systex | 893d536025014b23b28f0011c2892e358294935063c52875a4372d680323a194

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260716-btff3sas7q
SHA256 893d536025014b23b28f0011c2892e358294935063c52875a4372d680323a194
MD5 cb5a64e73909eb25c04bdb21313343a0
SHA1 d5ea0d1ec8049e39fec491c040ca5a4e02214530
SHA512 e20a31fe3eebdeaa9f72da385f76afe1c75d01c77ec1bc8d4951432be5f98c1562ab61496033b75afc659505d5b4f4200beca148ca91dedebbdf91f55109f541
SSDEEP 3072:eViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3804	spkicamkecxupnhf.exe
2884	spkicamkecxupnhf.sys
4532	CreateProcess.exe
1696	pkhcausjhf.exe
2500	CreateProcess.exe
4724	CreateProcess.exe
476	i_pkhcausjhf.exe
2144	smkecwuomh.sys
4384	CreateProcess.exe
4764	zwrpjhbzuo.exe
1436	CreateProcess.exe
4160	CreateProcess.exe
4088	i_zwrpjhbzuo.exe
4664	zwrmjecwuo.sys
1720	CreateProcess.exe
4224	wrpjhbztrm.exe
6088	CreateProcess.exe
3388	CreateProcess.exe
5772	i_wrpjhbztrm.exe
4684	omgeywtomj.sys
796	CreateProcess.exe
3716	lgdywqojgb.exe
4184	CreateProcess.exe
3848	CreateProcess.exe
2600	i_lgdywqojgb.exe
6048	ywqnljdbvt.sys
3256	CreateProcess.exe
4308	ytqljdbvtn.exe
3216	CreateProcess.exe
3028	CreateProcess.exe
2060	i_ytqljdbvtn.exe
4088	ysqlidbvsq.sys
5228	CreateProcess.exe
1144	kidaysqkfd.exe
2448	CreateProcess.exe
3384	CreateProcess.exe
5308	i_kidaysqkfd.exe
3096	nlfdxvtnlf.sys
5816	CreateProcess.exe
4228	lfdavtnlfd.exe
5664	CreateProcess.exe
876	CreateProcess.exe
4084	i_lfdavtnlfd.exe
3700	hfdxvpnhfd.sys
3836	CreateProcess.exe
2280	icausmkfcx.exe
5096	CreateProcess.exe
4948	CreateProcess.exe
5596	i_icausmkfcx.exe
1888	zxupnkecau.sys
4728	CreateProcess.exe
3508	xusmkeczxr.exe
1128	CreateProcess.exe
4548	CreateProcess.exe
5572	i_xusmkeczxr.exe
2332	hcausmkecx.sys
2440	CreateProcess.exe
3700	urpjhcwurm.exe
1308	CreateProcess.exe
476	CreateProcess.exe
4120	i_urpjhcwurm.exe
5024	zwrpjhbzwu.sys
1516	CreateProcess.exe
1888	zwuomkebzt.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_307181291\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_867853647\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_867853647\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_993387953\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_1354866893\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_307181291\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_867853647\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_867853647\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_1354866893\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_1237016991\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_1237016991\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_307181291\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3392_307181291\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbzuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomkebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhcwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicamkecxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhcwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomkebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidaysqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbzuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidaysqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5776	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1780	ipconfig.exe
916	ipconfig.exe
2604	ipconfig.exe
6048	ipconfig.exe
3868	ipconfig.exe
3152	ipconfig.exe
2600	ipconfig.exe
5356	ipconfig.exe
3948	ipconfig.exe
3360	ipconfig.exe
5592	ipconfig.exe
6052	ipconfig.exe
1916	ipconfig.exe
5592	ipconfig.exe
3948	ipconfig.exe
3616	ipconfig.exe
3944	ipconfig.exe
5888	ipconfig.exe
5352	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286387668731046"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{C68A7161-6E1F-46AD-98CD-EA588C3EE5CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe
3804	spkicamkecxupnhf.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	i_pkhcausjhf.exe
Token: SeDebugPrivilege	4088	i_zwrpjhbzuo.exe
Token: SeDebugPrivilege	5772	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	2600	i_lgdywqojgb.exe
Token: SeDebugPrivilege	2060	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	5308	i_kidaysqkfd.exe
Token: SeDebugPrivilege	4084	i_lfdavtnlfd.exe
Token: SeDebugPrivilege	5596	i_icausmkfcx.exe
Token: SeDebugPrivilege	5572	i_xusmkeczxr.exe
Token: SeDebugPrivilege	4120	i_urpjhcwurm.exe
Token: SeDebugPrivilege	5524	i_zwuomkebzt.exe
Token: SeDebugPrivilege	4084	i_jgebwtomge.exe
Token: SeDebugPrivilege	4280	i_ljdbvtolge.exe
Token: SeDebugPrivilege	2332	i_avtnlidbvt.exe
Token: SeDebugPrivilege	1780	i_ayvqnligay.exe
Token: SeDebugPrivilege	2876	i_faxvpnifay.exe
Token: SeDebugPrivilege	2948	i_smkecxupnh.exe
Token: SeDebugPrivilege	5416	i_mkeczurpjh.exe
Token: SeDebugPrivilege	2520	i_wupmhezxrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 3804	3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3376 wrote to memory of 800	3376	2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 800 wrote to memory of 3392	800	iexplore.exe	89
PID 3392 wrote to memory of 4488	3392	msedge.exe	90
PID 3392 wrote to memory of 1688	3392	msedge.exe	92
PID 3392 wrote to memory of 5776	3392	msedge.exe	93
PID 3392 wrote to memory of 1688	3392	msedge.exe	92
PID 3392 wrote to memory of 1688	3392	msedge.exe	92
PID 3392 wrote to memory of 5132	3392	msedge.exe	94
PID 3392 wrote to memory of 5132	3392	msedge.exe	94
PID 3392 wrote to memory of 6120	3392	msedge.exe	95
