systex | b943cd9a613bcbeaad11466c2de47ebaef873bfc3376cadceaec44980ffecdd4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260813-wngr6st1hv
SHA256 b943cd9a613bcbeaad11466c2de47ebaef873bfc3376cadceaec44980ffecdd4
MD5 9bab3c3018180449b41e114b6ad43b0f
SHA1 1086db9ac8ee5ca615c7797ef2aa4e795ab81f22
SHA512 45797e210765944bd0aff228ab695a3245fd2b9ad8d63ddf6880966c9f9cc7c812ebf1a6bdf042cb16e499a54dd835955dafa30c6c3b2fa9df3cd355c24979f4
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2584	omgebwtrljebwuom.exe
1476	omgebwtrljebwuom.sys
4580	CreateProcess.exe
1196	wqojgeztrm.exe
4192	CreateProcess.exe
712	CreateProcess.exe
1660	i_wqojgeztrm.exe
2744	oljdbvtolj.sys
976	CreateProcess.exe
4928	qoigdywqoi.exe
2044	CreateProcess.exe
752	CreateProcess.exe
4140	i_qoigdywqoi.exe
5364	dyvqoigays.sys
5604	CreateProcess.exe
2128	vtqoigaysq.exe
5932	CreateProcess.exe
1348	CreateProcess.exe
628	i_vtqoigaysq.exe
4376	ifdxvqnifd.sys
3696	CreateProcess.exe
4408	kidxvpnifa.exe
4760	CreateProcess.exe
4212	CreateProcess.exe
2644	i_kidxvpnifa.exe
3932	ausnkicavs.sys
3844	CreateProcess.exe
1268	causqkicau.exe
3260	CreateProcess.exe
2352	CreateProcess.exe
1100	i_causqkicau.exe
5832	nkfcausnki.sys
5256	CreateProcess.exe
1484	fzxrpnhfzx.exe
2660	CreateProcess.exe
628	CreateProcess.exe
2912	i_fzxrpnhfzx.exe
1408	hfzxrpmhfc.sys
3224	CreateProcess.exe
1296	eczurpmhfz.exe
2816	CreateProcess.exe
3344	CreateProcess.exe
1908	i_eczurpmhfz.exe
4720	gezwromkec.sys
4896	CreateProcess.exe
2624	mgecwuomge.exe
2756	CreateProcess.exe
5584	CreateProcess.exe
4440	i_mgecwuomge.exe
2872	geywtoljgb.sys
4576	CreateProcess.exe
5596	bztrojgbzt.exe
2740	CreateProcess.exe
5096	CreateProcess.exe
1864	i_bztrojgbzt.exe
3584	eywqojgeyw.sys
1076	CreateProcess.exe
1408	lgdywqoiga.exe
932	CreateProcess.exe
5048	CreateProcess.exe
2480	i_lgdywqoiga.exe
4752	nljgbytqlj.sys
4824	CreateProcess.exe
5816	olgdbvtqlg.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_1171971699\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_2089501011\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_1171971699\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_2089501011\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_2089501011\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_2089501011\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_468804411\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_103943983\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_103943983\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwuojeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgeztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbvtqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwuojeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgeztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbvtqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxvpnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurpmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxvpnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwtrljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurpmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecwupmh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4844	ipconfig.exe
3032	ipconfig.exe
3300	ipconfig.exe
4444	ipconfig.exe
5948	ipconfig.exe
4612	ipconfig.exe
3820	ipconfig.exe
2264	ipconfig.exe
5060	ipconfig.exe
1860	ipconfig.exe
5132	ipconfig.exe
5084	ipconfig.exe
1660	ipconfig.exe
1068	ipconfig.exe
5656	ipconfig.exe
6016	ipconfig.exe
1820	ipconfig.exe
5448	ipconfig.exe
5948	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311178442560409"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{C67F2133-B4A0-4D82-8E5D-67371F6674E7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe
2584	omgebwtrljebwuom.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	i_wqojgeztrm.exe
Token: SeDebugPrivilege	4140	i_qoigdywqoi.exe
Token: SeDebugPrivilege	628	i_vtqoigaysq.exe
Token: SeDebugPrivilege	2644	i_kidxvpnifa.exe
Token: SeDebugPrivilege	1100	i_causqkicau.exe
Token: SeDebugPrivilege	2912	i_fzxrpnhfzx.exe
Token: SeDebugPrivilege	1908	i_eczurpmhfz.exe
Token: SeDebugPrivilege	4440	i_mgecwuomge.exe
Token: SeDebugPrivilege	1864	i_bztrojgbzt.exe
Token: SeDebugPrivilege	2480	i_lgdywqoiga.exe
Token: SeDebugPrivilege	436	i_olgdbvtqlg.exe
Token: SeDebugPrivilege	4348	i_nigaysqlid.exe
Token: SeDebugPrivilege	3792	i_icaxvpnkic.exe
Token: SeDebugPrivilege	3424	i_nhfzxvpkic.exe
Token: SeDebugPrivilege	1612	i_rpkhczusmk.exe
Token: SeDebugPrivilege	1536	i_pmkecwupmh.exe
Token: SeDebugPrivilege	2264	i_jhezwuojeb.exe
Token: SeDebugPrivilege	2328	i_jdbytrojge.exe
Token: SeDebugPrivilege	616	i_ljdbwtoljd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2584	4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4456 wrote to memory of 5216	4456	2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5216 wrote to memory of 4472	5216	iexplore.exe	91
PID 4472 wrote to memory of 4812	4472	msedge.exe	92
PID 4472 wrote to memory of 4784	4472	msedge.exe	93
PID 4472 wrote to memory of 2332	4472	msedge.exe	94
PID 4472 wrote to memory of 4784	4472	msedge.exe	93
PID 4472 wrote to memory of 4784	4472	msedge.exe	93
PID 4472 wrote to memory of 3176	4472	msedge.exe	95
PID 4472 wrote to memory of 3176	4472	msedge.exe	95
PID 4472 wrote to memory of 3348	4472	msedge.exe	97
PID 4472 wrote to memory of 1908	4472	msedge.exe	98
PID 4472 wrote to memory of 3348	4472	msedge.exe	97
PID 4472 wrote to memory of 3348	4472	msedge.exe	97
PID 4472 wrote to memory of 1908	4472	msedge.exe	98
PID 4472 wrote to memory of 1908	4472	msedge.exe	98
