systex | 4a726ad988d14798af78c882443cb9939eddf47f8604a06b8d554e114cd54098

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260718-nerl1scy9x
SHA256 4a726ad988d14798af78c882443cb9939eddf47f8604a06b8d554e114cd54098
MD5 5534d3d89f3f82ad846f50dee9c9d723
SHA1 5f00035ae457c80e83f2d05b21aa10f97b992d08
SHA512 33c6122086995b26161ee45fc02330a5c8adb95fdcd4f649a2783c4e232e5a9491152aebfc8885dde10e1c4dac490955c0759bd7f633e5a2616f9b8b8f54f58b
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4676	wrojhbztrljebwuo.exe
3324	wrojhbztrljebwuo.sys
5236	CreateProcess.exe
3136	wuomgeywro.exe
5612	CreateProcess.exe
2332	CreateProcess.exe
1764	i_wuomgeywro.exe
2860	tomgdbwtom.sys
1800	CreateProcess.exe
792	ljdbwtolgd.exe
476	CreateProcess.exe
5372	CreateProcess.exe
5684	i_ljdbwtolgd.exe
2236	qolgdywqoi.sys
5964	CreateProcess.exe
1592	lgdyvtqlig.exe
4608	CreateProcess.exe
5308	CreateProcess.exe
1396	i_lgdyvtqlig.exe
2432	davtnlfdxv.sys
6052	CreateProcess.exe
4508	avsnlfdyvq.exe
4084	CreateProcess.exe
5156	CreateProcess.exe
2296	i_avsnlfdyvq.exe
2652	fdxvpnliga.sys
996	CreateProcess.exe
5808	vpnhfdxvsn.exe
5304	CreateProcess.exe
1112	CreateProcess.exe
3196	i_vpnhfdxvsn.exe
3112	axspnhfaxs.sys
944	CreateProcess.exe
5704	dxvpkicaxs.exe
4680	CreateProcess.exe
4728	CreateProcess.exe
1248	i_dxvpkicaxs.exe
1868	xrpkhcausm.sys
5184	CreateProcess.exe
1764	pkhczusmke.exe
5920	CreateProcess.exe
1448	CreateProcess.exe
5812	i_pkhczusmke.exe
3816	pmgeczurpj.sys
2980	CreateProcess.exe
1412	rpjhezwrpj.exe
1932	CreateProcess.exe
3900	CreateProcess.exe
4304	i_rpjhezwrpj.exe
3592	ztrmjebztr.sys
2116	CreateProcess.exe
2104	gezwrojhbz.exe
5996	CreateProcess.exe
5728	CreateProcess.exe
1980	i_gezwrojhbz.exe
3748	jgbywrojhb.sys
5040	CreateProcess.exe
3876	dbztrojgby.exe
3528	CreateProcess.exe
5000	CreateProcess.exe
468	i_dbztrojgby.exe
5664	olgdywtnlj.sys
2500	CreateProcess.exe
3336	olgdbytqoi.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1518571494\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1518571494\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1518571494\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1957588691\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1365192421\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1005490906\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1518571494\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1365192421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1005490906\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhecausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwromgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhecausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvtqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvtqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwromgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrojhbz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1736	ipconfig.exe
3728	ipconfig.exe
5600	ipconfig.exe
3152	ipconfig.exe
4532	ipconfig.exe
3224	ipconfig.exe
5468	ipconfig.exe
5484	ipconfig.exe
2420	ipconfig.exe
5440	ipconfig.exe
4792	ipconfig.exe
1684	ipconfig.exe
1060	ipconfig.exe
4788	ipconfig.exe
4312	ipconfig.exe
1796	ipconfig.exe
1932	ipconfig.exe
1816	ipconfig.exe
1716	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288471468772727"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{6FA2C2B0-2B60-41DB-A675-8929BC13AAA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4676	wrojhbztrljebwuo.exe
4676	wrojhbztrljebwuo.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4676	wrojhbztrljebwuo.exe
4676	wrojhbztrljebwuo.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4676	wrojhbztrljebwuo.exe
4676	wrojhbztrljebwuo.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4676	wrojhbztrljebwuo.exe
4676	wrojhbztrljebwuo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	i_wuomgeywro.exe
Token: SeDebugPrivilege	5684	i_ljdbwtolgd.exe
Token: SeDebugPrivilege	1396	i_lgdyvtqlig.exe
Token: SeDebugPrivilege	2296	i_avsnlfdyvq.exe
Token: SeDebugPrivilege	3196	i_vpnhfdxvsn.exe
Token: SeDebugPrivilege	1248	i_dxvpkicaxs.exe
Token: SeDebugPrivilege	5812	i_pkhczusmke.exe