PID 3392 wrote to memory of 6120	3392	msedge.exe	95
PID 3392 wrote to memory of 6120	3392	msedge.exe	95
PID 3392 wrote to memory of 2424	3392	msedge.exe	96
PID 3392 wrote to memory of 2424	3392	msedge.exe	96
PID 3392 wrote to memory of 2424	3392	msedge.exe	96
PID 3392 wrote to memory of 52	3392	msedge.exe	97
PID 3392 wrote to memory of 52	3392	msedge.exe	97
PID 3392 wrote to memory of 52	3392	msedge.exe	97
PID 3392 wrote to memory of 256	3392	msedge.exe	98
PID 3392 wrote to memory of 256	3392	msedge.exe	98
PID 3392 wrote to memory of 256	3392	msedge.exe	98
PID 3392 wrote to memory of 4764	3392	msedge.exe	100
PID 3392 wrote to memory of 4764	3392	msedge.exe	100
PID 3804 wrote to memory of 4532	3804	spkicamkecxupnhf.exe	103
PID 3392 wrote to memory of 2764	3392	msedge.exe	105
PID 3392 wrote to memory of 916	3392	msedge.exe	106
PID 3392 wrote to memory of 2764	3392	msedge.exe	105
PID 3392 wrote to memory of 916	3392	msedge.exe	106
PID 1696 wrote to memory of 2500	1696	pkhcausjhf.exe	108
PID 3392 wrote to memory of 2524	3392	msedge.exe	112
PID 3392 wrote to memory of 4364	3392	msedge.exe	113
PID 3392 wrote to memory of 4364	3392	msedge.exe	113
PID 3392 wrote to memory of 4228	3392	msedge.exe	116
PID 3392 wrote to memory of 4228	3392	msedge.exe	116
PID 3804 wrote to memory of 4724	3804	spkicamkecxupnhf.exe	117
PID 3804 wrote to memory of 4384	3804	spkicamkecxupnhf.exe	121
PID 4764 wrote to memory of 1436	4764	zwrpjhbzuo.exe	123
PID 3804 wrote to memory of 4160	3804	spkicamkecxupnhf.exe	126
PID 3804 wrote to memory of 1720	3804	spkicamkecxupnhf.exe	130
PID 4224 wrote to memory of 6088	4224	wrpjhbztrm.exe	132
PID 3804 wrote to memory of 3388	3804	spkicamkecxupnhf.exe	135
PID 3804 wrote to memory of 796	3804	spkicamkecxupnhf.exe	140
PID 3716 wrote to memory of 4184	3716	lgdywqojgb.exe	142
PID 3804 wrote to memory of 3848	3804	spkicamkecxupnhf.exe	145
PID 3392 wrote to memory of 1532	3392	msedge.exe	147
PID 3392 wrote to memory of 3700	3392	msedge.exe	148
PID 3392 wrote to memory of 4120	3392	msedge.exe	149
PID 3804 wrote to memory of 3256	3804	spkicamkecxupnhf.exe	152
PID 4308 wrote to memory of 3216	4308	ytqljdbvtn.exe	154
PID 3804 wrote to memory of 3028	3804	spkicamkecxupnhf.exe	157
PID 3804 wrote to memory of 5228	3804	spkicamkecxupnhf.exe	161
PID 1144 wrote to memory of 2448	1144	kidaysqkfd.exe	163
PID 3804 wrote to memory of 3384	3804	spkicamkecxupnhf.exe	166
PID 3804 wrote to memory of 5816	3804	spkicamkecxupnhf.exe	170
PID 4228 wrote to memory of 5664	4228	lfdavtnlfd.exe	172
PID 3804 wrote to memory of 876	3804	spkicamkecxupnhf.exe	175
PID 3804 wrote to memory of 3836	3804	spkicamkecxupnhf.exe	179
PID 2280 wrote to memory of 5096	2280	icausmkfcx.exe	181
PID 3804 wrote to memory of 4948	3804	spkicamkecxupnhf.exe	184
PID 3392 wrote to memory of 5652	3392	msedge.exe	186
PID 3392 wrote to memory of 5652	3392	msedge.exe	186
PID 3804 wrote to memory of 4728	3804	spkicamkecxupnhf.exe	192
PID 3508 wrote to memory of 1128	3508	xusmkeczxr.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_cb5a64e73909eb25c04bdb21313343a0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Temp\spkicamkecxupnhf.exe
  C:\Temp\spkicamkecxupnhf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcausjhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4532
  - - C:\Temp\pkhcausjhf.exe
      C:\Temp\pkhcausjhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcausjhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4724
  - - C:\Temp\i_pkhcausjhf.exe
      C:\Temp\i_pkhcausjhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhbzuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4384
  - - C:\Temp\zwrpjhbzuo.exe
      C:\Temp\zwrpjhbzuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbzuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_zwrpjhbzuo.exe
      C:\Temp\i_zwrpjhbzuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\wrpjhbztrm.exe
      C:\Temp\wrpjhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3388
  - - C:\Temp\i_wrpjhbztrm.exe
      C:\Temp\i_wrpjhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:796
  - - C:\Temp\lgdywqojgb.exe
      C:\Temp\lgdywqojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3848
  - - C:\Temp\i_lgdywqojgb.exe
      C:\Temp\i_lgdywqojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3256
  - - C:\Temp\ytqljdbvtn.exe
      C:\Temp\ytqljdbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\i_ytqljdbvtn.exe
      C:\Temp\i_ytqljdbvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidaysqkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5228
  - - C:\Temp\kidaysqkfd.exe
      C:\Temp\kidaysqkfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidaysqkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3384
  - - C:\Temp\i_kidaysqkfd.exe
      C:\Temp\i_kidaysqkfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\lfdavtnlfd.exe
      C:\Temp\lfdavtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:876
  - - C:\Temp\i_lfdavtnlfd.exe
      C:\Temp\i_lfdavtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3836
  - - C:\Temp\icausmkfcx.exe
      C:\Temp\icausmkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\i_icausmkfcx.exe
      C:\Temp\i_icausmkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkeczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Temp\xusmkeczxr.exe
      C:\Temp\xusmkeczxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkeczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\i_xusmkeczxr.exe