PID 4472 wrote to memory of 1256	4472	msedge.exe	99
PID 4472 wrote to memory of 1256	4472	msedge.exe	99
PID 4472 wrote to memory of 1256	4472	msedge.exe	99
PID 4472 wrote to memory of 5856	4472	msedge.exe	100
PID 4472 wrote to memory of 5856	4472	msedge.exe	100
PID 4472 wrote to memory of 5856	4472	msedge.exe	100
PID 4472 wrote to memory of 3172	4472	msedge.exe	101
PID 4472 wrote to memory of 3172	4472	msedge.exe	101
PID 4472 wrote to memory of 3172	4472	msedge.exe	101
PID 4472 wrote to memory of 4560	4472	msedge.exe	102
PID 4472 wrote to memory of 4560	4472	msedge.exe	102
PID 4472 wrote to memory of 5060	4472	msedge.exe	105
PID 4472 wrote to memory of 5060	4472	msedge.exe	105
PID 4472 wrote to memory of 5060	4472	msedge.exe	105
PID 4472 wrote to memory of 2352	4472	msedge.exe	108
PID 2584 wrote to memory of 4580	2584	omgebwtrljebwuom.exe	110
PID 1196 wrote to memory of 4192	1196	wqojgeztrm.exe	114
PID 4472 wrote to memory of 2592	4472	msedge.exe	117
PID 4472 wrote to memory of 2592	4472	msedge.exe	117
PID 4472 wrote to memory of 4176	4472	msedge.exe	118
PID 4472 wrote to memory of 4176	4472	msedge.exe	118
PID 4472 wrote to memory of 2912	4472	msedge.exe	119
PID 4472 wrote to memory of 2912	4472	msedge.exe	119
PID 4472 wrote to memory of 1964	4472	msedge.exe	120
PID 4472 wrote to memory of 1964	4472	msedge.exe	120
PID 2584 wrote to memory of 712	2584	omgebwtrljebwuom.exe	121
PID 4472 wrote to memory of 2872	4472	msedge.exe	123
PID 4472 wrote to memory of 2872	4472	msedge.exe	123
PID 4472 wrote to memory of 2872	4472	msedge.exe	123
PID 2584 wrote to memory of 976	2584	omgebwtrljebwuom.exe	126
PID 4928 wrote to memory of 2044	4928	qoigdywqoi.exe	128
PID 2584 wrote to memory of 752	2584	omgebwtrljebwuom.exe	131
PID 2584 wrote to memory of 5604	2584	omgebwtrljebwuom.exe	135
PID 2128 wrote to memory of 5932	2128	vtqoigaysq.exe	137
PID 2584 wrote to memory of 1348	2584	omgebwtrljebwuom.exe	140
PID 2584 wrote to memory of 3696	2584	omgebwtrljebwuom.exe	145
PID 4408 wrote to memory of 4760	4408	kidxvpnifa.exe	147
PID 2584 wrote to memory of 4212	2584	omgebwtrljebwuom.exe	150
PID 4472 wrote to memory of 2264	4472	msedge.exe	152
PID 4472 wrote to memory of 4720	4472	msedge.exe	153
PID 4472 wrote to memory of 1476	4472	msedge.exe	154
PID 2584 wrote to memory of 3844	2584	omgebwtrljebwuom.exe	157
PID 1268 wrote to memory of 3260	1268	causqkicau.exe	159
PID 2584 wrote to memory of 2352	2584	omgebwtrljebwuom.exe	162
PID 4472 wrote to memory of 4500	4472	msedge.exe	164
PID 4472 wrote to memory of 4500	4472	msedge.exe	164
PID 4472 wrote to memory of 4500	4472	msedge.exe	164
PID 2584 wrote to memory of 5256	2584	omgebwtrljebwuom.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_9bab3c3018180449b41e114b6ad43b0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Temp\omgebwtrljebwuom.exe
  C:\Temp\omgebwtrljebwuom.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgeztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4580
  - - C:\Temp\wqojgeztrm.exe
      C:\Temp\wqojgeztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgeztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:712
  - - C:\Temp\i_wqojgeztrm.exe
      C:\Temp\i_wqojgeztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:976
  - - C:\Temp\qoigdywqoi.exe
      C:\Temp\qoigdywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:752
  - - C:\Temp\i_qoigdywqoi.exe
      C:\Temp\i_qoigdywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5604
  - - C:\Temp\vtqoigaysq.exe
      C:\Temp\vtqoigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1348
  - - C:\Temp\i_vtqoigaysq.exe
      C:\Temp\i_vtqoigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3696
  - - C:\Temp\kidxvpnifa.exe
      C:\Temp\kidxvpnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4212
  - - C:\Temp\i_kidxvpnifa.exe
      C:\Temp\i_kidxvpnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3844
  - - C:\Temp\causqkicau.exe
      C:\Temp\causqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2352
  - - C:\Temp\i_causqkicau.exe
      C:\Temp\i_causqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5256
  - - C:\Temp\fzxrpnhfzx.exe
      C:\Temp\fzxrpnhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:628
  - - C:\Temp\i_fzxrpnhfzx.exe
      C:\Temp\i_fzxrpnhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurpmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3224
  - - C:\Temp\eczurpmhfz.exe
      C:\Temp\eczurpmhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurpmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\i_eczurpmhfz.exe
      C:\Temp\i_eczurpmhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgecwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\mgecwuomge.exe
      C:\Temp\mgecwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgecwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\i_mgecwuomge.exe
      C:\Temp\i_mgecwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4576
  - - C:\Temp\bztrojgbzt.exe
      C:\Temp\bztrojgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5096
  - - C:\Temp\i_bztrojgbzt.exe
      C:\Temp\i_bztrojgbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1076
  - - C:\Temp\lgdywqoiga.exe
      C:\Temp\lgdywqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\i_lgdywqoiga.exe
      C:\Temp\i_lgdywqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdbvtqlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Temp\olgdbvtqlg.exe
      C:\Temp\olgdbvtqlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdbvtqlg.exe ups_ins
    3⤵
    PID:4440
  - - C:\Temp\i_olgdbvtqlg.exe
