systex | 0964fda242d0edd9e89ac25e3abfc256158c17f6327fac964b773b179baed854

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260720-a9ghmsax2n
SHA256 0964fda242d0edd9e89ac25e3abfc256158c17f6327fac964b773b179baed854
MD5 9cb5cf1e126b30fc266ac9ae79014bd6
SHA1 f4dfc845d93f79da3dad417278b6cebf884ee577
SHA512 14ab224859d2b5ced4fbe59c77b7d1894d09b2d5958be8ae6a06a7b469e50bcc5228485196bdde2509535edb30d1711cc3587692375dfbb9628b4b86c1ffcace
SSDEEP 3072:EjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ayLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3200	igbytqljdbwlgeyw.exe
2160	igbytqljdbwlgeyw.sys
5052	CreateProcess.exe
3184	aytqlidbwq.exe
3556	CreateProcess.exe
6136	CreateProcess.exe
4644	i_aytqlidbwq.exe
3896	qnlidbvtnl.sys
5824	CreateProcess.exe
2464	davtnlfdxv.exe
2712	CreateProcess.exe
908	CreateProcess.exe
5988	i_davtnlfdxv.exe
3652	vsqkigaxvq.sys
2848	CreateProcess.exe
5488	tnkicavsnk.exe
2000	CreateProcess.exe
1872	CreateProcess.exe
5424	i_tnkicavsnk.exe
3196	dxvpnhfaxs.sys
2036	CreateProcess.exe
3328	xvpnhfcxus.exe
940	CreateProcess.exe
5600	CreateProcess.exe
1596	i_xvpnhfcxus.exe
5876	pkhcaxspkh.sys
4668	CreateProcess.exe
4252	hfzxrpkhca.exe
4192	CreateProcess.exe
864	CreateProcess.exe
1300	i_hfzxrpkhca.exe
3172	rpjhczurpj.sys
3764	CreateProcess.exe
1076	pjhezwuomj.exe
5572	CreateProcess.exe
2476	CreateProcess.exe
5424	i_pjhezwuomj.exe
1492	ezxrpjhbzt.sys
3496	CreateProcess.exe
1960	zwromjhbzw.exe
5012	CreateProcess.exe
4988	CreateProcess.exe
5236	i_zwromjhbzw.exe
5324	wtomgebztr.sys
2880	CreateProcess.exe
200	wtoljebwto.exe
1476	CreateProcess.exe
2280	CreateProcess.exe
3240	i_wtoljebwto.exe
4600	bywqolgdyw.sys
4264	CreateProcess.exe
248	bywqoigayt.exe
1528	CreateProcess.exe
4868	CreateProcess.exe
2124	i_bywqoigayt.exe
2408	aytqoigayt.sys
5972	CreateProcess.exe
2784	nigaysqkid.exe
2920	CreateProcess.exe
2528	CreateProcess.exe
1832	i_nigaysqkid.exe
1596	dxvqnigayv.sys
1132	CreateProcess.exe
1088	sqlidavsnl.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1616522386\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1751181621\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1953890088\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1953890088\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1751181621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_98306845\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_98306845\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_98306845\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_98306845\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkicaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkicaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqlidbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwromjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqljdbwlgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwromjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqoigay.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2640	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4084	ipconfig.exe
5796	ipconfig.exe
3512	ipconfig.exe
4492	ipconfig.exe
5284	ipconfig.exe
2696	ipconfig.exe
4876	ipconfig.exe
856	ipconfig.exe
1192	ipconfig.exe
5896	ipconfig.exe
2088	ipconfig.exe
4224	ipconfig.exe
5464	ipconfig.exe
2428	ipconfig.exe
5948	ipconfig.exe
4236	ipconfig.exe
2504	ipconfig.exe
2200	ipconfig.exe
4732	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289824842289708"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{BC675F04-346C-4FB3-8A74-05D0F68C1EB0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3200	igbytqljdbwlgeyw.exe
3200	igbytqljdbwlgeyw.exe
4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	i_aytqlidbwq.exe
Token: SeDebugPrivilege	5988	i_davtnlfdxv.exe
Token: SeDebugPrivilege	5424	i_tnkicavsnk.exe
Token: SeDebugPrivilege	1596	i_xvpnhfcxus.exe
Token: SeDebugPrivilege	1300	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	5424	i_pjhezwuomj.exe
Token: SeDebugPrivilege	5236	i_zwromjhbzw.exe
Token: SeDebugPrivilege	3240	i_wtoljebwto.exe
Token: SeDebugPrivilege	2124	i_bywqoigayt.exe
Token: SeDebugPrivilege	1832	i_nigaysqkid.exe
Token: SeDebugPrivilege	5036	i_sqlidavsnl.exe
Token: SeDebugPrivilege	2176	i_pnkicaxvpn.exe
Token: SeDebugPrivilege	4400	i_pkhcausmkf.exe
Token: SeDebugPrivilege	4132	i_mheczusmke.exe
Token: SeDebugPrivilege	1180	i_wrpjhezwrp.exe
Token: SeDebugPrivilege	5676	i_bztrmjebwu.exe
Token: SeDebugPrivilege	4784	i_bywqoigbyw.exe
Token: SeDebugPrivilege	5132	i_dbytqoigay.exe
Token: SeDebugPrivilege	1100	i_gdyvqoidbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3200	4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4148 wrote to memory of 824	4148	2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 824 wrote to memory of 4544	824	iexplore.exe	91
PID 4544 wrote to memory of 3580	4544	msedge.exe	92
PID 4544 wrote to memory of 5196	4544	msedge.exe	93
PID 4544 wrote to memory of 2640	4544	msedge.exe	95
PID 4544 wrote to memory of 5196	4544	msedge.exe	93
PID 4544 wrote to memory of 5196	4544	msedge.exe	93
PID 4544 wrote to memory of 756	4544	msedge.exe	96
PID 4544 wrote to memory of 756	4544	msedge.exe	96
PID 4544 wrote to memory of 1888	4544	msedge.exe	97
PID 4544 wrote to memory of 1888	4544	msedge.exe	97
PID 4544 wrote to memory of 1888	4544	msedge.exe	97
PID 4544 wrote to memory of 5024	4544	msedge.exe	98
PID 4544 wrote to memory of 5024	4544	msedge.exe	98
PID 4544 wrote to memory of 5024	4544	msedge.exe	98
