systex | c735f296cf7e99bb2682b33ebc6deb69060123b089b3d076a5241be5be897494

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260714-py6eysc17r
SHA256 c735f296cf7e99bb2682b33ebc6deb69060123b089b3d076a5241be5be897494
MD5 9985da5f8b4199674bb7ff9d38bf1bcb
SHA1 24127c5eb2fa5d4087734ffdf5290745645a133c
SHA512 e43e458a5300270d59da0c865512de1b2e0571f58eba421ca0043d446b9f0c9e00bcb6e63a5c3e8435c228fb356f65134a88a269f285bc64bc4d1e594d2f01ea
SSDEEP 3072:oFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:oFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4296	ljebwuomgeywrojh.exe
4288	ljebwuomgeywrojh.sys
3448	CreateProcess.exe
4736	dbwtomjebw.exe
4084	CreateProcess.exe
5824	CreateProcess.exe
3900	i_dbwtomjebw.exe
5696	bywqoigbyt.sys
1404	CreateProcess.exe
5556	olgeywgbyt.exe
2888	CreateProcess.exe
5988	CreateProcess.exe
3864	i_olgeywgbyt.exe
4292	wqoigaytql.sys
4192	CreateProcess.exe
4780	lfdyvqoifd.exe
964	CreateProcess.exe
3372	CreateProcess.exe
3424	i_lfdyvqoifd.exe
5432	vsqkidavtn.sys
6000	CreateProcess.exe
5272	qkidavtnlf.exe
852	CreateProcess.exe
4868	CreateProcess.exe
4612	i_qkidavtnlf.exe
4580	aysqkicavp.sys
4292	CreateProcess.exe
1064	pnhfausmki.exe
5424	CreateProcess.exe
1584	CreateProcess.exe
896	i_pnhfausmki.exe
3872	CreateProcess.exe
1844	upnhfzxrpk.exe
4660	CreateProcess.exe
1648	CreateProcess.exe
6100	i_upnhfzxrpk.exe
200	pmkecwupmh.sys
3964	CreateProcess.exe
1044	ecwupmhezx.exe
2304	CreateProcess.exe
2120	CreateProcess.exe
2484	i_ecwupmhezx.exe
1136	rmjhbzurmk.sys
708	CreateProcess.exe
3824	ecwuomgezw.exe
5900	CreateProcess.exe
3860	CreateProcess.exe
1556	i_ecwuomgezw.exe
940	ojhbztrmje.sys
2900	CreateProcess.exe
3068	ebwuojdbwt.exe
896	CreateProcess.exe
4384	CreateProcess.exe
1336	i_ebwuojdbwt.exe
788	ytrljdbwto.sys
5064	CreateProcess.exe
1568	jdbwtolgdy.exe
4668	CreateProcess.exe
4088	CreateProcess.exe
1396	i_jdbwtolgdy.exe
2144	wqoigeywqo.sys
432	CreateProcess.exe
2196	qoigaywqoi.exe
2812	CreateProcess.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1279866291\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1279866291\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1279866291\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_636981069\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_636981069\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_733904562\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1279866291\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1629881776\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_733904562\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geytqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geytqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwuomgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuojdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfausmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuojdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfausmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4372	ipconfig.exe
3400	ipconfig.exe
692	ipconfig.exe
2604	ipconfig.exe
2004	ipconfig.exe
2504	ipconfig.exe
2804	ipconfig.exe
6076	ipconfig.exe
5564	ipconfig.exe
5020	ipconfig.exe
4944	ipconfig.exe
6080	ipconfig.exe
3368	ipconfig.exe
1804	ipconfig.exe
5880	ipconfig.exe
1292	ipconfig.exe
4280	ipconfig.exe
1136	ipconfig.exe
692	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285067268717990"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{1CED2C85-F111-42D9-84EF-0A3F13266AF4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4296	ljebwuomgeywrojh.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4296	ljebwuomgeywrojh.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4296	ljebwuomgeywrojh.exe
4296	ljebwuomgeywrojh.exe
4296	ljebwuomgeywrojh.exe
4296	ljebwuomgeywrojh.exe
4296	ljebwuomgeywrojh.exe
4296	ljebwuomgeywrojh.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	i_dbwtomjebw.exe
Token: SeDebugPrivilege	3864	i_olgeywgbyt.exe
Token: SeDebugPrivilege	3424	i_lfdyvqoifd.exe
Token: SeDebugPrivilege	4612	i_qkidavtnlf.exe
Token: SeDebugPrivilege	6100	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	2484	i_ecwupmhezx.exe