Token: SeDebugPrivilege	4304	i_rpjhezwrpj.exe
Token: SeDebugPrivilege	1980	i_gezwrojhbz.exe
Token: SeDebugPrivilege	468	i_dbztrojgby.exe
Token: SeDebugPrivilege	3008	i_olgdbytqoi.exe
Token: SeDebugPrivilege	2396	i_yvqoigaysq.exe
Token: SeDebugPrivilege	4836	i_nkicaysqki.exe
Token: SeDebugPrivilege	3376	i_spkifaxsqk.exe
Token: SeDebugPrivilege	1868	i_rpmhecausp.exe
Token: SeDebugPrivilege	1788	i_ecwurmjhcz.exe
Token: SeDebugPrivilege	4908	i_zwromgebzt.exe
Token: SeDebugPrivilege	2420	i_bwtrojhbzt.exe
Token: SeDebugPrivilege	2544	i_rljdbvtrlj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4676	4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4956 wrote to memory of 1544	4956	2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1544 wrote to memory of 2360	1544	iexplore.exe	91
PID 2360 wrote to memory of 1476	2360	msedge.exe	92
PID 2360 wrote to memory of 4976	2360	msedge.exe	94
PID 2360 wrote to memory of 1444	2360	msedge.exe	95
PID 2360 wrote to memory of 1444	2360	msedge.exe	95
PID 2360 wrote to memory of 1444	2360	msedge.exe	95
PID 2360 wrote to memory of 5052	2360	msedge.exe	96
PID 2360 wrote to memory of 5052	2360	msedge.exe	96
PID 2360 wrote to memory of 5184	2360	msedge.exe	97
PID 2360 wrote to memory of 5184	2360	msedge.exe	97
PID 2360 wrote to memory of 5184	2360	msedge.exe	97
PID 2360 wrote to memory of 4392	2360	msedge.exe	98
PID 2360 wrote to memory of 4392	2360	msedge.exe	98
PID 2360 wrote to memory of 4392	2360	msedge.exe	98
PID 2360 wrote to memory of 1216	2360	msedge.exe	99
PID 2360 wrote to memory of 1216	2360	msedge.exe	99
PID 2360 wrote to memory of 1216	2360	msedge.exe	99
PID 2360 wrote to memory of 5364	2360	msedge.exe	100
PID 2360 wrote to memory of 5364	2360	msedge.exe	100
PID 2360 wrote to memory of 5364	2360	msedge.exe	100
PID 2360 wrote to memory of 1788	2360	msedge.exe	102
PID 2360 wrote to memory of 1788	2360	msedge.exe	102
PID 2360 wrote to memory of 4992	2360	msedge.exe	105
PID 2360 wrote to memory of 3624	2360	msedge.exe	106
PID 2360 wrote to memory of 4992	2360	msedge.exe	105
PID 2360 wrote to memory of 3624	2360	msedge.exe	106
PID 2360 wrote to memory of 5888	2360	msedge.exe	108
PID 2360 wrote to memory of 1596	2360	msedge.exe	109
PID 2360 wrote to memory of 1596	2360	msedge.exe	109
PID 4676 wrote to memory of 5236	4676	wrojhbztrljebwuo.exe	111
PID 3136 wrote to memory of 5612	3136	wuomgeywro.exe	115
PID 2360 wrote to memory of 2760	2360	msedge.exe	118
PID 2360 wrote to memory of 2760	2360	msedge.exe	118
PID 4676 wrote to memory of 2332	4676	wrojhbztrljebwuo.exe	119
PID 4676 wrote to memory of 1800	4676	wrojhbztrljebwuo.exe	123
PID 792 wrote to memory of 476	792	ljdbwtolgd.exe	125
PID 4676 wrote to memory of 5372	4676	wrojhbztrljebwuo.exe	128
PID 4676 wrote to memory of 5964	4676	wrojhbztrljebwuo.exe	132
PID 1592 wrote to memory of 4608	1592	lgdyvtqlig.exe	134
PID 4676 wrote to memory of 5308	4676	wrojhbztrljebwuo.exe	137
PID 4676 wrote to memory of 6052	4676	wrojhbztrljebwuo.exe	142
PID 4508 wrote to memory of 4084	4508	avsnlfdyvq.exe	144
PID 4676 wrote to memory of 5156	4676	wrojhbztrljebwuo.exe	147
PID 2360 wrote to memory of 3216	2360	msedge.exe	149
PID 2360 wrote to memory of 4972	2360	msedge.exe	150
PID 2360 wrote to memory of 4712	2360	msedge.exe	151
PID 2360 wrote to memory of 3368	2360	msedge.exe	154
PID 2360 wrote to memory of 3368	2360	msedge.exe	154
PID 4676 wrote to memory of 996	4676	wrojhbztrljebwuo.exe	155
PID 5808 wrote to memory of 5304	5808	vpnhfdxvsn.exe	157
PID 4676 wrote to memory of 1112	4676	wrojhbztrljebwuo.exe	160
PID 4676 wrote to memory of 944	4676	wrojhbztrljebwuo.exe	164
PID 5704 wrote to memory of 4680	5704	dxvpkicaxs.exe	166
PID 4676 wrote to memory of 4728	4676	wrojhbztrljebwuo.exe	169
PID 4676 wrote to memory of 5184	4676	wrojhbztrljebwuo.exe	173
PID 1764 wrote to memory of 5920	1764	pkhczusmke.exe	175
PID 4676 wrote to memory of 1448	4676	wrojhbztrljebwuo.exe	178
PID 4676 wrote to memory of 2980	4676	wrojhbztrljebwuo.exe	182
PID 1412 wrote to memory of 1932	1412	rpjhezwrpj.exe	184
PID 4676 wrote to memory of 3900	4676	wrojhbztrljebwuo.exe	187
PID 2360 wrote to memory of 3624	2360	msedge.exe	189
PID 2360 wrote to memory of 3624	2360	msedge.exe	189