PID 4544 wrote to memory of 4712	4544	msedge.exe	99
PID 4544 wrote to memory of 4712	4544	msedge.exe	99
PID 4544 wrote to memory of 4712	4544	msedge.exe	99
PID 4544 wrote to memory of 4300	4544	msedge.exe	100
PID 4544 wrote to memory of 4300	4544	msedge.exe	100
PID 4544 wrote to memory of 4300	4544	msedge.exe	100
PID 4544 wrote to memory of 612	4544	msedge.exe	101
PID 4544 wrote to memory of 612	4544	msedge.exe	101
PID 4544 wrote to memory of 3240	4544	msedge.exe	105
PID 4544 wrote to memory of 1436	4544	msedge.exe	106
PID 4544 wrote to memory of 3240	4544	msedge.exe	105
PID 4544 wrote to memory of 1436	4544	msedge.exe	106
PID 3200 wrote to memory of 5052	3200	igbytqljdbwlgeyw.exe	107
PID 4544 wrote to memory of 6024	4544	msedge.exe	110
PID 3184 wrote to memory of 3556	3184	aytqlidbwq.exe	112
PID 4544 wrote to memory of 4600	4544	msedge.exe	117
PID 4544 wrote to memory of 4600	4544	msedge.exe	117
PID 4544 wrote to memory of 4884	4544	msedge.exe	118
PID 4544 wrote to memory of 4884	4544	msedge.exe	118
PID 3200 wrote to memory of 6136	3200	igbytqljdbwlgeyw.exe	119
PID 4544 wrote to memory of 1736	4544	msedge.exe	123
PID 4544 wrote to memory of 1736	4544	msedge.exe	123
PID 4544 wrote to memory of 1736	4544	msedge.exe	123
PID 3200 wrote to memory of 5824	3200	igbytqljdbwlgeyw.exe	124
PID 2464 wrote to memory of 2712	2464	davtnlfdxv.exe	126
PID 4544 wrote to memory of 1680	4544	msedge.exe	127
PID 4544 wrote to memory of 1680	4544	msedge.exe	127
PID 4544 wrote to memory of 1680	4544	msedge.exe	127
PID 3200 wrote to memory of 908	3200	igbytqljdbwlgeyw.exe	130
PID 3200 wrote to memory of 2848	3200	igbytqljdbwlgeyw.exe	134
PID 5488 wrote to memory of 2000	5488	tnkicavsnk.exe	136
PID 3200 wrote to memory of 1872	3200	igbytqljdbwlgeyw.exe	139
PID 4544 wrote to memory of 3492	4544	msedge.exe	144
PID 4544 wrote to memory of 3492	4544	msedge.exe	144
PID 4544 wrote to memory of 3492	4544	msedge.exe	144
PID 3200 wrote to memory of 2036	3200	igbytqljdbwlgeyw.exe	145
PID 3328 wrote to memory of 940	3328	xvpnhfcxus.exe	147
PID 3200 wrote to memory of 5600	3200	igbytqljdbwlgeyw.exe	150
PID 4544 wrote to memory of 4672	4544	msedge.exe	152
PID 4544 wrote to memory of 2400	4544	msedge.exe	153
PID 4544 wrote to memory of 3732	4544	msedge.exe	154
PID 3200 wrote to memory of 4668	3200	igbytqljdbwlgeyw.exe	157
PID 4252 wrote to memory of 4192	4252	hfzxrpkhca.exe	159
PID 3200 wrote to memory of 864	3200	igbytqljdbwlgeyw.exe	162
PID 3200 wrote to memory of 3764	3200	igbytqljdbwlgeyw.exe	166
PID 1076 wrote to memory of 5572	1076	pjhezwuomj.exe	168
PID 3200 wrote to memory of 2476	3200	igbytqljdbwlgeyw.exe	171
PID 3200 wrote to memory of 3496	3200	igbytqljdbwlgeyw.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_9cb5cf1e126b30fc266ac9ae79014bd6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Temp\igbytqljdbwlgeyw.exe
  C:\Temp\igbytqljdbwlgeyw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqlidbwq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5052
  - - C:\Temp\aytqlidbwq.exe
      C:\Temp\aytqlidbwq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqlidbwq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Temp\i_aytqlidbwq.exe
      C:\Temp\i_aytqlidbwq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5824
  - - C:\Temp\davtnlfdxv.exe
      C:\Temp\davtnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:908
  - - C:\Temp\i_davtnlfdxv.exe
      C:\Temp\i_davtnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2848
  - - C:\Temp\tnkicavsnk.exe
      C:\Temp\tnkicavsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1872
  - - C:\Temp\i_tnkicavsnk.exe
      C:\Temp\i_tnkicavsnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfcxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\xvpnhfcxus.exe
      C:\Temp\xvpnhfcxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfcxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5600
  - - C:\Temp\i_xvpnhfcxus.exe
      C:\Temp\i_xvpnhfcxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4668
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:864
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwuomj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3764
  - - C:\Temp\pjhezwuomj.exe
      C:\Temp\pjhezwuomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwuomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2476
  - - C:\Temp\i_pjhezwuomj.exe
      C:\Temp\i_pjhezwuomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwromjhbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3496
  - - C:\Temp\zwromjhbzw.exe
      C:\Temp\zwromjhbzw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwromjhbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4988
  - - C:\Temp\i_zwromjhbzw.exe
      C:\Temp\i_zwromjhbzw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2880
  - - C:\Temp\wtoljebwto.exe
      C:\Temp\wtoljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2280
  - - C:\Temp\i_wtoljebwto.exe
      C:\Temp\i_wtoljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\bywqoigayt.exe
      C:\Temp\bywqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4868
  - - C:\Temp\i_bywqoigayt.exe
      C:\Temp\i_bywqoigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\nigaysqkid.exe
      C:\Temp\nigaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2528
  - - C:\Temp\i_nigaysqkid.exe
      C:\Temp\i_nigaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1132
  - - C:\Temp\sqlidavsnl.exe