Token: SeDebugPrivilege	1556	i_ecwuomgezw.exe
Token: SeDebugPrivilege	1336	i_ebwuojdbwt.exe
Token: SeDebugPrivilege	1396	i_jdbwtolgdy.exe
Token: SeDebugPrivilege	6108	i_qoigaywqoi.exe
Token: SeDebugPrivilege	3340	i_qlidaysqli.exe
Token: SeDebugPrivilege	6036	i_sqkicavsnl.exe
Token: SeDebugPrivilege	3680	i_rpkhcausmk.exe
Token: SeDebugPrivilege	4388	i_wurpjhczus.exe
Token: SeDebugPrivilege	6076	i_gezwuomhez.exe
Token: SeDebugPrivilege	1528	i_bztrljebwt.exe
Token: SeDebugPrivilege	692	i_geytqojgby.exe
Token: SeDebugPrivilege	3456	i_nlgdywqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4296	1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 1160 wrote to memory of 4548	1160	2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4548 wrote to memory of 5068	4548	iexplore.exe	89
PID 5068 wrote to memory of 5632	5068	msedge.exe	90
PID 5068 wrote to memory of 5780	5068	msedge.exe	91
PID 5068 wrote to memory of 4768	5068	msedge.exe	92
PID 5068 wrote to memory of 4768	5068	msedge.exe	92
PID 5068 wrote to memory of 4768	5068	msedge.exe	92
PID 5068 wrote to memory of 3416	5068	msedge.exe	93
PID 5068 wrote to memory of 3416	5068	msedge.exe	93
PID 5068 wrote to memory of 2360	5068	msedge.exe	95
PID 5068 wrote to memory of 2360	5068	msedge.exe	95
PID 5068 wrote to memory of 2360	5068	msedge.exe	95
PID 5068 wrote to memory of 716	5068	msedge.exe	96
PID 5068 wrote to memory of 716	5068	msedge.exe	96
PID 5068 wrote to memory of 716	5068	msedge.exe	96
PID 5068 wrote to memory of 236	5068	msedge.exe	97
PID 5068 wrote to memory of 236	5068	msedge.exe	97
PID 5068 wrote to memory of 236	5068	msedge.exe	97
PID 5068 wrote to memory of 124	5068	msedge.exe	98
PID 5068 wrote to memory of 124	5068	msedge.exe	98
PID 5068 wrote to memory of 124	5068	msedge.exe	98
PID 5068 wrote to memory of 928	5068	msedge.exe	100
PID 5068 wrote to memory of 928	5068	msedge.exe	100
PID 4296 wrote to memory of 3448	4296	ljebwuomgeywrojh.exe	103
PID 5068 wrote to memory of 3600	5068	msedge.exe	105
PID 5068 wrote to memory of 1976	5068	msedge.exe	106
PID 5068 wrote to memory of 3600	5068	msedge.exe	105
PID 5068 wrote to memory of 1976	5068	msedge.exe	106
PID 4736 wrote to memory of 4084	4736	dbwtomjebw.exe	109
PID 5068 wrote to memory of 3720	5068	msedge.exe	112
PID 5068 wrote to memory of 1988	5068	msedge.exe	114
PID 5068 wrote to memory of 1988	5068	msedge.exe	114
PID 5068 wrote to memory of 1332	5068	msedge.exe	116
PID 5068 wrote to memory of 1332	5068	msedge.exe	116
PID 4296 wrote to memory of 5824	4296	ljebwuomgeywrojh.exe	117
PID 4296 wrote to memory of 1404	4296	ljebwuomgeywrojh.exe	121
PID 5556 wrote to memory of 2888	5556	olgeywgbyt.exe	123
PID 4296 wrote to memory of 5988	4296	ljebwuomgeywrojh.exe	126
PID 4296 wrote to memory of 4192	4296	ljebwuomgeywrojh.exe	130
PID 4780 wrote to memory of 964	4780	lfdyvqoifd.exe	132
PID 4296 wrote to memory of 3372	4296	ljebwuomgeywrojh.exe	135
PID 5068 wrote to memory of 4156	5068	msedge.exe	137
PID 5068 wrote to memory of 4156	5068	msedge.exe	137
PID 5068 wrote to memory of 4156	5068	msedge.exe	137
PID 5068 wrote to memory of 4848	5068	msedge.exe	138
PID 5068 wrote to memory of 4848	5068	msedge.exe	138
PID 5068 wrote to memory of 4848	5068	msedge.exe	138
PID 4296 wrote to memory of 6000	4296	ljebwuomgeywrojh.exe	142
PID 5272 wrote to memory of 852	5272	qkidavtnlf.exe	144
PID 4296 wrote to memory of 4868	4296	ljebwuomgeywrojh.exe	147
PID 5068 wrote to memory of 5028	5068	msedge.exe	149
PID 5068 wrote to memory of 3452	5068	msedge.exe	150
PID 5068 wrote to memory of 1140	5068	msedge.exe	151
PID 4296 wrote to memory of 4292	4296	ljebwuomgeywrojh.exe	154
PID 1064 wrote to memory of 5424	1064	pnhfausmki.exe	156
PID 4296 wrote to memory of 1584	4296	ljebwuomgeywrojh.exe	159
PID 4296 wrote to memory of 3872	4296	ljebwuomgeywrojh.exe	161
PID 1844 wrote to memory of 4660	1844	upnhfzxrpk.exe	163
PID 4296 wrote to memory of 1648	4296	ljebwuomgeywrojh.exe	166
PID 4296 wrote to memory of 3964	4296	ljebwuomgeywrojh.exe	170
PID 1044 wrote to memory of 2304	1044	ecwupmhezx.exe	172
PID 4296 wrote to memory of 2120	4296	ljebwuomgeywrojh.exe	175
PID 4296 wrote to memory of 708	4296	ljebwuomgeywrojh.exe	179