      C:\Temp\i_olgdbvtqlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqlid.exe ups_run
    3⤵
    PID:5740
  - - C:\Temp\nigaysqlid.exe
      C:\Temp\nigaysqlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqlid.exe ups_ins
    3⤵
    PID:4120
  - - C:\Temp\i_nigaysqlid.exe
      C:\Temp\i_nigaysqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxvpnkic.exe ups_run
    3⤵
    PID:4740
  - - C:\Temp\icaxvpnkic.exe
      C:\Temp\icaxvpnkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxvpnkic.exe ups_ins
    3⤵
    PID:2480
  - - C:\Temp\i_icaxvpnkic.exe
      C:\Temp\i_icaxvpnkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxvpkic.exe ups_run
    3⤵
    PID:4864
  - - C:\Temp\nhfzxvpkic.exe
      C:\Temp\nhfzxvpkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxvpkic.exe ups_ins
    3⤵
    PID:6040
  - - C:\Temp\i_nhfzxvpkic.exe
      C:\Temp\i_nhfzxvpkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhczusmk.exe ups_run
    3⤵
    PID:3496
  - - C:\Temp\rpkhczusmk.exe
      C:\Temp\rpkhczusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhczusmk.exe ups_ins
    3⤵
    PID:3924
  - - C:\Temp\i_rpkhczusmk.exe
      C:\Temp\i_rpkhczusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecwupmh.exe ups_run
    3⤵
    PID:4936
  - - C:\Temp\pmkecwupmh.exe
      C:\Temp\pmkecwupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecwupmh.exe ups_ins
    3⤵
    PID:4688
  - - C:\Temp\i_pmkecwupmh.exe
      C:\Temp\i_pmkecwupmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwuojeb.exe ups_run
    3⤵
    PID:5200
  - - C:\Temp\jhezwuojeb.exe
      C:\Temp\jhezwuojeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwuojeb.exe ups_ins
    3⤵
    PID:4248
  - - C:\Temp\i_jhezwuojeb.exe
      C:\Temp\i_jhezwuojeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytrojge.exe ups_run
    3⤵
    PID:2152
  - - C:\Temp\jdbytrojge.exe
      C:\Temp\jdbytrojge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytrojge.exe ups_ins
    3⤵
    PID:4900
  - - C:\Temp\i_jdbytrojge.exe
      C:\Temp\i_jdbytrojge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtoljd.exe ups_run
    3⤵
    PID:1112
  - - C:\Temp\ljdbwtoljd.exe
      C:\Temp\ljdbwtoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtoljd.exe ups_ins
    3⤵
    PID:1168
  - - C:\Temp\i_ljdbwtoljd.exe
      C:\Temp\i_ljdbwtoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:616
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8bafac188,0x7ff8bafac194,0x7ff8bafac1a0
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16590110193829628277,3685797902401442344,262144 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,6276869741626711168,652697370077397480,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
      4⤵
      System Time Discovery
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,9792142835484799162,14279430724131814107,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,11849062332119624476,3352181212394680121,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,13126189309126633154,5216881024728041153,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,16655430392753076055,6216160025079772598,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,5434069200123492979,10047964036583805185,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3780,i,8099734801192445313,6995365942834344443,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,4561484123741528311,7813620022867453421,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5348,i,10835297031871900194,14961746773669008492,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3280412168960735345,14535239198136255739,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3280412168960735345,14535239198136255739,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,14104220946629960727,16036499692970843718,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,7175622905039114399,11623891248225954587,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9421874477061825929,1958659751078134063,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15466592276805805500,228447362262189222,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6848,i,9283727267520517561,15579302539532774584,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,17227247309646372496,13875467187255999448,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,6626936999739476329,1150383523696994875,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,7566996631175196277,4905440522020133134,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6472,i,4388075864558500930,14119836888646634666,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,1254528230246559738,1245715609744100550,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,3144035939851847001,11048406458624067255,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2740,i,9173267029405992777,2332505859175781143,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6724,i,11665715267894216688,8153719781802155498,2097152 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,18443264143284676686,13983176289983262996,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5920,i,14683645639562012856,7781547069291827161,262144 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:10
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,16327903569179191226,10303397359100207239,524288 --field-trial-handle=2336,i,2767509203316480872,8857543536717398712,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:14
      4⤵
      PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4348