      C:\Temp\sqlidavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidavsnl.exe ups_ins
    3⤵
    PID:2092
  - - C:\Temp\i_sqlidavsnl.exe
      C:\Temp\i_sqlidavsnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkicaxvpn.exe ups_run
    3⤵
    PID:1404
  - - C:\Temp\pnkicaxvpn.exe
      C:\Temp\pnkicaxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkicaxvpn.exe ups_ins
    3⤵
    PID:5136
  - - C:\Temp\i_pnkicaxvpn.exe
      C:\Temp\i_pnkicaxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcausmkf.exe ups_run
    3⤵
    PID:1832
  - - C:\Temp\pkhcausmkf.exe
      C:\Temp\pkhcausmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcausmkf.exe ups_ins
    3⤵
    PID:3492
  - - C:\Temp\i_pkhcausmkf.exe
      C:\Temp\i_pkhcausmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mheczusmke.exe ups_run
    3⤵
    PID:5652
  - - C:\Temp\mheczusmke.exe
      C:\Temp\mheczusmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mheczusmke.exe ups_ins
    3⤵
    PID:4564
  - - C:\Temp\i_mheczusmke.exe
      C:\Temp\i_mheczusmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhezwrp.exe ups_run
    3⤵
    PID:5060
  - - C:\Temp\wrpjhezwrp.exe
      C:\Temp\wrpjhezwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhezwrp.exe ups_ins
    3⤵
    PID:2260
  - - C:\Temp\i_wrpjhezwrp.exe
      C:\Temp\i_wrpjhezwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjebwu.exe ups_run
    3⤵
    PID:1612
  - - C:\Temp\bztrmjebwu.exe
      C:\Temp\bztrmjebwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjebwu.exe ups_ins
    3⤵
    PID:3408
  - - C:\Temp\i_bztrmjebwu.exe
      C:\Temp\i_bztrmjebwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoigbyw.exe ups_run
    3⤵
    PID:2696
  - - C:\Temp\bywqoigbyw.exe
      C:\Temp\bywqoigbyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoigbyw.exe ups_ins
    3⤵
    PID:3488
  - - C:\Temp\i_bywqoigbyw.exe
      C:\Temp\i_bywqoigbyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqoigay.exe ups_run
    3⤵
    PID:3172
  - - C:\Temp\dbytqoigay.exe
      C:\Temp\dbytqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqoigay.exe ups_ins
    3⤵
    PID:1448
  - - C:\Temp\i_dbytqoigay.exe
      C:\Temp\i_dbytqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoidbv.exe ups_run
    3⤵
    PID:4604
  - - C:\Temp\gdyvqoidbv.exe
      C:\Temp\gdyvqoidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoidbv.exe ups_ins
    3⤵
    PID:260
  - - C:\Temp\i_gdyvqoidbv.exe
      C:\Temp\i_gdyvqoidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a0
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,7778981685583663434,768109472217996502,262144 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,14177589704291208885,10952588324029131060,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,2362071927114499544,8884853003731915090,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,10500851414657679982,13838446479378378855,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,11991450746003796234,12192692343097376632,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,15001407083202647404,18127765015005541659,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,12944319478882990351,11258102177669446164,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,6969324266437790915,10863813175439230852,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,11867379183088676401,18372476795050212605,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,7464427436012483013,17088637193114423967,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,5111227557188008105,9875127461887781931,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,5111227557188008105,9875127461887781931,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,1409673601548705902,16630229084164096831,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,1444813015596027476,12921921390528903278,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6684,i,17733870347742714274,2106147202704898549,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3704,i,11148391408699181014,10058948933423290828,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5736,i,1431348464403681322,16237067021826701413,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,8865657078075427542,6156409808978604750,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,15553407448965670716,4546199380186689255,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,10145248892662835264,5911738864864290471,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,18429798558264052557,11758823440793264813,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3824,i,191233090187198652,9414386861351722080,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,8177128614411500333,8964788059443306449,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,16347590352417174236,17336673047958043988,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,7225067757976289916,13346014032538510911,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,14651204503912754674,16274808915011887426,262144 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:10
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6000,i,8025735938384733194,11993937672987852240,2097152 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,2642342846182267483,4520026770445334636,524288 --field-trial-handle=2396,i,958686760640414003,13621906869914870252,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2540