C:\Users\Admin\AppData\Local\Temp\2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_9985da5f8b4199674bb7ff9d38bf1bcb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Temp\ljebwuomgeywrojh.exe
  C:\Temp\ljebwuomgeywrojh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomjebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\Temp\dbwtomjebw.exe
      C:\Temp\dbwtomjebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomjebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5824
  - - C:\Temp\i_dbwtomjebw.exe
      C:\Temp\i_dbwtomjebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeywgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1404
  - - C:\Temp\olgeywgbyt.exe
      C:\Temp\olgeywgbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeywgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5988
  - - C:\Temp\i_olgeywgbyt.exe
      C:\Temp\i_olgeywgbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdyvqoifd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\lfdyvqoifd.exe
      C:\Temp\lfdyvqoifd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3372
  - - C:\Temp\i_lfdyvqoifd.exe
      C:\Temp\i_lfdyvqoifd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6000
  - - C:\Temp\qkidavtnlf.exe
      C:\Temp\qkidavtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4868
  - - C:\Temp\i_qkidavtnlf.exe
      C:\Temp\i_qkidavtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfausmki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4292
  - - C:\Temp\pnhfausmki.exe
      C:\Temp\pnhfausmki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfausmki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1584
  - - C:\Temp\i_pnhfausmki.exe
      C:\Temp\i_pnhfausmki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3872
  - - C:\Temp\upnhfzxrpk.exe
      C:\Temp\upnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1648
  - - C:\Temp\i_upnhfzxrpk.exe
      C:\Temp\i_upnhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3964
  - - C:\Temp\ecwupmhezx.exe
      C:\Temp\ecwupmhezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\i_ecwupmhezx.exe
      C:\Temp\i_ecwupmhezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:708
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3860
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuojdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\ebwuojdbwt.exe
      C:\Temp\ebwuojdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuojdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4384
  - - C:\Temp\i_ebwuojdbwt.exe
      C:\Temp\i_ebwuojdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\jdbwtolgdy.exe
      C:\Temp\jdbwtolgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtolgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Temp\i_jdbwtolgdy.exe
      C:\Temp\i_jdbwtolgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:432
  - - C:\Temp\qoigaywqoi.exe
      C:\Temp\qoigaywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaywqoi.exe ups_ins
    3⤵
    PID:4476
  - - C:\Temp\i_qoigaywqoi.exe
      C:\Temp\i_qoigaywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidaysqli.exe ups_run
    3⤵
    PID:6024
  - - C:\Temp\qlidaysqli.exe
      C:\Temp\qlidaysqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidaysqli.exe ups_ins
    3⤵
    PID:1136
  - - C:\Temp\i_qlidaysqli.exe
      C:\Temp\i_qlidaysqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    PID:3436
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    PID:1556
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhcausmk.exe ups_run
    3⤵
    PID:2020
  - - C:\Temp\rpkhcausmk.exe
      C:\Temp\rpkhcausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhcausmk.exe ups_ins
    3⤵
    PID:3736
  - - C:\Temp\i_rpkhcausmk.exe
      C:\Temp\i_rpkhcausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpjhczus.exe ups_run
    3⤵
    PID:2272
  - - C:\Temp\wurpjhczus.exe
      C:\Temp\wurpjhczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpjhczus.exe ups_ins
    3⤵
    PID:3132
  - - C:\Temp\i_wurpjhczus.exe
      C:\Temp\i_wurpjhczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwuomhez.exe ups_run
    3⤵
    PID:3464
  - - C:\Temp\gezwuomhez.exe
      C:\Temp\gezwuomhez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwuomhez.exe ups_ins
    3⤵
    PID:2308
  - - C:\Temp\i_gezwuomhez.exe
      C:\Temp\i_gezwuomhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebwt.exe ups_run
    3⤵
    PID:5048
  - - C:\Temp\bztrljebwt.exe
      C:\Temp\bztrljebwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    PID:4452
  - - C:\Temp\i_bztrljebwt.exe
      C:\Temp\i_bztrljebwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geytqojgby.exe ups_run
    3⤵
    PID:1260
  - - C:\Temp\geytqojgby.exe
      C:\Temp\geytqojgby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geytqojgby.exe ups_ins
    3⤵
    PID:2620
  - - C:\Temp\i_geytqojgby.exe
      C:\Temp\i_geytqojgby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    PID:3712
  - - C:\Temp\nlgdywqoig.exe
      C:\Temp\nlgdywqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    PID:5224
  - - C:\Temp\i_nlgdywqoig.exe
      C:\Temp\i_nlgdywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3456
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbfb89c188,0x7ffbfb89c194,0x7ffbfb89c1a0
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,9019911930530075923,3006124889492141108,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
      4⤵
      System Time Discovery
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9285905552086974550,16743947066818645260,262144 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,17560703994554384652,5134253623359965108,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,16242147017301860531,1903160288051008436,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,1297497211238773675,4495160234760123429,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,11610151982945841326,15561822547681082336,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,16574510558197337986,2242590231169921270,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,3828513710802511363,1889861716997546946,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10478279414569238927,14164117464912620542,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,7646789393298158851,4004874381003896021,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,17598359247780678385,3946959284692466481,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,17598359247780678385,3946959284692466481,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,17356311751366027057,12710548013802939242,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,9343954827334395014,2301262653553498949,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4524,i,15430303539929921412,6624418624393035524,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3660,i,9346344425990127421,3412131738393531490,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12861669769827086817,7403406237096478762,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10197821910674006002,12684350992425440880,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,5905700327373186957,8352685274424239075,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,4135927142931151288,15275995764819156918,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,2267961968052438926,8484334392487103634,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5232,i,5230293927931808356,18333352893366195487,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,17347420794412676215,12391004026539337899,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6484,i,4623611555025313172,6765745631395701406,2097152 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,11742117380669901202,9187928561740207863,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6932,i,16115837683726349393,11626459666377792926,262144 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:10
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6052732718322729211,11532504995091524865,524288 --field-trial-handle=2664,i,9131261624005770028,7601159218938337396,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2604