C:\Users\Admin\AppData\Local\Temp\2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_5534d3d89f3f82ad846f50dee9c9d723_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Temp\wrojhbztrljebwuo.exe
  C:\Temp\wrojhbztrljebwuo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5236
  - - C:\Temp\wuomgeywro.exe
      C:\Temp\wuomgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2332
  - - C:\Temp\i_wuomgeywro.exe
      C:\Temp\i_wuomgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1800
  - - C:\Temp\ljdbwtolgd.exe
      C:\Temp\ljdbwtolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5372
  - - C:\Temp\i_ljdbwtolgd.exe
      C:\Temp\i_ljdbwtolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvtqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5964
  - - C:\Temp\lgdyvtqlig.exe
      C:\Temp\lgdyvtqlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvtqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\i_lgdyvtqlig.exe
      C:\Temp\i_lgdyvtqlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6052
  - - C:\Temp\avsnlfdyvq.exe
      C:\Temp\avsnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5156
  - - C:\Temp\i_avsnlfdyvq.exe
      C:\Temp\i_avsnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfdxvsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:996
  - - C:\Temp\vpnhfdxvsn.exe
      C:\Temp\vpnhfdxvsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfdxvsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\i_vpnhfdxvsn.exe
      C:\Temp\i_vpnhfdxvsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpkicaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:944
  - - C:\Temp\dxvpkicaxs.exe
      C:\Temp\dxvpkicaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpkicaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Temp\i_dxvpkicaxs.exe
      C:\Temp\i_dxvpkicaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5184
  - - C:\Temp\pkhczusmke.exe
      C:\Temp\pkhczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1448
  - - C:\Temp\i_pkhczusmke.exe
      C:\Temp\i_pkhczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2980
  - - C:\Temp\rpjhezwrpj.exe
      C:\Temp\rpjhezwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3900
  - - C:\Temp\i_rpjhezwrpj.exe
      C:\Temp\i_rpjhezwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2116
  - - C:\Temp\gezwrojhbz.exe
      C:\Temp\gezwrojhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5728
  - - C:\Temp\i_gezwrojhbz.exe
      C:\Temp\i_gezwrojhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5040
  - - C:\Temp\dbztrojgby.exe
      C:\Temp\dbztrojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5000
  - - C:\Temp\i_dbztrojgby.exe
      C:\Temp\i_dbztrojgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdbytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2500
  - - C:\Temp\olgdbytqoi.exe
      C:\Temp\olgdbytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdbytqoi.exe ups_ins
    3⤵
    PID:3112
  - - C:\Temp\i_olgdbytqoi.exe
      C:\Temp\i_olgdbytqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    PID:5356
  - - C:\Temp\yvqoigaysq.exe
      C:\Temp\yvqoigaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    PID:4048
  - - C:\Temp\i_yvqoigaysq.exe
      C:\Temp\i_yvqoigaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicaysqki.exe ups_run
    3⤵
    PID:3776
  - - C:\Temp\nkicaysqki.exe
      C:\Temp\nkicaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicaysqki.exe ups_ins
    3⤵
    PID:5444
  - - C:\Temp\i_nkicaysqki.exe
      C:\Temp\i_nkicaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkifaxsqk.exe ups_run
    3⤵
    PID:4532
  - - C:\Temp\spkifaxsqk.exe
      C:\Temp\spkifaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkifaxsqk.exe ups_ins
    3⤵
    PID:2052
  - - C:\Temp\i_spkifaxsqk.exe
      C:\Temp\i_spkifaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhecausp.exe ups_run
    3⤵
    PID:4440
  - - C:\Temp\rpmhecausp.exe
      C:\Temp\rpmhecausp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhecausp.exe ups_ins
    3⤵
    PID:3016
  - - C:\Temp\i_rpmhecausp.exe
      C:\Temp\i_rpmhecausp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmjhcz.exe ups_run
    3⤵
    PID:1048
  - - C:\Temp\ecwurmjhcz.exe
      C:\Temp\ecwurmjhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmjhcz.exe ups_ins
    3⤵
    PID:2396
  - - C:\Temp\i_ecwurmjhcz.exe
      C:\Temp\i_ecwurmjhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwromgebzt.exe ups_run
    3⤵
    PID:4836
  - - C:\Temp\zwromgebzt.exe
      C:\Temp\zwromgebzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwromgebzt.exe ups_ins
    3⤵
    PID:3436
  - - C:\Temp\i_zwromgebzt.exe
      C:\Temp\i_zwromgebzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrojhbzt.exe ups_run
    3⤵
    PID:5508
  - - C:\Temp\bwtrojhbzt.exe
      C:\Temp\bwtrojhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrojhbzt.exe ups_ins
    3⤵
    PID:4596
  - - C:\Temp\i_bwtrojhbzt.exe
      C:\Temp\i_bwtrojhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbvtrlj.exe ups_run
    3⤵
    PID:2512
  - - C:\Temp\rljdbvtrlj.exe
      C:\Temp\rljdbvtrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbvtrlj.exe ups_ins
    3⤵
    PID:3752
  - - C:\Temp\i_rljdbvtrlj.exe
      C:\Temp\i_rljdbvtrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb7837c188,0x7ffb7837c194,0x7ffb7837c1a0
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1884,i,10898255109726672252,12529498486582463035,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:11
      4⤵
      System Time Discovery
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,3025395070430430063,17539712937774683672,262144 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2320,i,12955763168741168472,18178558362449003370,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,5951410024410531280,3538412548324887417,2097152 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,5924608665619325785,15686832194778398284,2097152 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,8459009782426227111,17422389009533335490,2097152 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,17793997201679504507,9886560542058857311,2097152 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3764,i,17132760483808474528,15954670305629524780,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5468,i,17264617205142482441,12874199136836969899,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3764,i,13165714502497832772,5557194599473012020,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5948,i,2894264572364976882,14247346040644144365,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5948,i,2894264572364976882,14247346040644144365,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6256,i,7537560886294487997,4836556119743075291,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6484,i,7157192643047869851,16860435874726813224,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5172,i,16760333628065494471,15332374177472878600,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4420,i,11091461308979696665,13647279549251820406,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5276,i,15988932036666660723,14096630334127405284,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2348,i,5939952800241175307,10065218029063324938,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5580,i,5817643793659585310,5582055814712237536,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5444,i,5071917522448262075,3576724710229323025,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6456,i,6539087662852889756,9027722260693233432,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6456,i,16494631720668377464,1509981367740497992,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3560,i,6956170816723005355,10137946301144665109,262144 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6152,i,11960419106722627172,18196559126007641381,524288 --field-trial-handle=2616,i,6163616985165570,2614327714299318086,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1808