C:\Temp\igbytqljdbwlgeyw.sys
C:\Temp\igbytqljdbwlgeyw.sys
1⤵
- Executes dropped EXE
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2996

C:\Temp\qnlidbvtnl.sys
C:\Temp\qnlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\vsqkigaxvq.sys
C:\Temp\vsqkigaxvq.sys
1⤵
- Executes dropped EXE
PID:3652

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:3196

C:\Temp\pkhcaxspkh.sys
C:\Temp\pkhcaxspkh.sys
1⤵
- Executes dropped EXE
PID:5876

C:\Temp\rpjhczurpj.sys
C:\Temp\rpjhczurpj.sys
1⤵
- Executes dropped EXE
PID:3172

C:\Temp\ezxrpjhbzt.sys
C:\Temp\ezxrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\wtomgebztr.sys
C:\Temp\wtomgebztr.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\bywqolgdyw.sys
C:\Temp\bywqolgdyw.sys
1⤵
- Executes dropped EXE
PID:4600

C:\Temp\aytqoigayt.sys
C:\Temp\aytqoigayt.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\dxvqnigayv.sys
C:\Temp\dxvqnigayv.sys
1⤵
- Executes dropped EXE
PID:1596

C:\Temp\snkicaxvpn.sys
C:\Temp\snkicaxvpn.sys
1⤵
PID:4556

C:\Temp\pnhfzxvpnh.sys
C:\Temp\pnhfzxvpnh.sys
1⤵
PID:1816

C:\Temp\upnhecaurp.sys
C:\Temp\upnhecaurp.sys
1⤵
PID:5288

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
PID:4892

C:\Temp\ztrpjhbztr.sys
C:\Temp\ztrpjhbztr.sys
1⤵
PID:4592

C:\Temp\ywtqoigbyt.sys
C:\Temp\ywtqoigbyt.sys
1⤵
PID:4828

C:\Temp\ljdbvtrljd.sys
C:\Temp\ljdbvtrljd.sys
1⤵
PID:2484

C:\Temp\dbywqoigdb.sys
C:\Temp\dbywqoigdb.sys
1⤵
PID:5852

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqlidbwq.exe

Path C:\Temp\aytqlidbwq.exe
Size 376KB
SHA256 e4db055a54ce75e34f37196b486ef94791c48b165f99371499310a9994643acd
MD5 70aa5495b718e701e604bbc0d9d68c76
SHA1 794695eb9db34a5368f0cf72deec52a73d2f4d24
SHA512 2086083db4e8407f067432ad719d6a07e6c8fa0c2536dee4cc103ff4ad81acc7fd869fd6642f92b863138f27e67cd46285b62c56f459023011627a60ed1bca89
SSDEEP 3072:VjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdxv.exe

Path C:\Temp\davtnlfdxv.exe
Size 376KB
SHA256 008daa9be8976c4d98a80fb155db4f06a49edbff245e2fcafd34b61103614556
MD5 306d419ebe977d28c83ded4dede362d4
SHA1 d6deab64edaefe4deaa859929fa5f6592b459a8f
SHA512 23c11e090b6bed3c5b2ef6d876f0c75a02b94f0ff5fdbc8def6b7bf5f9f40e54cd182241d57d235248496c3874cd766f12e0649f772a8e6d628858785f8fd3df
SSDEEP 3072:FymjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLxd:44yLJq/IJjiJcbI03GBc3ucY5DCSjXp
TLSH
T13A847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnhfaxs.sys