C:\Temp\omgebwtrljebwuom.sys
C:\Temp\omgebwtrljebwuom.sys
1⤵
- Executes dropped EXE
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5780

C:\Temp\oljdbvtolj.sys
C:\Temp\oljdbvtolj.sys
1⤵
- Executes dropped EXE
PID:2744

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:5364

C:\Temp\ifdxvqnifd.sys
C:\Temp\ifdxvqnifd.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\ausnkicavs.sys
C:\Temp\ausnkicavs.sys
1⤵
- Executes dropped EXE
PID:3932

C:\Temp\nkfcausnki.sys
C:\Temp\nkfcausnki.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\hfzxrpmhfc.sys
C:\Temp\hfzxrpmhfc.sys
1⤵
- Executes dropped EXE
PID:1408

C:\Temp\gezwromkec.sys
C:\Temp\gezwromkec.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\geywtoljgb.sys
C:\Temp\geywtoljgb.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Temp\eywqojgeyw.sys
C:\Temp\eywqojgeyw.sys
1⤵
- Executes dropped EXE
PID:3584

C:\Temp\nljgbytqlj.sys
C:\Temp\nljgbytqlj.sys
1⤵
- Executes dropped EXE
PID:4752

C:\Temp\tnlidavsqo.sys
C:\Temp\tnlidavsqo.sys
1⤵
PID:5868

C:\Temp\fdxvpnkica.sys
C:\Temp\fdxvpnkica.sys
1⤵
PID:3476

C:\Temp\xsqkhfaxvp.sys
C:\Temp\xsqkhfaxvp.sys
1⤵
PID:4392

C:\Temp\smkecauspk.sys
C:\Temp\smkecauspk.sys
1⤵
PID:3700

C:\Temp\mhezxupmhe.sys
C:\Temp\mhezxupmhe.sys
1⤵
PID:4276

C:\Temp\ljhbzwrpmg.sys
C:\Temp\ljhbzwrpmg.sys
1⤵
PID:4756

C:\Temp\rljgebwtol.sys
C:\Temp\rljgebwtol.sys
1⤵
PID:1108

C:\Temp\igebwtolgd.sys
C:\Temp\igebwtolgd.sys
1⤵
PID:4460

C:\Temp\gayvqnlfda.sys
C:\Temp\gayvqnlfda.sys
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausnkicavs.sys

Path C:\Temp\ausnkicavs.sys
Size 293KB
SHA256 783c0d201d939f827be16587cad9823280727c59c8158289616d88d15dbea6fa
MD5 85fcec781ff28cc0af928cb0839df5e6
SHA1 86571a2bc6f4ee06299fd7cdef0664b2293f37c2
SHA512 26121a3b963a78712a08875360e53cc1022aa881061104d1c4e678cc9ff6cc06c43f56199511a7471cb0f3bf59cc66da2ae6ab896b40a5707454fa8f7715ba9c
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causqkicau.exe