C:\Temp\ljebwuomgeywrojh.sys
C:\Temp\ljebwuomgeywrojh.sys
1⤵
- Executes dropped EXE
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4672

C:\Temp\bywqoigbyt.sys
C:\Temp\bywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:5696

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
- Executes dropped EXE
PID:4292

C:\Temp\vsqkidavtn.sys
C:\Temp\vsqkidavtn.sys
1⤵
- Executes dropped EXE
PID:5432

C:\Temp\aysqkicavp.sys
C:\Temp\aysqkicavp.sys
1⤵
- Executes dropped EXE
PID:4580

C:\Temp\pmkecwupmh.sys
C:\Temp\pmkecwupmh.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\rmjhbzurmk.sys
C:\Temp\rmjhbzurmk.sys
1⤵
- Executes dropped EXE
PID:1136

C:\Temp\ojhbztrmje.sys
C:\Temp\ojhbztrmje.sys
1⤵
- Executes dropped EXE
PID:940

C:\Temp\ytrljdbwto.sys
C:\Temp\ytrljdbwto.sys
1⤵
- Executes dropped EXE
PID:788

C:\Temp\wqoigeywqo.sys
C:\Temp\wqoigeywqo.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
PID:1092

C:\Temp\faxsqnifax.sys
C:\Temp\faxsqnifax.sys
1⤵
PID:6080

C:\Temp\kicsmkecxu.sys
C:\Temp\kicsmkecxu.sys
1⤵
PID:3424

C:\Temp\ecausmkhfz.sys
C:\Temp\ecausmkhfz.sys
1⤵
PID:5052

C:\Temp\rmkecwuomh.sys
C:\Temp\rmkecwuomh.sys
1⤵
PID:5484

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
PID:3708

C:\Temp\rljdbvtolg.sys
C:\Temp\rljdbvtolg.sys
1⤵
PID:4600

C:\Temp\vtqolgeywq.sys
C:\Temp\vtqolgeywq.sys
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkicavp.sys

Path C:\Temp\aysqkicavp.sys
Size 293KB
SHA256 487db9a3db4a56f81af1304b63210d227be4cd9b23e5af37fd34afc5225a49c9
MD5 f85a413981c05d1813cfc54459199bd8
SHA1 14c657dbbd852d50d4d58b0186fe9332d6850ce2
SHA512 a0b6cf9b57d868e35c4f37e2f10b24b162f7da775849b7aaa08fa866c1d21cda93e29fd541c73c02615068ebbc9325c8f0834fa41d7b900a7f06e0b5bb759820
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqoigbyt.sys