      C:\Temp\i_xusmkeczxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhcwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2440
  - - C:\Temp\urpjhcwurm.exe
      C:\Temp\urpjhcwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhcwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:476
  - - C:\Temp\i_urpjhcwurm.exe
      C:\Temp\i_urpjhcwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomkebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1516
  - - C:\Temp\zwuomkebzt.exe
      C:\Temp\zwuomkebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomkebzt.exe ups_ins
    3⤵
    PID:3320
  - - C:\Temp\i_zwuomkebzt.exe
      C:\Temp\i_zwuomkebzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebwtomge.exe ups_run
    3⤵
    PID:5224
  - - C:\Temp\jgebwtomge.exe
      C:\Temp\jgebwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebwtomge.exe ups_ins
    3⤵
    PID:1180
  - - C:\Temp\i_jgebwtomge.exe
      C:\Temp\i_jgebwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    PID:1388
  - - C:\Temp\ljdbvtolge.exe
      C:\Temp\ljdbvtolge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    PID:3424
  - - C:\Temp\i_ljdbvtolge.exe
      C:\Temp\i_ljdbvtolge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avtnlidbvt.exe ups_run
    3⤵
    PID:4644
  - - C:\Temp\avtnlidbvt.exe
      C:\Temp\avtnlidbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avtnlidbvt.exe ups_ins
    3⤵
    PID:2348
  - - C:\Temp\i_avtnlidbvt.exe
      C:\Temp\i_avtnlidbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnligay.exe ups_run
    3⤵
    PID:1204
  - - C:\Temp\ayvqnligay.exe
      C:\Temp\ayvqnligay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnligay.exe ups_ins
    3⤵
    PID:5800
  - - C:\Temp\i_ayvqnligay.exe
      C:\Temp\i_ayvqnligay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvpnifay.exe ups_run
    3⤵
    PID:2784
  - - C:\Temp\faxvpnifay.exe
      C:\Temp\faxvpnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvpnifay.exe ups_ins
    3⤵
    PID:4484
  - - C:\Temp\i_faxvpnifay.exe
      C:\Temp\i_faxvpnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run
    3⤵
    PID:2880
  - - C:\Temp\smkecxupnh.exe
      C:\Temp\smkecxupnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    PID:2912
  - - C:\Temp\i_smkecxupnh.exe
      C:\Temp\i_smkecxupnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurpjh.exe ups_run
    3⤵
    PID:2392
  - - C:\Temp\mkeczurpjh.exe
      C:\Temp\mkeczurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurpjh.exe ups_ins
    3⤵
    PID:4116
  - - C:\Temp\i_mkeczurpjh.exe
      C:\Temp\i_mkeczurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhezxrp.exe ups_run
    3⤵
    PID:4364
  - - C:\Temp\wupmhezxrp.exe
      C:\Temp\wupmhezxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhezxrp.exe ups_ins
    3⤵
    PID:4616
  - - C:\Temp\i_wupmhezxrp.exe
      C:\Temp\i_wupmhezxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb44b3c188,0x7ffb44b3c194,0x7ffb44b3c1a0
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,6760974154137886606,9884998514030538700,262144 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,7297959875150632197,9689297519185706531,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,14233838112582145377,14225716747285872521,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,1723219420759443849,14652803325237773543,2097152 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,10980535487316071748,3887048896145375572,2097152 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,6619710738108116241,13157517294148118323,2097152 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
      4⤵
      PID:52
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,3481760051863887237,10589533958049697899,2097152 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,12094661359844603922,17896623783261699999,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14774113267753561299,10145505119106490393,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,3805758813135423182,8040005638620257616,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9586837095689739491,14264493305053916416,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9586837095689739491,14264493305053916416,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14935268349386432836,14535961563231693725,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3538746032169776516,17529009015728065705,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,14984756400291078321,8105847728874231317,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16922728477186988317,691716343661812623,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9502977867229088735,661007667730822073,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,7239335857845268028,8635523146386526974,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12266921450267937115,6440376573081241698,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,338268790496943500,6649385856699892534,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,3211557052003022203,16309767074376589607,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11518729845587812200,17882365957520505234,262144 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,10228770482164938335,13805148350799877831,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,16064853222341154549,14633109199484973307,524288 --field-trial-handle=2484,i,2177988356039498869,12829122656652169039,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2912