Path C:\Temp\causqkicau.exe
Size 389KB
SHA256 8def26ef3259444f3f3a3b25a401590572cf3532bd9f40c7105127e10c34d373
MD5 3ebf2e37e9716ceda4995077bb1f4a35
SHA1 c16f58f913e40f83acc7f77ff7f64ff77e9165ea
SHA512 64658df2dcf7d0f0c7a00a2e5fdec383ee452af2f91b758ac0db9e7d220b24b7acbb78e188a719dbbac40011f2232ca60115de12f8f269308d76e687bfb7e1d0
SSDEEP 3072:5uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigays.sys

Path C:\Temp\dyvqoigays.sys
Size 293KB
SHA256 858251407902ef029ec590a86d0387e956056fd4396f61613cc4077eaa792ba3
MD5 8d3d7a936bed442e0c687af788ee8738
SHA1 04972ab5cd8de33572224e1a9de66d74ba1f4aed
SHA512 99664af046e27e35e66ff4c20833d9dc7fcbddb7f8d126d7e10012ccf952dce45dec4cbaa57815b3b1c9e1b02c26f68a9fe252d3034c36aed069e8a765963617
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causqkicau.exe

Path C:\Temp\i_causqkicau.exe
Size 389KB
SHA256 43a647fd103ee100250ebe1c815fb0acd14164d107075062d87bbb3766eefd43
MD5 594c9d17aabf2e91aacaf33f7ec42079
SHA1 7c79e75210321f01d086186499dbd756f832ab9f
SHA512 fbab0e96a976574ce316e118965e9c767e74dbd25c4ec12cf9bd5924104e248e1280f421f881b293693a9b28bc3f4e3f5a41de1e634100469021c1028e95fe9e
SSDEEP 3072:cuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidxvpnifa.exe

Path C:\Temp\i_kidxvpnifa.exe
Size 389KB
SHA256 ba6d49930fd53954ef835e504e9e93ad54df9fa95a685b590b785bf37cf868fe
MD5 5eabc8329f900f35d033bcacd903ab3a
SHA1 d3b03111dc78491061211774880cbf4d667c4788
SHA512 2a3542bb9022577f95442530262b9554f764555bc0f9c204ac4e642f9af854ee38fb762986eb6e477f50854c106f8c75966f5f97f634b2a3a6238810b59da986
SSDEEP 3072:uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigdywqoi.exe

Path C:\Temp\i_qoigdywqoi.exe
Size 389KB
SHA256 50987bdb0b68a009887c094875f8183d73792ca230fe7c55afda20e0ce959ba2
MD5 c9c93093581395037aa44cb36c5fc10d
SHA1 58338d6e5a83833a0fdf7da2f034be148b6cc2e6
SHA512 409493be031d48e4275bdbded126f4e39368ba8b6a029dc8e0c9ac2fc6d2889800bfff9365f45367d2bf425a4464c68e76abe2fc1aab1cc5629d3e4848fe7d13
SSDEEP 3072:zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqoigaysq.exe

Path C:\Temp\i_vtqoigaysq.exe
Size 389KB
SHA256 917c98a8b01c19143caf512804ff7dbf22a5db84379d3b8c692bd6fa4a3ca83f
MD5 dd8d05cc64eb815b21917b39cd134118
SHA1 ba1fbc43057df05b8447f21b32f88912a843322b
SHA512 58dc23595f5feccf29cfd56be160b8e26538931c6eb85068512f2ffe5a7de204e4170e39559a24ef56e9a5e07024d895b584682dc5e560b982ff9c856f8df300
SSDEEP 3072:huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgeztrm.exe

Path C:\Temp\i_wqojgeztrm.exe
Size 389KB
SHA256 d1e73e58759053b55a1d3a7a5615bf700ba2179527df2a4c7f9b56af9dbe8335
MD5 8ddd34d5aca11daa6779dd60cc81bbb6
SHA1 b4bbf61b3a1117b212500bb712a7ddb78bfb1e8c
SHA512 9cae9e36006e33c0b45e1aa83e1ba70b27e3abcccf9d1cabc50e7e68759488c7eec5ed27e721c4cc7eddb1ae46af91c877b9c2dd1541dd568563b86d9a02c6f8
SSDEEP 3072:duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvqnifd.sys

Path C:\Temp\ifdxvqnifd.sys
Size 293KB
SHA256 ef6c772d8c0c3709347a1c86ab5d0e7626a1c9ca58bedf1712707af065c1af81
MD5 e3c89299fda4712c825f926834d2ed96
SHA1 7bce6420ee33a6ab412a440a6d2b5946dbd0ef30
SHA512 2b30f65eed39ec3310c8a23e886dfedfa5127fc94967465014527a5dca371cfd6c1188b1f5620c53030daab8a32a9d2f15a21eef0b6867599049e451ecd16e28
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidxvpnifa.exe

Path C:\Temp\kidxvpnifa.exe
Size 389KB
SHA256 d34b3b7382957fb1ebf7ba2edd5e238fc3bdd5329229dcb122d193999152c2c1
MD5 57f0e246984da1db91c55f806d53de9b
SHA1 0c7492be5f4da6a4d8e20dddaf42f889f5304dde
SHA512 698c7f6ddc319105ffc9cc57310801b0afa5bce31b556a27fe9687e831fdfe550ad3a022bdbd8cf197e97967348432d6b6ddf7be57912c75b692240e02a1cf89
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcausnki.sys