Path C:\Temp\dxvpnhfaxs.sys
Size 293KB
SHA256 0a1fb04b62336ae1c28f42798b90d0a3af0091890c071a0fab22a113414a29f2
MD5 70628d550d43c9eada1180c953d860dd
SHA1 d3c31b24b434414958a90d5454f57018ed8b1644
SHA512 920fc0806ae1fb954ef0b32bdec6621abe6c30bfb425fd976a7fda21e2f0c46a6355cf366ab70af31476ab2bbe8cc84a438a44e551deeab8fd67f369b02671ce
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhca.exe

Path C:\Temp\hfzxrpkhca.exe
Size 376KB
SHA256 fc08f46c45e4a03d941d4bb077bc7a19bf60e9afa2b9d422f28e83403e6ad7be
MD5 857cf26d9f59cfca3702acc7653b70ff
SHA1 7922b1acc63854a695a4b7d6a320666bc6d8dbb9
SHA512 0bcf3bed6c392352fd9711c0d80fc5b499da050416178e577092b3f6e225061fc70e2519d2aac34d299b5bd1ab908b89f5052d205e0da3c335172cd6fa65b3b0
SSDEEP 3072:qjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:EyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqlidbwq.exe

Path C:\Temp\i_aytqlidbwq.exe
Size 376KB
SHA256 129e5a31590dc50e7c0779b75de47f0d2555e90ffe874d125e284a68ff9e5528
MD5 6cea131dc3f9f534ca0b78adb20bdc99
SHA1 9f9710cc25378e19c1f7964a9aaa917e259e034f
SHA512 58dc4d60c1272543000592cd6dc8932de3277c48c30a5b8945b281de30693d6cdaa12a641a887debd4a6136e2f9a166141be206b6cca39fb60c4e6efbc20da6f
SSDEEP 3072:ejyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T16B847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdxv.exe

Path C:\Temp\i_davtnlfdxv.exe
Size 376KB
SHA256 c2b159c2227b2a6601d99141ac10bc8ea558885bf85d2169a09dfa5fbdd8244b
MD5 cc02fc70545f0b5b0cabe19070e66803
SHA1 290dcb39f1aab866c4b1b351b25b19992617d860
SHA512 16fabffd47bae2771cdf0323ed134e29c5e2775be6a25ddb5c2d6552ef38c79ef7b937b0601947ed497279e67c6cc4e9ccc4227709c6269350b343a5c9f8e756
SSDEEP 3072:5jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T119847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpkhca.exe

Path C:\Temp\i_hfzxrpkhca.exe
Size 376KB
SHA256 86879ea2613e6d02e81ed68ba5107a0af70b6bcf2a8df03686bc333ba21b6de4
MD5 a167454105a874809ffb7c28677c1352
SHA1 658f8a8152974a2b09ea8f91710ebe570d37d372
SHA512 71022b0153ec961db4b64742575b66a02f3fff92c8b91e3f476f25b580a460a72e764723fc59cc3f9f7c7306475ef7d335ce3821ae19bc0221ac69234ccec3a6
SSDEEP 3072:mjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnkicavsnk.exe

Path C:\Temp\i_tnkicavsnk.exe
Size 376KB
SHA256 1ca5dfc46e596480ef17d4c852f4a86237887666b5bf0de0e43e7ae54259fe99
MD5 c8a7d47d772e39dffe23ad740ae2cf8a
SHA1 6cad3372d961a34fd4e11177da87fa5cf9e40f30
SHA512 b8d0a82db64bb410ad3e3a8a3f28093384c5c0e9c3fced318cfe469685fa26550b500c663d9aafc66f31cf5cf9218690b3bd800c3cc896745a2881a711e18ae8
SSDEEP 3072:EjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ayLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfcxus.exe

Path C:\Temp\i_xvpnhfcxus.exe
Size 376KB
SHA256 164155ed0c6227bba03bc166dba9ac21fd4a71900bf0cfbe3e503543993523df
MD5 bfee4ba716f922cfc02320465ba270bb
SHA1 6251d0f2e460140a988be3950b9d0a49484a63de
SHA512 736719a9337eb9ee8a0fb7b330dd0c0c99fef753f5bcae8c881b50c53701714f63a9af84260002a9698549fb38044318706e6bc6310fe625a7e1d727d7e4a2f0
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T171847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytqljdbwlgeyw.exe

Path C:\Temp\igbytqljdbwlgeyw.exe
Size 376KB
SHA256 f0ec6966114b30bbbf69b2d21e1f64141bfdb9e2dd54d8f4d1549e2670ae6d37
MD5 6750e63575912ac087b86a671b475ba3
SHA1 76e0cef60051c8f0c32c2729feefdad9310fc851
SHA512 9589ebad7c70915b349095d2c94a950ba5a426a340d1ca90b5495d6d978cf8ccf13290c384705ad6e633019c6ccf78c4a76b3b3e2433f39078a8cff7e50f8fa2
SSDEEP 3072:6jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytqljdbwlgeyw.sys