C:\Temp\spkicamkecxupnhf.sys
C:\Temp\spkicamkecxupnhf.sys
1⤵
- Executes dropped EXE
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5764

C:\Temp\smkecwuomh.sys
C:\Temp\smkecwuomh.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\zwrmjecwuo.sys
C:\Temp\zwrmjecwuo.sys
1⤵
- Executes dropped EXE
PID:4664

C:\Temp\omgeywtomj.sys
C:\Temp\omgeywtomj.sys
1⤵
- Executes dropped EXE
PID:4684

C:\Temp\ywqnljdbvt.sys
C:\Temp\ywqnljdbvt.sys
1⤵
- Executes dropped EXE
PID:6048

C:\Temp\ysqlidbvsq.sys
C:\Temp\ysqlidbvsq.sys
1⤵
- Executes dropped EXE
PID:4088

C:\Temp\nlfdxvtnlf.sys
C:\Temp\nlfdxvtnlf.sys
1⤵
- Executes dropped EXE
PID:3096

C:\Temp\hfdxvpnhfd.sys
C:\Temp\hfdxvpnhfd.sys
1⤵
- Executes dropped EXE
PID:3700

C:\Temp\zxupnkecau.sys
C:\Temp\zxupnkecau.sys
1⤵
- Executes dropped EXE
PID:1888

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:2332

C:\Temp\zwrpjhbzwu.sys
C:\Temp\zwrpjhbzwu.sys
1⤵
- Executes dropped EXE
PID:5024

C:\Temp\gebztromjd.sys
C:\Temp\gebztromjd.sys
1⤵
PID:4912

C:\Temp\ztrojytrlj.sys
C:\Temp\ztrojytrlj.sys
1⤵
PID:4128

C:\Temp\vqolgdywqo.sys
C:\Temp\vqolgdywqo.sys
1⤵
PID:5472

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:2472

C:\Temp\faysqkifay.sys
C:\Temp\faysqkifay.sys
1⤵
PID:5992

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
PID:2800

C:\Temp\pnhfzxuspj.sys
C:\Temp\pnhfzxuspj.sys
1⤵
PID:2676

C:\Temp\wupmhezwrp.sys
C:\Temp\wupmhezwrp.sys
1⤵
PID:5984

C:\Temp\ztrljgeywr.sys
C:\Temp\ztrljgeywr.sys
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i_lgdywqojgb.exe

Path C:\Temp\i_lgdywqojgb.exe
Size 376KB
SHA256 924e85ba8d6a6a02357263310bcfba5ca00a679dfd357d4eaa632406bc0e04e3
MD5 eb93dbc1f874b720aa68aeeb02cea1e3
SHA1 b1c5acaae78cfbede857f939ccb09e2baa007303
SHA512 b0d46c38c1dec9d40236c23484f6aab5b4528c0e5a4ade6c75a9e7818c167e664654ce139ddb9e88982776ffe8c7d17e908bdf79bc0994e8dfe1c73031bf2c4b
SSDEEP 3072:WViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcausjhf.exe

Path C:\Temp\i_pkhcausjhf.exe
Size 376KB
SHA256 11435669d4fbdcdddc55b3593b09c1ec0ddfddb25a3727a7524097faf7e7c808
MD5 2b60993f45afb9af248a9e8aba42c970
SHA1 befb3c81e1c0258604a8d096348e9ca3172ab801
SHA512 2450468eb523f9bcf266eeda96e954e558cfd4357bcd866b7ac42959da30e45078372024240cc8ae74b9e68c7a6e76fe081fe91c6752fc13c8ec471e369516da
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbztrm.exe