Path C:\Temp\nkfcausnki.sys
Size 293KB
SHA256 e6d1a00ab5e2764edc1897b80fed87675c18d1907843a842c7e421b8138a3140
MD5 1c8b5de69ae1f2033dee500929770d0f
SHA1 d171e3c58a358f0a6820614ada0ca1bd1d415f5b
SHA512 8d552f2df717a790d2e8f6b81764cc9a34c49e11206c66f51bd643df32007c762d6977871f8e9879dfbc4881fc9124ed3097aa9ca63696db4b4d697ea9a427da
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbvtolj.sys

Path C:\Temp\oljdbvtolj.sys
Size 293KB
SHA256 41061f19c7bb4dd362e5f076571a8c950f0a33893db4f0192fac28e47dd6eb36
MD5 86e333fe533b82d525d0cd74c2e9bea9
SHA1 e3c5e903a07a38f7a1eb0d088f193569ebdfef14
SHA512 cb1e94b7881e3155b2c92541a71dd759c4f976ed590ca29790732401bf0020b04c138c70b1b1a75d599eff162a1aeef3c2233f3c89dc154b99f3ff7e5d441850
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwtrljebwuom.exe

Path C:\Temp\omgebwtrljebwuom.exe
Size 389KB
SHA256 51339bfeb6e3410fc616a447817f943c9a4eb42d40faa962b56ddc7e87349332
MD5 6bcdbfcd89622fee123c71dbec8216df
SHA1 99aa7c6fcf7d89f388fb8348b4b8c6171db8f479
SHA512 69c6ba66641796181a3cfae63d9575d9216fbd3d91764d2293230145427646a10fd0c7f0e597173b1c48e161ac35e647d11280eceeb9c3bf7d9321bc5ba81e8a
SSDEEP 3072:Quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwtrljebwuom.sys

Path C:\Temp\omgebwtrljebwuom.sys
Size 293KB
SHA256 35ab0e3f717d3195be3902e536d7b9be6ef131828554f1905cc49be7669359d1
MD5 1141e0b8d4d83fca90bafb7660440a6c
SHA1 e0ee47efd58570892c72e2314e191edd86adf806
SHA512 ecbdccaa2326adb57d902f21d7ef9889945ce2e734230b44dcbb9a1395e4481bee6fef06ce2afc89a79176b514c35f1fce7a06ad0dcd532f7a547a2013bde679
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T194545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdywqoi.exe

Path C:\Temp\qoigdywqoi.exe
Size 389KB
SHA256 b999589f41af6cb39b3ece1809ea2acf70b4577b513e8c9d6b02b1b3afa94e65
MD5 41e02644a50db630b6e4a7351a7fb05e
SHA1 77026c3272e24714a308878e7bfd2a98b9eb7226
SHA512 843f08cb690a3c5735bbd6826776bb6fcab56605a3f90961d1a9d5c617e1ff747bc5ce60a2a27ed358b6cefdb17d26b0345f2aaebfb8b6ccebe3536582f06bec
SSDEEP 3072:3uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqoigaysq.exe

Path C:\Temp\vtqoigaysq.exe
Size 389KB
SHA256 9777d9e9381596f0cd246eb8a22d7d89b3ce47d4292ff603b4ab2e8032085823
MD5 c0f763f1099881aa19d382dd4b580669
SHA1 f0c7be173703b761a1214d2c5a6bdb75b90d5f92
SHA512 473ca3b93c27b0978aa5b0f498d3bcbbd13039a25f67dbf5d24883c43b2d70859142beba2bd179b5da0d86d6b433587f44b00195ad7134b8fd75717cfba21d44
SSDEEP 3072:puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgeztrm.exe