Path C:\Temp\bywqoigbyt.sys
Size 293KB
SHA256 6dcc696e97c5350e46c6b2e77026ec672f134db1a3afc0fe6128a7fc9f717ee3
MD5 11245d7d7f62f246a01c7a7f8b287a8e
SHA1 7318cb3e8f0774419db5f28c5caadf94d902846e
SHA512 166e737bd1f3639f4f0709747d86c47562e7907c5b09772cb16f6c360c36d2ef4bbd71d10baaff2ad60bd1fdcb1f6ff62f8331a87fe79856f906d4b88ee9192d
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomjebw.exe

Path C:\Temp\dbwtomjebw.exe
Size 376KB
SHA256 b3a9e82d7585c220f3bf8cb2dd05c4ab15fc0a8b5fd0a5de88c11f4945e39f9e
MD5 deeaba2ecbf429564c23188a3af8008c
SHA1 5d6e633871bb6a6b4ef718d1ae10c98877cd45f3
SHA512 9acfbd250da9cdaf603b2ad3ee1930e1992321e11bac4993c4948b80af24c2931fb2b10c0464e0ba7f194f11b9fe6a323bf75c0714e4fceb3df80c6473a1c38b
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwtomjebw.exe

Path C:\Temp\i_dbwtomjebw.exe
Size 376KB
SHA256 2a5c2e26720a7342930961606ce63beed97172206acb827fa763ca6fe2dc93a3
MD5 c2f323670f8e58791035b5fbb365b294
SHA1 c0651bb103a077630025f59cf578e5524782a33e
SHA512 95678d1f0ac0bc35661b4e81d0a0a12fbd632133fe52dc774e967f6f645fc99c858caecee5757800bba0d197dc8d279a85bd6da499565e8943e8ad980131568e
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqoifd.exe

Path C:\Temp\i_lfdyvqoifd.exe
Size 376KB
SHA256 3763bc7639d6fc77c6b5f393a0c3b88e20ec1fe29562a1b347afbd2cdc9dd927
MD5 65eff18da0946a8c94f39eca94a671cd
SHA1 135a68952aee3a65d808dd72ce77a3f0afc8c610
SHA512 61e2e72ab358469a115a1c423d87e7d183011cdfffa6c95146799c94444d0a3a37268e3804569bd4a71c7640b2043c90b78cf285a799fd8fe33f893f280c8e59
SSDEEP 3072:6FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywgbyt.exe

Path C:\Temp\i_olgeywgbyt.exe
Size 376KB
SHA256 a3139a1f4facce034e947e7a714f7deedb33501870ae54e7b11722ad59542e7e
MD5 ecb53353d16a8bd5bb581a976cae646f
SHA1 2b8aca1d3e24eac6d76ba4a2716afd623917bc10
SHA512 5e5fd2768d801550a52e45e5a125fa7444a1850f55c96111a865d57da30ac2c7bdb15c6966cb7bdb3af97f4e53a83852779a111ef06ef2b5643c1a9205d616d1
SSDEEP 3072:lFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfausmki.exe

Path C:\Temp\i_pnhfausmki.exe
Size 376KB
SHA256 ab6665ba80aa9ba27f92ef20c8818051dd5f10aa6b8e7b09ce8661c50ceda5b9
MD5 e71392ebac609a6038287f054fd90441
SHA1 b882bae653eb1bcc36d5eeca39ff18df774e2dbd
SHA512 d87d327269516d14371bb7d448244b7821117ddd98abbe4217dd18e82bc05c23d77bdaaa01be379a07d3f12e89de3e3deed702569e4b8eecbf9d068b3ca2b003
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T151847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkidavtnlf.exe

Path C:\Temp\i_qkidavtnlf.exe
Size 376KB
SHA256 0bd63d8097ab0e67f2cb638ee79f792b2531bd29a2b4b3c5d206b3c77bc9efae
MD5 3bb53c2d367fea47431cb217f007790e
SHA1 056f64535a107ff9c34aa399a809093cf9c7dc1a
SHA512 c78426b4428beca9d750fce4a1461c5684afa2f1320951934f3e7be32a4279c672ef2c3e47352771604c5dce5664c0ad92aaa004240768b0810ba80370c45ba3
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upnhfzxrpk.exe

Path C:\Temp\i_upnhfzxrpk.exe
Size 376KB
SHA256 e836c17c9c1e41a8b6036583e5ae216722d977e5bc173efca7ba25bdaee545e0
MD5 5de440b001c2545c2e44f6aad61d9f7c
SHA1 8f8d9acee2f4fd8b56819b02497a92607b6d4ec3
SHA512 3851493e35866bf73489dcfef018a32d66bd9de9ac95324f65992fc63242484ec480ef7fb5bcc3c15eb8d1ed55862f1ae74834dca61efd8cb239dfa29d9c5793
SSDEEP 3072:lFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqoifd.exe