Path C:\Temp\igbytqljdbwlgeyw.sys
Size 293KB
SHA256 df8fd389d4fcfd3c667ea94f3228852af6086d84fec02e77476fc558986dff7f
MD5 9f8e2f6961082bb8cd24a24a24b75d9d
SHA1 5bc5fe6c52bf9cf0c737cee038493e78c10b59f3
SHA512 08475994240eba06444bfc7af09e2b896d58c94e66c4a378059546f60392cf395b58b7e7c20da5a151048c70fddcc6757828ffa003e30311f9514b6108bb00b9
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhezwuomj.exe

Path C:\Temp\pjhezwuomj.exe
Size 376KB
SHA256 b776914100b297c582037e8cbce556eee062dca530faa17ddd466c13286227a1
MD5 b2cfd1653f75d738e1dcf69192c163c0
SHA1 c907879566e5dcd488b807839b2101952302077a
SHA512 77cb7de76a92e091d90714922402350b164f383c51abdc8d0684747f691be5e232727ebb483064d70e1525e5ab1b4175661f3d508fbf13f3be23ed7d0369a915
SSDEEP 3072:UjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcaxspkh.sys

Path C:\Temp\pkhcaxspkh.sys
Size 293KB
SHA256 07c8283a39037cc6aa7688cdce3c3600e7130a9e02f9cb37b5743939b6a22d74
MD5 5c17e33847450ca8d9be75292e7ed731
SHA1 c2780e218147d24618d556b8ae7448da7c470e32
SHA512 d3462b28ac82528422e965d566c713da189c4ebc4bfa945fd121d863854120e1bc12437140ed801cab2db42e21ce96929e2d7e50b0243112c641ed63609a3076
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlidbvtnl.sys

Path C:\Temp\qnlidbvtnl.sys
Size 293KB
SHA256 ab637aef7d03c2f2053c549c9b4a845741df9a17f8e989440969ab6c17ea5225
MD5 043638dd71d593505e6031d3ce3f5716
SHA1 59ab611c1633ced66ae7c72d110dd4d95243465e
SHA512 9b5d19f6a30694bf09b24b8a7ac936e7aaeb9dc8a269dbc2e22602a8a63366c079c6a60b24ed029364f22a1238db30362090ee591d8b9f6d59ebd350bafdfead
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczurpj.sys

Path C:\Temp\rpjhczurpj.sys
Size 293KB
SHA256 c794bf864c4c6ec156e28c9afc345f377a24e63e11905dfd87d5e54e566b5655
MD5 4d31bee7ab0ac3482288368d129b249e
SHA1 3863fb36e042dc4af6a510f59c9fcc7311014bbe
SHA512 bc2dd450159e997746f420c3bd084a3d153ee19c69102823f62fc32581244b475458e2851d62ae601e90716ac1ba41232ada04f1bb93b0fb8849debad788a9a6
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnkicavsnk.exe

Path C:\Temp\tnkicavsnk.exe
Size 376KB
SHA256 84e2e2ad82fe64e31f3fc9a174f4228933f2f6cf99c8f2d5a439b537693ee3b1
MD5 f77a5e9a0cecb5ce7ec313bac2f1d4dd
SHA1 ffdf779b5afe8a43321ef3dc8ce3240bf01ab154
SHA512 d79951f44d3706ef6dff3f8d001044577162b16fc6502636ceae176c1be25746a910a7f2f5b07d7c8840ec5e063624f439ce4f69988b0e2867ae912709a62d6b
SSDEEP 3072:zjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkigaxvq.sys

Path C:\Temp\vsqkigaxvq.sys
Size 293KB
SHA256 96f9bc35f8289e9754df81bb1d4721132c01894c4170b6975608e4f5c612544a
MD5 10a5565fb7b1c38dde073e0720fe845f
SHA1 91ac2075a602925ceaa7508aa0066cbdca88f726
SHA512 6eef33cc73bdf5b8d3f715bc45cb9aa483961b71f1198ea0b3828593174d373574056365b2de0e1156cb9f5e9580ca217bf1cd82baa5c1504d494a4aeb6bf056
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T113545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfcxus.exe