Path C:\Temp\wqojgeztrm.exe
Size 389KB
SHA256 d32bc9e1f3236cf922031d36845c36af6e949b95258d8f85e61ebf4603a8350b
MD5 941f36d0f8236a404ff07955f4e9df9b
SHA1 c5b8c3258ff22b7e87317a6187b407f94dba9708
SHA512 2f5ab7b9399b39b222de55e9ccb016242f3e256fe7884db19c267372eda0e4bab0e8a39322f2cf5963e9a50a4892a68485fed12a73eb86a891b9b607af8b3cdf
SSDEEP 3072:zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 69105f8849d3dc7a4c75d70f019739e76694d3068a227468bce33a39a085846e
MD5 b907c9c5737b49e997f52fdbe334a62c
SHA1 1584916f2cc7930e7be116e9829674b8c76a0968
SHA512 0f9a0efd2f5617fa1fc590bd81e50292e2cc992ec9c2f85a96dff42573254ab9ee7ba37a67608d24746e3f73b3d4bb6de944dae64b07360c9c14d83131d17b26
TLSH
T1AC61A45423AB0AE3D32845B121F1145836F086F5CD47FFAAA04E9EB8D4A6F34D0D861B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ab3a.TMP
Size 3KB
SHA256 0d4b6e35c92c9246ae33eab47b1de63f5c8767fbaf2d6433e6196e22709b4259
MD5 a3b80b30398a3cea236421fda788f100
SHA1 d538a67b9aff59dd96aee342c2e6d6ca00ec322d
SHA512 2e3b8a5e1ccd1e2c1a3885281ad947c604759800394fdcc67e9eafe5e47cdda441d46dac9d814348c0698ab18bc5370efab37b08977599f94691f1cdb4449627
TLSH
T18961865423AB1AE3D32845B161F1145836F086F5CD47FFAAA04E5EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 419d1a22a840aceb93fe890c591a4584f95029e87a2fa49f8f6bd5443b0cfd72
MD5 40d13bede60a54d111d530ffccd2527a
SHA1 238c7f0c5de4c8edef4ba613ce285dc87fca398a
SHA512 a2701c1517b5f94f1b18518e5c5ee6d5005a1425cae297b5ad64784653a85372bc0906f81c8072f267afda9c41c9f675aa98938dbe5c2759e8ca1f3c2dc673ea
TLSH
T11C419EF383F4956E890196F0AA186E2FCE1D0915432C7D5AC9E4AE2BD3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b102072bcc5e6921aa0e5b3f74c4b78706782e2496dbf999841953f9646be88b
MD5 ac6ebba9148256307a47e18297304cd6
SHA1 1bc582b947597acc0681643191afdc581fce4307
SHA512 dc6165752b105e5a1da5b3cd31ade83b68eb22b75958618b4467ea5dfbb9f5eda1ff67e1e85a960f5a0193c6956f1b27fa4b31173d98d6c1a812d17efdc0074f
SSDEEP 192:sxR2RWCf/fRsH2FN5ZbFxbzoA8p9v/g6+WNIYo5rCY2GQIgVsJ:sxR2Lf/fRsHqNXZYF/5IkJe
TLSH
T12A32A7166E28A93B5CC7E21DBB55BF53E2F9103260D52E48EAFC961C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90117d6be1d933d9dd5a47cc91af5e1ac692c14f7403a19ce3ef05bd87896d24
MD5 1c7e30d03ac4b5778818a0a2c5b4f41e
SHA1 5a0cde81282f177938f3e63c833afdef0cf862ed
SHA512 e1977b30e4d1845b04ffea7f423acfec2da033f0afb785a636ed0b7b700f4403360b0f603a103281630c145934f654256b710b9ae1a28f56ae064fe4734fc7c2
SSDEEP 192:sxRtRWCf/fRsc2Fr5ZbFxbzoA8p9v/g6+WNIYoVzCY2GQIgD1sJ:sxRtLf/fRscqrXZYF/5IEJK
TLSH
T11642C716A928A93B5CC7E21DBB557F53E3F9103260D52E48EAFC9A1C01E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 da13b783734581d6e17b068533e48837294a1963f655ae67e0a4c11342392a56
MD5 9cf564d392223442b5b5aeca6ab5a902
SHA1 444eb646da84834c57d2ca443cdbc16863e6c77d
SHA512 b85b90c6dfca8fa877e4a22a6373e0f882f211c989fa7ac45602e4ade8a8c1061811b0345f053bbd3beaaf55aa4eda2e0fc136b97d1812b60500b4d4d410b2d1
SSDEEP 192:sxRtRWCf/fRsc2FN5ZbFxbzoA8p9v/g6+WNIYo5rCY2GQIgD3sJ:sxRtLf/fRscqNXZYF/5IkJc
TLSH
T19242A7166E28A93B4CC7E21DBB55BF53E2F9103260D52E48EAFC961C05E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7da6db9a2c776d794cbd00060eb58429d7828548b1b990d46b71a79a3a4e8aa1
MD5 9cb59078f4a1731708247bd82de3b530
SHA1 5381299e325d1f7dd94f0504538f1e1afab902ee
SHA512 0a4258c452b4ab4855b1c6bffdac8f8cd022fce4cf713681aed587efc0d393a7a56be53005943536ac0e3e2a47b97c0a1a4b7cf67090d7062320c661621ebe18
SSDEEP 768:j26HUo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVwXBVuwAro9ie07:j26HUUE7MRWgs2f02u1ja3XB4wL9o
TLSH
T15FD2DB7B640DCABE4F800ADDDC297E9F6D6802CB9698CD8447FE941C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 52820d231464c19e5e41822750f0f4f653242a051369d90d324ed8a693dfd648
MD5 6761de8df8148580c4b78c8195c3bc5b
SHA1 e84f046d13782dce0bfd9bfa338b4e8d53f41035
SHA512 b6203009954c20af8036abe13ec9977e0488f85e1106986af44fa806ab005346b20d5873d321894a9f85a28f8ab0ba30c846c550217c53018ddd6e52c9483821
SSDEEP 768:jd3RN/TBOWoSczONXyer1IRCzni9/Pi9PC:jd3n4zSIqnkPt