Path C:\Temp\lfdyvqoifd.exe
Size 376KB
SHA256 2002d3c4a7bbf2cb7664f9c28ee2a38999db8aed626da8ae4e0fdb173c07e3e6
MD5 476fa85470c9e13c345c5fd419ecbd22
SHA1 e59718e34899462dc99da67f1774ac4a518a4482
SHA512 15f3171d6ac177426b38321b88b48fce7c0fb26285b8e7019f4ee324b23901f7fdb5f50c7a265cd102d1108912fb059f9dc5a028d731217ae1a81326920b6e79
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwuomgeywrojh.exe

Path C:\Temp\ljebwuomgeywrojh.exe
Size 376KB
SHA256 a3313e46977148473f86a65ea8d353eab31a8e8962e0234a5a1fa1d4e13cdb4c
MD5 08420eb20d2715a6af7b93d194417463
SHA1 0235cd6997c4ea0b63d5293cfb536bb10812fc0e
SHA512 6031978525a231b48add0846e1490364186357276d3131c0fe57ed805d10b303a05f41ba10c3fff8757e1a2e58dd325abc77a0ac5b6a1d25e97c09e9f8dc3025
SSDEEP 3072:hFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:hFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwuomgeywrojh.sys

Path C:\Temp\ljebwuomgeywrojh.sys
Size 293KB
SHA256 c9b6aa4977d14ea171f5d04a3448fa8ff3c138a52868dfd43b9f58488a980f5f
MD5 cbb058ad6d20cdd88a81e4963f77df98
SHA1 ab49f277f07d41924255dcfed4354c6137fefcba
SHA512 263c2adec8a59e59223d9aa89c84c42e9223c2c34db69ba04d1e00e7ca2cc053d2ff7069eb49bdf8ba73436a5d021b53f8f8e6a47dd2d369e03abf6a0a7873ee
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T156545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywgbyt.exe

Path C:\Temp\olgeywgbyt.exe
Size 376KB
SHA256 90982916e535a1a4b6655f1696692cdcdaa8572074d662c7ffdd16599784d645
MD5 eea928997715435c26220454abb5ee2b
SHA1 7fc3cff79cfd54904530075221e7be369c385cad
SHA512 39591174177c696e6229204971ecaa4db7ef433388bbc4fc094d3f2632c3fb5ceb4f8014a1a58cb5b8bc62e7775ad380352a8451e4bb32b91b72993df0c3e162
SSDEEP 3072:jFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfausmki.exe

Path C:\Temp\pnhfausmki.exe
Size 376KB
SHA256 be5f2214b285d33cbae74167bebb205665ef1bb541b5e6956ac596a244e5fe6a
MD5 028b440d863301a08ecd193fc466e4e1
SHA1 e53f09da38b36b38eed63b6516477c0a06f25866
SHA512 9c33f5b8713ff7a3b188dbffec433ef036f9475bd15fb99d48110283c0bcdc9c4772ef5563d2b3e139de94e80f571670aaffaf8ddcc15006c321e6dd22621113
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T146847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavtnlf.exe

Path C:\Temp\qkidavtnlf.exe
Size 376KB
SHA256 ba354d38fe7b53ab2842bfdd8fc8d713369781cd48807c96bd72ea5c04284490
MD5 fd0585e3f60bea6e316d0864359cd484
SHA1 e969bb419ed1f8a3d16b3bb12d5712ec3b4a99b3
SHA512 21cd2f287e009c1c645f19a8a5dbe814834902c8478cf62d8a7460bb96d37e49eb4688e89203da90570218ebe17fc9d906518fed280fe246a2ff3f085b5ec78a
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.exe

Path C:\Temp\upnhfzxrpk.exe
Size 376KB
SHA256 4b63811c25c504700294412df9a5124075cf976df840807448d1ade4f4a86618
MD5 ba871d9d8642930c592706db7529ead6
SHA1 998bf2e348b0e2b7b2b30a90bb79d26d1f7379c9
SHA512 b4ed32610db33a5c1707380a817879ccc0fbe77ea073b2dae75da0d8610723da9e4855a7985f42efc83572da3d8bb30d966159a20ae1f4c1c7583a22e6e157a8
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkidavtn.sys

Path C:\Temp\vsqkidavtn.sys
Size 293KB
SHA256 54da8c8b2226297a581ca6b4bf29a90a256cf400897eaf53c7ff88ff1e61beab
MD5 e90982af4e6757c6a319d812054ae3e6
SHA1 5a4afa352bf214b6eef7793fd5c631afe6906d14
SHA512 1d730d42a9a15c82e78db84dd658e4075ec93e790bee95f189d45a402b2a40f8cb7843aaa60894ca4af1dd5c170c2e862e3cc60e28ac7700a40260d333309e73
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaytql.sys