Path C:\Temp\i_wrpjhbztrm.exe
Size 376KB
SHA256 0c5263d352e1164a83079959a9e54f80b99169c0eaa13cf51dd1217b5bb4db93
MD5 024fbfb3884aa6665bffc90d35999a32
SHA1 c9e266a927e57907546bd658445f8bba2e9faf41
SHA512 9ec668d05ef4028c25d4cd9c3d4c884387039aacb4eb1d800ac7fc6664d6d2ea4fdb4d5e741309aee662c02992148a18cc3bf98f95789c62e685322e71e3e034
SSDEEP 3072:QViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqljdbvtn.exe

Path C:\Temp\i_ytqljdbvtn.exe
Size 376KB
SHA256 e9803ea58d11106bf7262b80b1c1bccd34ee33a18c31ba99ab7182cfd410ac66
MD5 8fdeac2e9293b17d853a7bf0c99597d9
SHA1 e6064ae185e5c5620f241fc83813cbef67ab8042
SHA512 49629db40ce0a7328e21c4df471d41796f73574890036338524ae357abd41a30ad453517045a879d00568300865f89fe2a8e76ad125bacc5a2ec1e1f02342097
SSDEEP 3072:rViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T121847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjhbzuo.exe

Path C:\Temp\i_zwrpjhbzuo.exe
Size 376KB
SHA256 8a040c19a3130d083dd26f69770a6745fc0e119f0de3886bc58548f69f856bdd
MD5 ad8c1bed11995baad30d9de3c8213f16
SHA1 e6c693118af77be3349490479aaac8114480bcd3
SHA512 97b8ea28d62dbd8c3abb7a9dcd29dca54180cf98bdcac5079377dd124f4ead0c31ce79c7892b9133c865c2fcfc7559e26821604f47c3cb63eecacf4a380e0d94
SSDEEP 3072:8ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidaysqkfd.exe

Path C:\Temp\kidaysqkfd.exe
Size 376KB
SHA256 caa01fdf8c67c3c66075d37b0ece0dce48777ffbbd64fa01bca75b4b58911b0c
MD5 c7c74395925d797ef21166f10089ec08
SHA1 0751cfffac6d984305245f5d4e4829d21f9d5a45
SHA512 a9bef3b35ac2f305665392cbc953cb34b6aa4f312d6abfae690ce6463f483d55f899f598a153a6383ef6dbb91e4173e1e60e6d431655c9c7ea5543a7a21f2063
SSDEEP 3072:FViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqojgb.exe

Path C:\Temp\lgdywqojgb.exe
Size 376KB
SHA256 7c20d186a5ca7aa785ff41a720facda09768b09f2bc5952bcfc9cd4acab75494
MD5 feae39ae26b2aae10e9836470595c8ef
SHA1 6161aeb42e6ccddfdc46aaac6f8fc9eb74f6b01d
SHA512 271abc50560e02c1e16ecc15498a946bc2f0898aaf080df2daf2c25ab515a28c1ab872b0c2f73b7296ed3c474e4ed05c1156111ea1adc7faa7fe5df6a50ba695
SSDEEP 3072:YViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywtomj.sys

Path C:\Temp\omgeywtomj.sys
Size 293KB
SHA256 d5f3effff2415c0fa161d18c17a1b5f9628446dd54f17a1ab28b8b3e9c03113d
MD5 e790d65bee33ebb6e2fa4e06cae436cc
SHA1 d0fb1178747b1bd0a5224783722e1304710458af
SHA512 04d1bef9984289ef6f02cd36d8df1835cb6f50b396786b75ea4b94df059dda9c7e67bb39359bea60964c32da29c48ad1fd6012385cb1b44f07eefd13f202e7b2
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausjhf.exe

Path C:\Temp\pkhcausjhf.exe
Size 376KB
SHA256 ef125f48db60402d2407d7435b3605cf76933635e03a5bceca0e7d338bf40deb
MD5 2409235d1fd8cd3a709a76a194fe90f3
SHA1 911f9c2f606781302856086a02026500a98802f9
SHA512 1ca1863a8c293fbae5640bc13ddc9311bd44609fbb2dd3216ce6a79846c448d15a7f5ee73121294d8c2fd599bf10b409a64e588e11b6beb428c20335651167cc
SSDEEP 3072:BViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwuomh.sys

Path C:\Temp\smkecwuomh.sys
Size 293KB
SHA256 ac4509f3229dcca7e8a2a8013a4c97fbe0787c7a3c75dd2cc4b36dda2c2b2fbb
MD5 388c88abe284dbb6d18cf89cddddc574
SHA1 3f7c6849d1544f5d0f22b211614dda107c557fff
SHA512 0b4a87a5e98f5689f22349147fb27f5dc7ee91e71610247d2fe0da78336b8c8101c9d453a02d637280f0dc764f71931b3efbfe11b8f889d384d8525de2e3d27b
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicamkecxupnhf.exe

Path C:\Temp\spkicamkecxupnhf.exe
Size 376KB
SHA256 ba8ac07e5e68c009ff4c0746fbb42d928007816f4541f4484c98650e8978515e
MD5 4dbc32b0bed6a68b760344dfd2cbbfc1
SHA1 ede91da3cd86f3b0f3b24bd2390379065efb508a
SHA512 22dd72812168f7c3c6c59c2074fb2948907c0173f7846370839fba2a1eb8297f49aabbd5a5896829cde3f28868778e2d23897712fc657e93b0a155e68d19ee52
SSDEEP 3072:2ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicamkecxupnhf.sys