Path C:\Temp\xvpnhfcxus.exe
Size 376KB
SHA256 5bedb36d5ddc3a22f3115636ecd6407e74eda9c120c2f96ee6664bede3365d14
MD5 d42217edb0e777294d565528a610c5d4
SHA1 42f47ec92258b58ea22d75b3e2927e1e12e49aa9
SHA512 c8f249561ae4b27c23e7790db9f12a801cc625959c8585c81b5079aba0e6a60b65113ae08c503bb1e933a55406216ec79df8f9f1cc78274c3b2a664cc5cffb4c
SSDEEP 3072:sjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1f85c670864985e6fb2564bbb01eb8a63073ccc6b9d0c28b4e899d420840c4a8
MD5 490d8cfa777638427a280854a58f6121
SHA1 fda018e146f700f2b322f6dc5f522d6a2a57b468
SHA512 8c947a3c31192fd4518f35f7ae36608c1f976931ae7409e0c88ab10ddbc7baacdfd79745b96e478a624fc8916ca9295bbeb4685e09bc81e3c9c65a2b1edf49e2
TLSH
T12541D8D41BE90AC2DBFC8EF560E1AADD37F0D4AE41176E8164422E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ce62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ce62.TMP
Size 2KB
SHA256 84e809577d3ca29404794d9658b8253e8df32930fae6015dce48d150ab5cff2d
MD5 412f555be5e4a468d022094988f28c2e
SHA1 b02f9e5ce5533c40c7e34b6512b1392d8f4eb1ec
SHA512 f6e25f3ea5eca4c08389a3b6415fefa3452729ac739ebb7d460e2e1583353682b0de408026e84342c8ae3136da7ee8e036e72896d95f27443ea9f0ea6c602e4c
TLSH
T18741E7D40BE90AC2DBFC8EF660E16ADD33F0C4AE00176E8164422E701B0AF9691D2973
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b93b5bef15d9ec5af78aab64298bad7d65f2b5188723453a42eabf34488575dd
MD5 c9e703e94d89c6743df399094b520363
SHA1 e243e7ecd77fc0150a43a123ebb0c3aab300e72a
SHA512 8c506e07c8cf92db0636692e948939b147f5a4fd68abe45f72746e03ca91b207ef65a3f312266394d32a9e29ba9e1c1b131ac4412b8fb83f3fd32dd9bde5114e
TLSH
T1D951AFF7C7E8862EC90156F0AB187E2BDE2D0914432C3D5AC9E4AF1BA7E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f2563c15e4c659c629d728ba96cc92f42b106e50420425340892e88449b20bf
MD5 b9ce7075eef0c6742a089eaf0c669aaf
SHA1 85731952289739adbedf3aebf0afc5dacd052a35
SHA512 27e578599faef0cefbba5e3663ca3e6352fe569d645aef9b4077d23a15d2abeec7c10151ad545cd6ab9531f85074e835b383c948b12c7b8f523c1bb46d45148e
SSDEEP 192:sxRMRrCi/fMsegAiZWzoD8pi/g6+WNIYCsuOcG4IgtJ:sxRMAi/fMsegAkKi/5Ies3
TLSH
T13932D6166E28AD3B9CC7E21DBB65BF53D6F95032A1D42A48A7FC870C04E76CD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 10b9a0c90cbbe66459b06721f055a3fadcefc6a7be3193f2bfef1bf3078381c1
MD5 c54f5cd8a2765231b095b7b608ff2176
SHA1 8bb4dc4e32d3c68cb8496e98b21e3b26868d3e5c
SHA512 d07a81ec80778f9a275e09c1102066ea5ab128d08a93328199d8e17956f207866dc9abd90f9c5b2375effeb060f6a2ff5f1bd39524073c1696f844d7baad3d3a
SSDEEP 192:sxRfRrCi/fMsFgAiZKzoD8p9L/g6+WNIYCyuOcG4IgDAJ:sxRfAi/fMsFgAk2p/5IQsw
TLSH
T12632D7166A28AD3B9CC7D21DBB65BF53D6F95032A1D02E48A7FC870C04E76CD520381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 830cd1e48a8715ff9f2073ef17c1eac774700cad53589a175a215a1d5e760493
MD5 fcdb15691460c21ccef4cc8401bb76ce
SHA1 f3c8df67f452ff2e7e690834bedb138f3d725ae2
SHA512 2c8195618aee272326dde87217178b6cd6c704d7af76c9053925508b426ec00043e4dcfc2c17067079b81c6ce4b67bd2b3709066f1280733171e6cc57ca03316
SSDEEP 192:sxRfRrCi/fMsFgeiZKzoD8p9L/g6+WNIYCluOcG4IgD2J:sxRfAi/fMsFgek2p/5IRse
TLSH
T18942E8166A28AD3B9CC7E21DBB55BF53E2F95032A1D42E48A7FC870C04E76CD520381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0075b5c096c4e78cc9363b5297c9c3b1a1f6c7e164e017cea2433e2d1dbb2c46
MD5 ba414b94c62646a85064706866f041ec
SHA1 d79091a455272675a3981752a608f5b81086ae7b
SHA512 e1249768ed28af2e8c3a32d3e96143327ac9462ad0c24142b84c47a8ca127a180a40dee21195e2074a99f99aea3aa78478552f18d2e333dfb526b58f10d45297
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTZ0Qqc+roZGv:jC+vf7E7JQWgQ+f4+u1ja8Z0VcVkv
TLSH
T15BD2DB7B640DCB7F4F804ADDAC197E9E6DA802CB9698CD4047FA941C02C67EB52154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9614b3ea7e6b8d3150b53744859096a518999195b032b3e8e673b3859bdd1646
MD5 dc0f4efbb027bf827340a0c53d633698
SHA1 8e522f5c627e7e2724f42bffacbcb110db39062d
SHA512 ff18d917ec9e0f0307b2d0c2642af574fd693e079848c363bbaf52ce82af538e244bd820fbf247c4b41dab8ab2682aaaa53e939eeecf411639584dd6845775cb
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9lM0gK5mSqz:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VPH
