d577c8c8ffcc424795d57a9a2d7e863d9de337d661dc6d0e686c364
SSDEEP 768:gj+983fM0av5QUZ+VCrh0yAJDQfQLb9MO:f983f36SWh0Sf+b+O
TLSH
T106F2C030B8A18D734CD6D2C8B54B37E65EF8117785891D8CE8ED9F4C09837AD234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 89963891d314a60b79a81c5c6a2c877be406ecdebba181f6957ba7a366e33aa9
MD5 e708ec1e00d377b458c8239fdeafe4b6
SHA1 bf62cc382607a03d7f40b3db58b9e8130bb37ad5
SHA512 be576bac0207f19011adb6b0a3310beb72eecf0c3b4619f789e80d4e79840bd19f0488bfe9eac2c007fda10ab88ec8e9426599e27dab4fba72edb608ac1449fd
SSDEEP 768:KF1j+993YwgEc1aav52NUZ+VCrh0yAJDQfQLb9MO:P993BHVgSWh0Sf+b+O
TLSH
T1C6136BF1A8D38933C89E8787A73E2E915EBCD167B4855988B7C85E4CCD432BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

7719daf5-c103-402c-9b6a-8f25463370ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7719daf5-c103-402c-9b6a-8f25463370ec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4656_1066473030\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1168-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1192-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1820-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1868-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1868-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2616-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2888-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3236-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3760-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4180-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4792-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5984-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download