Path C:\Temp\spkicamkecxupnhf.sys
Size 293KB
SHA256 6b37bf0cdfc315926f2c703de7642acd3afaafbf5f70d975864b09dfff58e84c
MD5 c1a88d1119638afac699aeb46653d094
SHA1 19918cde15f83819aae2b3cc3352abd560a93d0b
SHA512 e30cb1ef9d3e5a36798f648499c2661498e2456eafff1874ee10650a57a7ded175d1ba964e60bd6732e60e80aa1aefb81f030fb5ea79cab5725bfa3488447ad2
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 376KB
SHA256 d2356b98e421beb4dc73b69ee4b8d0b2e402313b5902409bcb6bc9e319d30d97
MD5 567ec34d0889e53c4f0587b5fe589b86
SHA1 3925e81fa7f2a47373da7e9a3c1513db3e7f3097
SHA512 c6ed78e390183b4f185b22f15b35a105bc388fe2e8cbdc5bef786a24c5679f0a0f50881c7a5d51b22d59f3fd4fb3c064ea5255f5ca8dced50f27b8081538ea1f
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvsq.sys

Path C:\Temp\ysqlidbvsq.sys
Size 293KB
SHA256 90db383ad524c8204907816379c3b8e3dde65f61b3adc69cc379486cf6dbd77b
MD5 625f2b1e8b851b79473e72cfd4941a8c
SHA1 aad02ab5abab14ac35dc0cb9e7f983af0b897511
SHA512 c2b7f13c1401a7ad194cdb65138ba2957863c414e7997eca402931037d890c4edc8d55faafee18bf91f6fe162744e816d223381cb2dc2ff8b1d6210d379146eb
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T106545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtn.exe

Path C:\Temp\ytqljdbvtn.exe
Size 376KB
SHA256 9c6be8217cb727d89f461f426c37cd5bf159b6e5bfbe95f42a07fdea6797ccb1
MD5 1e203b1a28a311a01191b24db50b00fc
SHA1 5bb0ced31dbe453c464f9651933635aefa16fcce
SHA512 1d23ef0724d76db19edce73c7297f99de3768fe366863c3a6757d036a05145b1dc5a94d9b939a42312e9bc546329fad83b56c4d78237f2bea4290d0bd6b3d80b
SSDEEP 3072:HViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqnljdbvt.sys

Path C:\Temp\ywqnljdbvt.sys
Size 293KB
SHA256 e514abf0407ed193fd9d79952a9774f8895bfd5660af955342a812a3f68d49ba
MD5 e0dd55f5830ee022bae84f340f5095dd
SHA1 988f439765cbdf9e9205f8733e6f2eccb3071b64
SHA512 3f0b1c0fd058b428e965cf4ce405bf2000fc321c8773db5c7c5c65dca09fcb59f1c186cb75a1ec0a0c9f13aaf353bc46179cdc2bc24111d54fb11007cd54d67d
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T187545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrmjecwuo.sys

Path C:\Temp\zwrmjecwuo.sys
Size 293KB
SHA256 eb403fdece1e491dd55455e1904196198b998857a8ff07a152ef250bf867c313
MD5 3f39c511137f7c9d404338b59515de84
SHA1 edf8bdc572f16a095a9b44a60b55525e1cf2204b
SHA512 e6eed7c9937be1385e1d574fb46bc827f22ebace8acf5edc51704d8a28b971b211a44b3b3b57660d6617e7bd7a56c9229becf2016c04fa57654bd1b55160b710
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbzuo.exe

Path C:\Temp\zwrpjhbzuo.exe
Size 376KB
SHA256 ee6e8cb32399aa4ecb2775b24caccc00436bad8b2616e6a215aa04e04639d186
MD5 e3d85866d3a05a27b74ea47cf71c9964
SHA1 7789bb830dca20e512c6c04cde1ba99bd1112bdb
SHA512 b919154d9ac84f727009100bb5b8c0cc0e6e45bc0c0523e0cd5c4fd773eada9d175456d8ca10c60719682f8cec017573b4013476a8323eaf551f5b940823e46b
SSDEEP 3072:kViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