TLSH
T11C91995071BA42513C3DB50C81788C6ADAC270B73459A56B3FA845670FA7E43DEFDAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 52557976134c773f5ad963c327870e0cb9deecfd2878e8e05f36e00e5b7442b3
MD5 0f7f898b2139fcd26caa078e677e0528
SHA1 a00be17bcc27783ce0f213635c7f367cb72e7792
SHA512 4adc363800a01c45bde60a557e43561aee264ed77021c4ec765118661a18c043120b9321148132a42b38efaa0840f3bb369f6cf836c2c87247894bae401ef199
SSDEEP 768:Irv+4UNbdD31cQVTNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp3pL8+p3Z6n4yG0ww
TLSH
T15903CF33E8A899739CF6C648B2467B433FF851A396C10AC4D4DD2B4E419A19E230BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d360fdb150747a1a6e6ef8f45a45e24e435b624671565b7e4a13706fe4cc243f
MD5 8cff460f434764e196a982e4bfcf4271
SHA1 c4920987915565a374c025080bfee2ae10c33406
SHA512 544c681f7db80aa4c8d037572e9b8a8b6c20d495744507cf8ba71e15c5bd6988203eeb43fc152250ccddb9dbbd4a431b875bdb0c80391d4679fc94a31a9b3456
SSDEEP 768:2j+9X3WWnQVPQp8+p3bd66j+4BRv86aLIWRb9MD:l9X3Wdu8+p3Z6n4yLb+D
TLSH
T1ACF2AF31E8698E339CE6C658B2973B836EF411B396C01ED8D8DD6B0D049726D170BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 087be67e928b9fe72d24f32f751eba0170d4788c5a680a95e196cade4e34005a
MD5 5ca557644d5c90a347e618ad7b611b32
SHA1 6f53234904483bede714edbfec0183a659381ffa
SHA512 4bd5624e83ac9447fa89a4388c95c5e71c9a555871b4ba73ae43c1f049eb7262ab9d8b7289e7ab467e6e0c1b86cdc76f44afae5e075d0887f57299c54fd0318c
SSDEEP 768:urv+4UNbd13l/nQVPBp8+p3bd66j+4BRv86aLIWRx:ubsbL3le/8+p3Z6n4yLx
TLSH
T17503BF72E8699D339CF6C648B18637837EB810A396C10E94D9D92B4D44971AE270BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5a2b2d76f58f041e3b982f3d7771dfe0212278657e9eb610e5374ffe2e34731c
MD5 122c71a6ea40ffc6fe905e73eedb76b7
SHA1 8dd3ae3c6365a96e4d31dad39bed2bcef9c8aab8
SHA512 b7fd738a985b00cc4a88073900d0b2a5241653d090edeba32003268ead0886982a4a44109a06a1da57a25925cc328b9e97ba09b02dfd16bf893ba664bd93080b
SSDEEP 768:Tj+9X3lWnQVPQp8+p3bd66j+4BRv86aLIWRb9MD:29X3ldu8+p3Z6n4yLb+D
TLSH
T1E4F2AF31E8698E739CE6C658B2973B876EF411B396C01EC8D8DD6B0D049726D170BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3f34869dcc06cfc6056013501730ebedd0e97a3219fe5cf58109fc7167bff72f
MD5 84db9fab012b9b4906cdcd720dc9f4c3
SHA1 117a26fcbd475bd397c1043f9b526193e70727f6
SHA512 e4e3e31485ca65764990c6a969975b2b7383c49f8adff71636cba5da444635f87ee5fbbccf01ed5c188a3db071fb711855ae029bec31e754e333734c17a96c69
SSDEEP 768:Nj+9C3WW0RVXp8+p3bd66j+4BRv86aLIWRb9MD:o9C3WH8+p3Z6n4yLb+D
TLSH
T16AF29E75E869CF279CE2C395B3463B87AEE411A386C41DC8D8D96F4D00C72AD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_1687481127\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 6caa75d2274bb5141bb0a32be12055cf1bab18c8a4eb64077039c8b54137e58a
MD5 e3f1cdc5fcf3b7227dd9d033c6b0c30f
SHA1 bd9fbeb340adcb5c119e08faa255a249d6309512
SHA512 3a27624b6ca1e70ee97da7600cebfb673a846cdd3cb31a28a41151e3408447b570aa6d2efefe661d1f964fb995001e12bcca69436de4853a65b3319aa58e4d33
TLSH
T14E71278357A8D5B3C1DE9BF503835644F1FB123C072330600B91558BAB30A7658B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1596-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1816-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2160-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2484-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2484-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3172-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3172-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3652-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3896-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4556-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4592-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4892-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4892-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5288-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5676-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5876-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download