Path C:\Temp\wqoigaytql.sys
Size 293KB
SHA256 e120c0b3756ddf27825d72fa1eea994c1403d4a4074d17bb43ad17efe878545b
MD5 6adf89b2c02f7c29044397d90509ba10
SHA1 9d8c7696cd39ae48afe6fe7eeb9709e5cac1d0fb
SHA512 f0817fbf34101ea271475cc5572221857abcadd61bb20c18385353ba7f14400a26435bc00edc4c74e3819349be4610ab54b00677e112a720276c5680b01bee17
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed8:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 81a6377788d52a8fe64622aa9d291ce1f546e996d0c9368c1298acc3e74d2cdf
MD5 03391bc306d172ff39324efb02dc7060
SHA1 121d9334080c6728674f37ef8c63b97753b01636
SHA512 547584132f387ed8db873c6bf86e023b94c3137e08c9a635424b17f62fc296e17681c3822539f4576b50fcdfb0a9a6fbe66678748a733e16b737ae665332da17
TLSH
T18661A65A13621BF2E7755EFE63E5924B327D4C7D070B6F40408CA2F5D80B7A9A4171A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a54e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a54e.TMP
Size 3KB
SHA256 a65c54a80ac6aff86d0a5eec82be7ded8aa425f9306e99f7d46225b67fa4c4a4
MD5 c58d31851deb59b816902a18b85adb60
SHA1 5399eff4d5e36e4809147c4a15b68b4a5ab33f74
SHA512 0790182f7e38c58e880181ff0f992e4f6432f45522ebf9dd0f34b50dc4b155fb8228c6158e386658e8bc489ced869877b3f72177fe4baa209e9917a9733c290a
TLSH
T1D561D65A13621BF2EB755EFE63E1824B327D8C7C070B6F40408C62F9D80B7A9A4170A2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2290106edc8f877b1e542eaf1644e6e5208e27303a8c2751d8e4f4ac556d963a
MD5 dc2f43918af1977946e3d52c6d25cfe4
SHA1 42e5894347fb2bd2d2bf8edcc1df307a30c2aa1c
SHA512 9c821132d4983b5e471b0fdaba1a5d4b8866636d399a9888c37bbf2d1910a49c4fa0864231d14fb7888b88518b968d885730b93f3af16a0eaf084e62c47ee0b8
TLSH
T1E5218CF3C3E4856ECA1156F0AA28BE2BCE1D0501432C3D5ACAE4EF5BA3E2475E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 71eaac962c263373757f79fd82bdbff9aff9e50b2e1e1cef3a68a76a0c603871
MD5 65c482f3430633aa38e4764af3c564af
SHA1 ce39f242e39dba0cf1ce3c90346596aeb9627a42
SHA512 e8b177338e67cbbb3385df3a20ce6c960a95fa55524d278669092246ad7ae0154fadc6213d0ef277134c3c635bbb865d471e59ab115faa554aca2dbe6613e96e
SSDEEP 192:sxRFR4iyM/jK1Ml8wCb/f5sCXIZf6zoA8pi/g6+WNIYxvJcGcIgtJ:sxRFZ8b/f5sCX2vi/5I4I3
TLSH
T12252E9166A24993BCCDBD20DFA557F93DAF81573A2901E44AAFC8B0C05E66DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f1f15c984c2309be46810721b516ce06cc23587adf27fbcca6919a97b4b43cb7
MD5 ec3fe7d955a52d49c8ed3bad4e971825
SHA1 f00dd5a7defed761c81b204e712d9548044efcc0
SHA512 aaf90419fbcdf8bc2468672d8bb09dad59220510b3693c7efa776da1778828ec9b749a87da5cf0b0e2808320a224052fea47ab41482fdc5aff5f3e81ada26392
SSDEEP 192:sxRmR4iyM/jK1Ml8wCb/f5sOXIZf6zoA8pi/g6+WNIYxvJcGcIgDCJ:sxRmZ8b/f5sOX2vi/5I4I6
TLSH
T1B152E916AA34593BCCDBD20DFA557F93DAF81573A2901E44AAFC8B0C05E66DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51e5c04b79836166055a2aa5a4cb9ebe8ad53c23dfeb68cb31c5c38179e3229a
MD5 48c04ae86a092d068be7feb7aac2c8ca
SHA1 40703ebf4edde0db212a577aac4ba4c6bfe2cc9a
SHA512 978521d6aab016f54aca1320feb5988ebb0714722d1655c59d76e9c5079ed4323784670e3787dc38d0195a3dea2846f1ccb74b0e3f6aec339e7dc159b5e31a7d
SSDEEP 192:sxRmR4iyM/jK1Ml8UQOCb/f5sOvIZfOzoA8pr//g6+WNIYx6JcGcIgD0J:sxRmZq5b/f5sOv27z/5IxIE
TLSH
T1C362EA16AA34593BDCDBD20DFA557F93EAF81473A1901E44AAFC8B0C01E66DD225381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b391398fe2ab8511f4625c6df2940cbdc6b36598056d08e4c25c2124eec5ba72
MD5 ccfd88b824ea2d8fb85c527db55ea45f
SHA1 292c4b0904f97457dc2d15d3a0e6446b70ea0d29
SHA512 4e050e29fb54c254f3f19b2dc7d52884cef8e27ae0da3a4aa32f0a134ba6a93405a115b3086ee0318554f7c8245ade863969005d5c3a9d7dae1ab7ebcef992b3
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVDmHrVAMroJqvdW:0xCyDQE7ijWgbrfM1u1jaomHpAXJqpa
TLSH