6106b643-9cd5-4962-9dd3-b8f4c7a9ef17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6106b643-9cd5-4962-9dd3-b8f4c7a9ef17.tmp
Size 14KB
SHA256 aa62e012d556fe0d2039419b4b8895771bef14202833cc2d43fb3e8e5a087d99
MD5 6b75f4109656f8368670837b48947887
SHA1 15825453caf4a0c2136cd71e91b416a15913a2e3
SHA512 46fa65fb9b09dc81c118f1819bb9e0ccf6d267d3aa970f453952042935d003cbb9153e1002aa0ab5066c6da6c80b92c8ace39eb3cd4374f0f8784e0bc68b6387
SSDEEP 192:sxRJRYyM/jK1Ml8UQhCl/fOs8u56mrZIIzoA8prL/g6+WNChH/YxyJXG1IgD7J:sxRJOq4l/fOsb56mFqv/58/3Ex
TLSH
T19062E916AA245D77DCDBD20DFA917F93D6F85573A2940E44AAFC8B0C00E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 729b255ea47c5a029b82f9113ed01b3edc8a72ff0cae4e327e841a3ba4ca5080
MD5 b4df7858352e4debe977417d8dd93f4b
SHA1 e5c8965ef3f1469b571efcb01ffaaf0553074a97
SHA512 ef66f80be9fb41b1ce334e64c92841bb7b18c87f1f26aee4ba912a83f0e4f90124f345c7cc8ef269374ab5281d5d9d2b921964b78d95fb9228f15491b95434ce
TLSH
T195613FA20F2E0BE3DF2F86B290F895D532BC8725C13B2E1153B564F5889A7186533938
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595951.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595951.TMP
Size 3KB
SHA256 41d1800bfd3f12053647dba53637a0fab5138d1a7c6b2522e4b551d6ae55857f
MD5 e7037da5c934d3218a8a56f87a8c8599
SHA1 51ecf09b67f61b4a388c432c07ed909482499bff
SHA512 a080877d6fd44b18ac5e057a050a46fa6bb5c7040b80fa53319fbdedd1273bc89747863b24ab35f144aa1ed508321625ac876c23f383c1a82d735a23ddb18950
TLSH
T170613FA20F2E0BE3CF2F86B290F895C932BC8765C13B2E1153B554F5889A3146533938
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1cb55bedc62a051818d53c8b582be6c15451f3054e361b8c2a07ee19fc351367
MD5 8dbd180e28492ae31c01e78e8a1dc55f
SHA1 81be9f0a859d0d471d4207eb5ed537775a17674a
SHA512 4db44f8f8b719ab50d22e0c71b0d3026adb7b6980ec957452799301d6d238c9d0e74aa40bcb20f0bcd861cd9e5f1f81c9a1363a9ee1521527aa325795c52c8ef
TLSH
T1FE217CF3C3E9856E890156F0AA28AE2BCE1D0A05832C3D5AC9D4EF5B93F2475D10185F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7a43ccf6f05e5edcf6d76955fd49c9a36504707ea291ea0f5b20a966d2aed751
MD5 990c1339320fac8a974252c9eb2c981e
SHA1 72709047cb302236568cd7727ec9b83ca75954a5
SHA512 31b39f0b33345179073cf20e0804ad82015d0c77ba7edbee728cf6f7085a2938abd1f43fc3ad60fb80a02afa5a0933f766513fddaf685634dbaaa50a62a3bc7c
SSDEEP 192:sxRSRYyM/jK1Ml8wCl/fOs9u56GrZIAzoA8pi/g6+WNIYxvJXG1IgtJ:sxRSW8l/fOsk56GFOi/5I4E3
TLSH
T1D752FA156A245977DCDBD20DFA517F93D6F81573A2901E44AAFC8B0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c01d3760fe12b971711502bea6277c4272370563acfab260e884f1d6a220059c
MD5 a9407d3c15e5e222e86be0a9f71411aa
SHA1 f1a14d749724cc9f77f285d66a95b59b444e4abf
SHA512 9f6e17ec26150d13a7375c99d3e8d1ab481ef303a889963fa1aea09a79c39a73cc06ae190792d170de8f5c0e9022caac0bc0ea58e6b79dfabb858f55a54cca44
SSDEEP 192:sxRJRYyM/jK1Ml8wCl/fOs8u56GrZIIzoA8p9L/g6+WNChH/YxiJXG1IgD5J:sxRJO8l/fOsb56GFq9/58/5EX
TLSH
T14062E916AA245977DCDBD20DFA517F93D6F81573E2900E44AAFC8B0C04E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b7e27cd51115d5e2dce7eccbfcf75ecbbeb4755c519566221e895f5d3236b90d
MD5 e03214c7b6f4d945b483352d5f5a1707
SHA1 273051fbb24b4d92eeccc34104a061e92b57a67e
SHA512 efd32b7ebc74ba48b9e07e4941fde17a98e246ca6a64d5b882c13594e600e1fed0b8350a246a4745dfd78e0af5f34a6d15246fa55454b8fa6a7b7185cb21bcff
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVDCHrVA2roJqNa2:0xCyDQE7ijWgbrfM1u1jaMCHpANJqM2
TLSH
T1F2E2DC7B680CCB7E4F404A9DEC297EDEADE802CF96D8C95447EA840C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3c73f32d6f7c7bb6d87b4e7220f701b46d9378b57c094e849778b7729b557d19
MD5 84c90fab306607088be23a65decbe4db
SHA1 5ea88d40d540942c67edf460d8421576f81fcd9e
SHA512 a9a78b56a8437fd708e5acbe0a11e76d05900b7414619f19fe1aad74ba0d5af3fbee6b6cd2f1d3ebd68123e1503bb6d5769428e9f8f1944dec21713b93f23f26
SSDEEP 96:Kb6fOqoEA8o0FnWy8KOpWg8qaql4ahlslgsiCSCo6jxW8CKOnWeCaG9yWosI4k0E:89lhdZ
TLSH