C:\Temp\wrojhbztrljebwuo.sys
C:\Temp\wrojhbztrljebwuo.sys
1⤵
- Executes dropped EXE
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2924

C:\Temp\tomgdbwtom.sys
C:\Temp\tomgdbwtom.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Temp\qolgdywqoi.sys
C:\Temp\qolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:2236

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\fdxvpnliga.sys
C:\Temp\fdxvpnliga.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\axspnhfaxs.sys
C:\Temp\axspnhfaxs.sys
1⤵
- Executes dropped EXE
PID:3112

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
- Executes dropped EXE
PID:1868

C:\Temp\pmgeczurpj.sys
C:\Temp\pmgeczurpj.sys
1⤵
- Executes dropped EXE
PID:3816

C:\Temp\ztrmjebztr.sys
C:\Temp\ztrmjebztr.sys
1⤵
- Executes dropped EXE
PID:3592

C:\Temp\jgbywrojhb.sys
C:\Temp\jgbywrojhb.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\olgdywtnlj.sys
C:\Temp\olgdywtnlj.sys
1⤵
- Executes dropped EXE
PID:5664

C:\Temp\igaysqlidy.sys
C:\Temp\igaysqlidy.sys
1⤵
PID:1248

C:\Temp\xvtnlfdxvt.sys
C:\Temp\xvtnlfdxvt.sys
1⤵
PID:824

C:\Temp\sqkifaysqk.sys
C:\Temp\sqkifaysqk.sys
1⤵
PID:5700

C:\Temp\upnhecausm.sys
C:\Temp\upnhecausm.sys
1⤵
PID:4468

C:\Temp\hfzxrpjhbz.sys
C:\Temp\hfzxrpjhbz.sys
1⤵
PID:2012

C:\Temp\mjhbzurmke.sys
C:\Temp\mjhbzurmke.sys
1⤵
PID:1756

C:\Temp\zwuoljgbyw.sys
C:\Temp\zwuoljgbyw.sys
1⤵
PID:4788

C:\Temp\vtrljgbwtr.sys
C:\Temp\vtrljgbwtr.sys
1⤵
PID:4912

C:\Temp\igdyvtqlig.sys
C:\Temp\igdyvtqlig.sys
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsnlfdyvq.exe