TLSH
T173F2BF70E5A59E234CE5E3C2B1466797BFF82067E4C00A94EDD9AF0D0A87A5E130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5cd42a37b41c2568d6e8990ddbc3007cf2d432f76a1ab12ad89049b42a16841a
MD5 986855f2a9dfd031ac85a91b34173efc
SHA1 b5cbc9d87a68ebc718c38c1e1c59ea1f12b523a8
SHA512 f98422333a8cbf092e73b7abaea3ea0b26ab110f07e1a4ac4169fcfba0d0e0d5888edc271afc321aaf56f7e377677d400a8c6f1ed0437c69ee90bd019f5c552d
SSDEEP 768:hrv+4UNbdz3kI/TBOWoGONXyer1IRCzniBneVH1SK7:hbsbV3/lSIqnoEH1l
TLSH
T1C203CF32A4A89E338DE2A3C5B14776437FF85057D6800790ECDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8d356e7c76d8bcbcbe6a577a35db281b00598e2a452ff5e8f4c7e8b273abe314
MD5 044cee33c3e5448a96a70fb79beca2ce
SHA1 772d85002d4b28491ce1fbfb7897173bd40cd2d6
SHA512 a7c2b5e286ba5c2b982de64a40e41d75674779bdecd7f141caf07d74e6a503321c17052cbf223c0801eebaf2b77480bdaa43b8f2bca40b2288a564074c1a3dc2
SSDEEP 768:Xd3ON/TBOWoSczONXyer1IRCzni9/Pi9PC:Xd384zSIqnkPt
TLSH
T152F2BF70E4A59E234CE5F3C2B5466797BFF82067E4C00A54EDD9AF0D0A87A5E130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b9bbd9a3577e22c894d98438505bf1f019f0f32f565c0f3c56f4dae6ad75a07e
MD5 4644f1a894df8b2952c7f3f9f41d84c2
SHA1 b127054fcabf92f31aa6be9c59427d59d7f2d4ba
SHA512 0b70687c4856d9f4602fe0fe6341a71d9fd92d59a457e2124a59fd2c08ddd26f9e14f1129bae5e644c6ff7f4109dde9ea3fb64144e90d7616d9f3c959e07349f
SSDEEP 768:Nrv+4UNbdC3DN/TBOWoScYONXyer1IRCzni9/zBQ:Nbsbg3h4YSIqnkdQ
TLSH
T18D03BF31E1699E334CE6A386B14777937FB820A7D9C00A94DDD62F8D069759E230F907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 27d8d7c57c640ffb45e12e0a9281253d8f59e1365bf8535f8fc7d30957bb5ac9
MD5 0f9bf9432888774eed08087be7a2c4b4
SHA1 34d1c608b785bf289af665e5fef5cf3b42e794e4
SHA512 3e4c2b804bcd70b154a14a5e0778edab64c852930d3387473d8b966de33b088f38514e293d06af91aeb71fe49c3d4e615cd4b59d13adf64d5e6f8d4d04185856
SSDEEP 768:QY3OSpsOWoScsONXyer1IRCzni9/Pi9PC:QY3vFsSIqnkPt
TLSH
T141F2AE35E465EE239CE2A3C2B342BB87AEF81063D5C849C4DDD96F4D05C7A9E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 baaedb6a0e721ec5be6e8febd27d5a404932a5285ad4cbdc0ad0a7af6dfcd00e
MD5 21f72e045b9ab72de2b14f2776b985bd
SHA1 8737d97c31ee57bc5c1e6006952144719351253e
SHA512 c9a788a103dd07468049a9b198636fbe5fc51093d85ad34076e8bd6a4209a690f42eccfb63a3ed04488aab73207ca610145070b559332a0d72ef22ec4e35b8bd
SSDEEP 768:Yrv+4UNbdz3Nj/TBOWoScgONXyer1IRCzniw/eVH1SK7:YbsbV3J4gSIqn7EH1l
TLSH
T1C603BF31A069DE334DE6A395B047B6937FF82067D9800B90EDDA2F4D0A9759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2fbcb94e-aaf1-43ea-8aa8-ea8491d4b4ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fbcb94e-aaf1-43ea-8aa8-ea8491d4b4ee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4472_1637781939\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3455bb5a2c1c831490f1263ad126cb44d84bf0838c94e66a2b45648fede17c89
MD5 88d9711bd882fe6f2dcc3726762d6153
SHA1 ef4ee3dea62818b0155d7175da4b222d5bfdc78d
SHA512 8ea3bb4f05826b2cac550f9bb42410608fb175430b9f3010e06d3a82bd1ab3ba5061a74a9564d0c5d7dc2f8d3507f9a500b01a405a41f7697fd38d9f5b4509e8
TLSH
T15771008356B9D5B3C5DA5BF102835604F5FB22384B2330310B515586AB30A3A28B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1108-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1408-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1476-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1476-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2744-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2872-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3584-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3700-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3932-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4276-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4376-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4752-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4756-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5364-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download