T10BE2EC7B680CCB7F4F404A9DEC297EDEADE802CB96D8C95447EA480C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 79284facc27e0cad598c1db9f4260b5966fd71922989d4144a872ed5ec52e431
MD5 8d80cad1533c7a2ba63a30e23e209d0b
SHA1 157b0f6ec0ee008f89f8976440dc9c147ded4869
SHA512 4b89e4d425b871423f6298548ac4ca197b1ed4aa4e28ebb6f5a4551c816008225ee82d0d067cd467cfd27cfb7b7337b32d2abc2155c638ea48223a549c504c76
SSDEEP 768:arv+4UNbdl3EPkKL2GjF669yrqUjWiIwwxMRP1Uiler:absbX3bOjF66INWZTMV1UsQ
TLSH
T1E703CE70AC589AB7CCF2D68672433783BFB4109396C50B88CACD270D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4410e8dc98705074e7c49163d1b3a97ab780213bd322e3d6c2bea813db2bda8f
MD5 0d6ce86b6ae9acf4135e4404245059ec
SHA1 f37f91880ba309d14d39841e50e493386e5a1c1e
SHA512 cd86bcb8dea7e78d3d325cf286d073e5b95356af614556ecd0e53e7d26ccdd5e1dd29d313b2acd8a7f88ffa321eeac3efeae71a97fd076e7c4876b52e96f4500
SSDEEP 768:orv+4UNbd33V9XkKL26jF669yrqUjWiIwwxMtPUileX:obsbV3QSjF66INWZTMdUsQ
TLSH
T1B513CF70AC589AB3CDF6D646B24377C3BFB4209385C00F98CAD9570D468B5D92B4B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f9b1595f2a3827510c5c2b61fe165212ab3d3fd30934bb58de8406b62518f7a4
MD5 286ef202ddaf5b3e8f642a459bd32ed7
SHA1 470c24ed75df70c6cf9b63e9509d719b7c43395b
SHA512 4f52638dd8e102612268ae8f40cbb8aefdbbbc9b8c7f2cfa1c4756adc5c24ee5ed72dd51026d7e8eaefb4430f9c4f998354413a9b1df70eabe5e510d84de26d6
SSDEEP 768:4F1j+9b35wgOYO/nF669yrqUjWiIwwxMtPb9MV:19b3MnF66INWZTMdb+V
TLSH
T173038C75E855DBBBDDF2CB82B3023786EEE011A786C84EC8DAC99E0D01871DD1747825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 08694849cfae7a7b04dc406d9325804c31d49d9396f12bd86c1ef45c0fc28e44
MD5 ad37aeb02c5d556dfcc525e8cde5dbc0
SHA1 663393958dec75a3039a26aecb1439cc765128d9
SHA512 96c3d05c4212b86dfd578ef0b1d058e87cbd22da6e1aba6e0a9628a3881dd9b1b8b2c01b07e97b8a498a45d3078c79fb84495ce2854e1c908370a153467ebc13
SSDEEP 768:Vj+9h3YYXkKL2yjF669yrqUjWiIwwxMtPb9MV:g9h3MajF66INWZTMdb+V
TLSH
T131F2AE70AC555FB7C8E6DB85B21337C6EEB011E782C40E8CDADD9B0D06875DC168742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

17c7306f-6d63-4fe6-a9ed-a321f4dcedb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\17c7306f-6d63-4fe6-a9ed-a321f4dcedb1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_1548675450\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c8fa7e0344700f561fbd431820bf5185b065a0b544132ed89ada39cb2dc5269f
MD5 c750b84e47b525de76968e85f12fca1a
SHA1 022357741d91a7283a6a1a42057102b9a95728b9
SHA512 32483281d02d3f741fd039baed26617784a50f77e81da0da16ee59c5952d8676d7ef962805690209caf20a8718023c8697e88dd78e5bfafb9e491605afb7a5f3
TLSH
T19671238357B9C5B3C5DE5FF502835648F5FF22380B2330350BA15546AB30A3A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/788-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/788-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/940-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1092-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1136-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3424-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3708-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3708-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-226-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4292-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4580-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4672-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5052-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5432-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5484-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5696-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6080-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download