Path C:\Temp\avsnlfdyvq.exe
Size 376KB
SHA256 4e4203c54d65f426226a47117b2c6e74e1722366e415be55a243fcbef0b8d239
MD5 3a7cd77563646217d585f307609bfdff
SHA1 ab227a6d19cc7c8983f1e7c74c7112a5448ba1bc
SHA512 ea4af52947c2487e958d67ab15facf792f644b928d766942d1658005a192f9458525d15e811a02e0cac52c46d3ffda861e654fce06e7cd9f5c572beda2955a49
SSDEEP 3072:3FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axspnhfaxs.sys

Path C:\Temp\axspnhfaxs.sys
Size 293KB
SHA256 d097584dc7b95247cde25da59e377171f224c89009ffc29934e3ec7bba0b4f16
MD5 c87a03987ef01b706cf7638be1820b8a
SHA1 3150fbf9a66dd0f9977043589dd64c77184d5914
SHA512 75130ba7ed29b78a35c817246125706a4ad444b7230aaaf84eddcb24688cf18bd166d6be2ad61c933d9421ec00d3dc312bac2c6108cc968eadfe6a7fc9359369
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdxv.sys

Path C:\Temp\davtnlfdxv.sys
Size 293KB
SHA256 623ec7248223befc6447ec71fafe6abdb42099097af2f1dfdc61683bfc635bfa
MD5 48f1ee0d02e52dd55606c570c33badb5
SHA1 69382ad58385909d38e2fb2118a4eafe9e8c2a62
SHA512 594bce0d2617a64398633482d19f0bd7838d6d3f7f003fe3b16db2064f3e1d3d201ae614dc567a22792032e1275aed0daea469e9294f98ca6104f6d59a1ea6c5
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpkicaxs.exe

Path C:\Temp\dxvpkicaxs.exe
Size 376KB
SHA256 a6f403e019a659ef7ccae071ef568e5401942143df6fe08bfa926119c352cbdc
MD5 08e5a6a4a333669b97ab08b8cb9addef
SHA1 a40d098ff48c880e0b12aff3b6cf1203e043a3d4
SHA512 ea79c076b2f07a250a149be0477b23ac9aa3b4a29d4b9c9f72826dd8a63741233c89704ed9224ef89c50299ae5f7f08116e3d276e99b95990a7fa5003a293624
SSDEEP 3072:gFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnliga.sys

Path C:\Temp\fdxvpnliga.sys
Size 293KB
SHA256 91969afd9ae24f70ddb462b8b57e60ce18011f0e7af3a69b9e6463d7db90389f
MD5 4491deed6a010873b5b7838fc1986437
SHA1 ed038c9383fdbb6e9160d0cbb6526a1f957aeda6
SHA512 30f6e09b5719223cbc1c61b520cfc072852aa584f80b14c1563bc67d12d2bfe86433d9cfb7eb7706a46202cc42a7be4110feeba0b925415e419855e961c4de67
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdyvq.exe

Path C:\Temp\i_avsnlfdyvq.exe
Size 376KB
SHA256 4e1fed9c3bd1984637d7e92008682bea23b7abe38616cdbe0e06bde257a803b3
MD5 8e48c3e6ba93a86d88bc97573ee46e99
SHA1 6366b42f5e97e607d94c062458450d5860677076
SHA512 c1bdb28427cbd99163c4adb6cb2758225e3ad3bd83089d05316398563de75e23f98017376e3281792abee7cb54e29e204d28863a27c362c4f5a3e86e449fb229
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvtqlig.exe

Path C:\Temp\i_lgdyvtqlig.exe
Size 376KB
SHA256 a16e06fcc9810172be397232461790cc7249d20132c2afb78708efb890af0d1c
MD5 7fd467698e54b201dcc929af345a6219
SHA1 1b39a66dd9de5a9fe137e4d26aea1c54ba93804f
SHA512 45bec4ea4f8a43396fa5f6d8a0b97903475f8d8730901c07ca3d35741f1ea406281ee9c6f47083547bb91d96de0f56e5f79e5cde933b7b7438889fa687016c2d
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T135847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbwtolgd.exe

Path C:\Temp\i_ljdbwtolgd.exe
Size 376KB
SHA256 d9120e759fe591abbaa53900e82d1c28e40ed43fc3613db3eed68ca87ed2c4c6
MD5 8b60585a46180c7ce13341f2baae1656
SHA1 414b989df6de6618047a0efa9dc7aebb3c66b940
SHA512 0de6c9032d0c4db9fe7ee3389aa1619185c1ce0418d322a9ae2f9eed012eaa3d498d73b2c6d450978cb10768ddf060a7b61df7bcf5328a0510b3f111aacbd86a
SSDEEP 3072:3FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfdxvsn.exe

Path C:\Temp\i_vpnhfdxvsn.exe
Size 376KB
SHA256 8d82a015cdb4e27548c7fb3b2c2c8a3ecbf5a11a23cec980df5dc6e3313a0c1b
MD5 1f57ccf816cb2b2ab8f7b055a6ca39ea
SHA1 7b37e901d3ad78dd9cafbf0a6fee2090db126b03
SHA512 4992b043c2c439888bbb76b0da67c6e27877b2f5422968d1760f6870ccd13e257b85ddf715b749526110e0dff02f369b05d1f24f345a076d24d972d702a132bf
SSDEEP 3072:cFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgeywro.exe