T113912865703B125038BE285D95A8CA56C6C1B063721EEA6B7BE804754F3BF028DFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32234a82-668b-4f20-869d-e74c04e2d6af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\32234a82-668b-4f20-869d-e74c04e2d6af.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a74aafeea71bb41eb480ee3434736aebff7874207cab4929ca45663e2d2300a3
MD5 5fb761cdab8ed664e1410a2f4aa3a049
SHA1 fd11130eb09be6055dab7b07fba112969bc8280d
SHA512 56f8e48fb8278349a8948c76cbff83c6c54a5e21d195eb427b966eb0507a75593a5eeb2edbdcebb074499d492cedc9b594a70ef4594b0ba0fdddea67625cd7f3
SSDEEP 768:0rv+4UNbdb3jnTkKL2sJjF669yrqUjWiIwwxMtTb9Mh:0bsbZ3jwQjF66INWZTMJb+h
TLSH
T1A913CF70B8689AB3C9F7D641B15337C7BFB420A786C40F88DAD9A70D4A4B4DD270B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 48b7fe405a58064963d646d6dbb28650a41e8b4cf99d24ebb023c268162f1296
MD5 8568fe378823f665f97a15ed14f991d5
SHA1 63af17348b9e8817eaf624b5d21146de316a4cc8
SHA512 17328dd739d7d2d456d3aa7c0bb52eddac5bfd2aafbed562a6c6bc94549014856d45e4b3d2c44bb63e8f4db9fb3a06cf3c265f7acdc1b209a154b8fb1cb6aa41
SSDEEP 768:arv+4UNbdl3JPkKL2skjF669yrqUjWiIwwxMR0Uiler:absbX3GDjF66INWZTM6UsQ
TLSH
T14F03CF34AC589AB7CCF2D28672437783BF74109396C50B98CADC670D869B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f9897b1204864085f68077a94af7a72f9f8e929cb1aef0591855fa2c96205413
MD5 0314458e2a1624a417af9bb793c14304
SHA1 8e0ffea72e4d3455414675020b20aa6568d0adaf
SHA512 f1616f3649776b3d2825d3afa7f6593039fe2e68b1333bfdc651b27654914ba57ec08556b20c40ed362e8235e69c5684e3ed577ff725513414a37c96903df114
SSDEEP 768:1j+913j6TkKL2sojF669yrqUjWiIwwxMtTb9MH:A913jhbjF66INWZTMJb+H
TLSH
T107F2AE70B8655EB3C8E6D785B21337CAEFB011A782C40F8CDAD9AB0D09875DC674742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dad94e34e7f45407a22a38dfbb73ca613382f2518d5f7dc3eb37e0241a8930c2
MD5 d450875a706025920d9c528f6f04789d
SHA1 6aa9413c6414ada02ad4a2ea4f49eef86c282fa2
SHA512 913e7748b499a52b05890305637e53ec5b94cab3e5e295719b7e94f8026679df4e05d8a836962627e65acbf330daa35ee916a68dc6b58d97b1f5e2bff1cb5b1a
SSDEEP 768:9j+91366TkKL2sojF669yrqUjWiIwwxMtTb9MH:49136hbjF66INWZTMJb+H
TLSH
T1B6F2AE70A8655EB3C8E6D795B21337CAEFB021A782C40F8CDADDAB0D09875DC6747429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 656fbb168d482e25fe930e88216d5a27eb47aafd3a6ee45709beadf2e4fd5b23
MD5 7f1b0ecd2d01d16fc4ecfbd661630032
SHA1 1de3b44b952cd7064fbe72eb9d789aafed291de4
SHA512 93a90321264aeab7f934aec1b7229929de5ed10cf9d2d1fa7dd9f1684b519419f2612970825ea56c4eec93327f75fbf240e0f04bc2c85af587cf15ffeb85a375
SSDEEP 768:XF1j+9W3jwgGpTabnF669yrqUjWiIwwxMtTb9MH:e9W3E4nF66INWZTMJb+H
TLSH
T18B1329F198D78A77C8AE8783633D2E869EBCD167B1884984B7D85D0DCC860BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

c07885e0-66ce-4f2f-bcfa-9afc19e1478e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c07885e0-66ce-4f2f-bcfa-9afc19e1478e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3392_711093444\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 00ded732520939036a9d9bb989b2d373c4dc08682a3849f92c366534965a9aef
MD5 40786c5d02a129a4537d6f0d8368f18b
SHA1 f3f6b2c303e296a42f360f7346458f17c73ea179
SHA512 8a07638fc235b9f59902b567ca6ec1da9563a7a8aac920f8cf45f8c1453eb9e55db193d74070dd2391107ba128663958caf54d3789c6b5480864655d27f57079
TLSH
T1D371238357B9D9B3C1DA5FF002835248F6FB2338073330218B55598AAB30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1888-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2332-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2472-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2676-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-503-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2800-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2884-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3096-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3700-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4088-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5024-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5472-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5984-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download