Path C:\Temp\i_wuomgeywro.exe
Size 376KB
SHA256 61e8d0e9dac847048d777b9111f28faf5bf5e521ba86a3b39e102a256a400999
MD5 3eb38e7fc2f3ced0fee0cbd933a77fa5
SHA1 0f13646b038d678c82fd0f40204322b4c5b1ae4b
SHA512 34626683283cf899decf94dc1163cb533f0b5ef17a6779d4213df30c86560eb04959aee1518fb46eb0e00c608ca3a6f1dd2636a28051cdfde4365f6806a6a4a2
SSDEEP 3072:rFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:rFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvtqlig.exe

Path C:\Temp\lgdyvtqlig.exe
Size 376KB
SHA256 39ec318d1531af9826be60f8186a437a70fbac5277276fde4659e6d7d2f88bfd
MD5 e7042a46046af68a673843c241f2fdf0
SHA1 39f997c5e63bd44ec5e4f966fe4b4ef492d5cfd0
SHA512 b4e5978dec5d744a9899ab95862b59058d759c4312cbc6a5b773f62a46e723ced33ebde4f32b1b151c6177c707b9319d00fe4b507f2dea2b04ef25f010adf4af
SSDEEP 3072:zUFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLI:oFL1JeIJjiJcbI03GBc3ucY5DCSjXO
TLSH
T168847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtolgd.exe

Path C:\Temp\ljdbwtolgd.exe
Size 376KB
SHA256 7e05fbf4714cabb4e8632c2f01d639ea238cd556a1ab13bfee1d1ed9f6f0ed31
MD5 88a4df2460d7e253028447c8f5315197
SHA1 b75bc4e00d871c33f4b5453e134a46a3ed24b5ec
SHA512 6b8a38c687c2479f67bf434e02304adadc50c9b48d05597366974d07f71428daceec3af69574c4311e794c514a045620b5c497c95015246d61ab606810a81967
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdywqoi.sys

Path C:\Temp\qolgdywqoi.sys
Size 293KB
SHA256 e0ef30f317fe1045e55b5a3d9e8581b199919adbfa1eb6b4ac8a73796a7f1a97
MD5 1a41bcbb72ad2e83b5425d5b210ed211
SHA1 8b72bf86d6418ec9a0c1532ff16260e904dd06c2
SHA512 732419a14ab64d92fa866ae936cf58483da2f461ffb0140cd0f5a6c9b37c145815000a2137d6b4bf6c6ea2733e34b3685c4887be7fa2d6f1bf7f82c055fb1d09
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgdbwtom.sys

Path C:\Temp\tomgdbwtom.sys
Size 293KB
SHA256 e89f662d389b9035ed7dee7e15d1b80ca5d65e6e247076baed16cd31eb4d46ed
MD5 f0e07e170c9d01f52aa8a0a9b24c0cc8
SHA1 a778ed296eeb4ffda1e7d2ed3990fdd0be8ad17d
SHA512 4d15b5cf1a9868d1606ccb3da440fc6ce40418f4c9ef11d2ee960e91320a40fec8f5ce492e1deac988048123bb9120d07368118c27921e1299da8d026933bd08
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfdxvsn.exe

Path C:\Temp\vpnhfdxvsn.exe
Size 376KB
SHA256 61e80b875bc7b2ad9da0bf7c2e6a10cacdd5d4ed3cfb9da4a46fb90a838b2a87
MD5 5b62aa64b858762053d334d6b96122b0
SHA1 dab176ca30fd0c073646e8310918c35462478a6a
SHA512 b078da799ac32ddb5c971a4162f4a416abf303023a58eec09d90ee709bbc87cd15b6d0d689392f0146536097f36269ce85a41397a91d4eeaa1479d69085bad1d
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T101847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrljebwuo.exe

Path C:\Temp\wrojhbztrljebwuo.exe
Size 376KB
SHA256 e04cb7f6caf287409745b3fb1a596cb58a4e95214a825f30e1f5e68e6773e98a
MD5 7bcebbed16dab5cdbeec39ded20a600b
SHA1 9fb52add0b7336efd66a7c799e20cbc079638214
SHA512 a658d652c1fcca3c03c4239daeab56ea74e95d779adceb94d20d4fa1dc5b0ab3b1b3166724ee513fc63c35d29a56b030fbbb5bef38d156469d6cd3e835870f84
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrljebwuo.sys

Path C:\Temp\wrojhbztrljebwuo.sys
Size 293KB
SHA256 36ab4fc197799b5042922e63bff47a80427235867d6767952078ae80731e7924
MD5 25131d01665f34da2ec5d048866e1521
SHA1 6473cf4d5df33d2e49d39a1eba8426453bd44716
SHA512 69bbc16856917e76ff021da3cb702899e011b2a8d7741266f08d659b1a5adee21cd19a0547ea4d45138e3b0951f7f1180673b05d493ee4e6d4f5a5fb2a49ecd0
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.exe

Path C:\Temp\wuomgeywro.exe
Size 376KB
SHA256 b3764a53d8e1860b7992f67b6e8c80ad651dc35b2928bdd5ec14b5b74566925f
MD5 5d307610b74d9b437b66a4ffccb89dda
SHA1 909d65fbac2d4392375aa58db6b6627a1b8119d9
SHA512 7c7febf558dada24299429ac7af838396d374cd8cdb2c56f5306d286193fb8b096471614e011bcef7cfc9bb9c994cb07279557945c1da044e9e3f10170f9d120
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4af5b7304a6bd169eac64bd00eeb19889fe96f75dea8882e400670665c2fa076
MD5 0aa15714600ec0b5e75dd095318565a9
SHA1 74a87352822ea856e3d0d7edeeed480ef2099323
SHA512 80b10abe821622985eaca2afdf90a61456e82cd7b3eabaec1da23515550beb9e1de2270050483ecd28d10e1168ccc9cf037cfaec028e5d17b368bdf34b62c9d6
TLSH
T1FD513C4D2B6D89EDD736287991E3788976F08A3E62C36A50C380AD708D13FF524D20E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8e39538725dc320c9ac2c64a1477db51a83bd7d911d850376885819aa612c974
MD5 402ba0cda2bc584071a84e729eaf3bcf
SHA1 c69c05177867b0bd6a2904e2d59c3ac1cf62c26e
SHA512 b4f3bfa98cfddf028d30beba0cb4f29bb30149ad563874343613a731bda048257ba1f803c880bc01284546302c2ece4c2e61f76200e2dbce2f8499063807032c
TLSH
T16541BFF3C6E8856E890156F0AA187E1BCE1D0915832C3D5AC9E4AF5F93F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 505f55609c5f7768100d58a8c564e7b4ae7440474635500d9244f946dcd1f9ff
MD5 6ede761aab1d371ba80febb12a9e485c
SHA1 6aa207408ff426048360b76ee263007be3cdef65
SHA512 857ad24920c257d993c2b37dd97f5be80c8e008e891a87cb9835e2c07a0f0f2ea9683df748001878bd773d4234badda0f18d074830352ed3a1f1503f543c2940
SSDEEP 192:sxRbk/yM/jK1Ml8wCP/flsOpoROZUzdIzoA8p9A/g6+WNCZBF9/Yo0xCYoGlIgtJ:sxRw78P/flsioRoy/y/5YT9/0Ue3
TLSH
T1A852E9166A245D77CCDBD209FA557F93D6F91473A2901E04AAFC9B0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 362cf0d6b589d0c84738a1010f2ffb308e1b3f573d700e54f69e942866c9d852
MD5 0254809bddd9cc0bc5e1e3f4647e8e13
SHA1 ef52bd0591e3048f67ddb75f8b429a722062f453
SHA512 cf6653fa496ba257fe8141c8eaa4fb71a52308fe8d6b5657606ec81e45b6b095c017fc3cafe7530677fdb70dd6cfb3e943be2bd3ba1007053d540b0097c84ef3
SSDEEP 192:sxRok/yM/jK1Ml8wCP/flsyOpoROZUzdIzoA8p9A/g6+WNCZBF9/Yo0xCYoGlIg5:sxRr78P/flsnoRoy/y/5YT9/0Ue5
TLSH
T19E62E9166A245D7BCCDBD209FA557F93D6F91473A2901E44AAFC9B0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c985c5330f0672fe3c0f6f7573ee36303515631a1ebf13cc40c7da468441bca7
MD5 508727bffa4963b9bab803435954f1b6
SHA1 ccbbb2beb9776d08c79fef75940362d28bc5bce5
SHA512 6e7bd4602bb0ae5400e113e7d7ef5549cbcdfaea9fd6875f765206e61613d4a0e22c2ca08ab96388294fff05622b8c6dc1823a0340561543184f881242307e5b
SSDEEP 192:sxRok/yM/jK1Ml8UQNCP/flsyOpoROZUzdIzoA8prA/g6+WNCZBF9/Yo0mCYoGlX:sxRr7qsP/flsnoRoy/s/5YT9/0teX
TLSH
T19162D8166A245D77DCDBD209FA517F93E2F95473A2901E04AAFC9B0C00E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e87bf826769b4b76d4b56ca4b05d046c2c060f4c29b21f1902e9b1d261eddef5
MD5 09e455df0a648c55f3f3854b68b25764
SHA1 61f4b931e4083f0774d697189235c6fb21aa4026
SHA512 9adaca6615600c70659e1392f6a03cc1797b1aaacd44a3eb2f496bda370aa3b600dcfea33d3e8d9cd630bf44b140fb55f03b8f4a1f83071fe8e1f2780f3aef56
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVjdKVuGrrockZeD:jXwHnUE7gRWgs2fJ2u1jasdK4GYdSZ
TLSH
T1B7E2FC7B680CCBBE4F404ADCEC29BD9E6DA801CB56D88D5447FA840C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 55e9a587a3b2a7d6f7799ff7ffda8d26495905b3466134fd0df316e6958e862a
MD5 d95df323bae6398c22958f25e3fea7af
SHA1 6568e31690efccbec387a1a91a8458d77b3541ed
SHA512 1b1fd6002959621c7fb1f76c74a451bd0e02b03c5601ad73cd8e68ab2e09752c34eb22d9c3f9de3a678cb8ac8730522dc96b69dff6ac997821930d8a5536523c
SSDEEP 96:KR8H8Q818x8H8F818ZW8B8u80g858ZK48wg838Zc8/83828p818qH8d8q8j8X8N5:CWLa2Q445IdGWWrgEN+W10m/Hc9oMmqg
TLSH
T1A991F501343F065138BF6A1C947A892A96C174B23258E53BB7B905E60F3BE234DFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3c7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3c7e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 51cfc98dc1b9f726dc105ed99e4face3597685e5ed5bb17ba53b98b52d75f4bf
MD5 82ce4fb8e18390d70c46887432d262bb
SHA1 d96f4f6a00dc0f4fe4cb2f516646ca72f6726efd
SHA512 e6a92f58ff0ff69f88603fc136002514307baefd63c6db9b37e219e9a0096e401ec3e986ba3bfc7003ed6d465bd94894ef4c0aaeb1ea9576e50ea30e421a19cd
SSDEEP 768:5j+9Q3oy/TBOWc8nOONXyer1IRCzni9vb9M+:k9Q3NQSIqnQb++
TLSH
T199F2AE31E5568E234CE69396B24737D7BFF820B7D5800E50EAE96F4E05C7A5D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1f8c697dc02c424e91a4ff3d151cc6d1ce2e4f796bdf74c9be3991521f765387
MD5 65a8d41aa4ffbffd25763007429c8610
SHA1 066a4582633faa11f3d4f5364bb694c08b7bc441
SHA512 6b06cc6bf267ed4ba3d1d06eb72b6c534ecc6b373d38745ac15e81eeef9f2f88934025a1fee6eec7025c1febb8c7dd5a4067d4690ce8a16544a5e0daa4d405da
SSDEEP 768:hrv+4UNbdz3nN/TBOWc8IONXyer1IRCzniBeeVH1SK7:hbsbV3NCSIqndEH1l
TLSH
T12D03CF32A4A89E338DE2A3C5B14777477FB86057C6800790E9DE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dc21b500073001f055fada2ccdc3cdaa06dd9f1a75a02b44c87256240bf800b7
MD5 6c183f59ace16c9556c63ddce6be813f
SHA1 abcbaa0ad65fc84b215150e1e5cfbd71a870a5c4
SHA512 643a9b3f21831da9cd5ea3773e0d999eea020d7458e154bac362eb9de7c2c8c5329ada8a31175524d615687391fa4b0a77a47f7a16b60d5d42ebc852e24fbd4c
SSDEEP 768:srv+4UNbdy3Ay/TBOWc8nOONXyer1IRCzni9veVH1SK3:sbsbs31QSIqnQEH1R
TLSH
T11E13BF31A5A8DE335CE6A386B147B7837FB82067C5800B90EDDA2F4E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 98ec9d36fb5ced6bac9f4db4f7d34e72d332ca932557f055deb0d35bebbbcec8
MD5 f121cc27dc8f88bda704a2d29dcfb30b
SHA1 ed9982d66976047b9566c9731287d3216d7d13f2
SHA512 7942c7c7f8e42c9f04003f52910cc962b6c0a9a455dadcf8533928dd9dad60643558c0d07afcae26c1f5a154c2d935c73a32ccbe98c4cad95c7eb2c4247f225f
SSDEEP 768:0F1j+953Uwg1RpsOWc8nsONXyer1IRCzni9vb9M+:Z953uPSIqnQb++
TLSH
T1BB1317F694D78A37D89E5387A33D2E869EBCD067B5844980BBD51E4DCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

0d097de7-49bc-4ddd-9fea-85db40595777.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d097de7-49bc-4ddd-9fea-85db40595777.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2360_590057068\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 49bb93e60b9158da31b2abe8f055c2551fa6d133a7aa77915224fb4cb5a6617f
MD5 6153fc8a0e9fa4d731f6a14dcfe32cfd
SHA1 c5c24cefb7f55d28da05f51be08840748775caae
SHA512 cbdeeb2097126df998012aaf40a1509bd54570ae46152e2653e391ba35ca8023ad798dd9297ed79a1109c5568529186709c6a7a7d93aa1ce56b72b27305dda11
TLSH
T17971008357B8C5B3C1DA5FF102835648F5BB22384B2330350B955586AB30A7A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1248-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1248-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1756-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1868-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2236-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2860-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3112-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3592-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3592-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3816-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4788-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5664-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5700-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download