systex | efd638b9929191f82d50c45531dddbbbf2863afe7686e1b64d89a24a0ec107fa

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260930-m14yssyzew
SHA256 efd638b9929191f82d50c45531dddbbbf2863afe7686e1b64d89a24a0ec107fa
MD5 6358a1abd3333cc346abba4615cb6a22
SHA1 5b15110040243cdfc1a17303d8967018ad539820
SHA512 3c26a579d3d975f5188ad941bb0ecf5cb26be3543955a343b4ff9ae468abca68720c4b6f1542b6c3c99d975ed3e9e815a5c86d928bc03c8774f44b37a08c5cb9
SSDEEP 3072:wjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:eyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6108	bvtolgeywtoljdby.exe
3212	bvtolgeywtoljdby.sys
4876	CreateProcess.exe
5968	geywqoigby.exe
5660	CreateProcess.exe
4900	CreateProcess.exe
3212	i_geywqoigby.exe
3428	lidbvtqlid.sys
4352	CreateProcess.exe
1128	dbvsqlfdyv.exe
4368	CreateProcess.exe
360	CreateProcess.exe
1344	i_dbvsqlfdyv.exe
5316	sqnigayvqn.sys
1600	CreateProcess.exe
5496	nkidaysqki.exe
5152	CreateProcess.exe
5420	CreateProcess.exe
3488	i_nkidaysqki.exe
4476	tnlfdxnhfa.sys
3820	CreateProcess.exe
3004	fdxvpnifax.exe
1628	CreateProcess.exe
2316	CreateProcess.exe
4516	i_fdxvpnifax.exe
4564	fcaxspnhfc.sys
1644	CreateProcess.exe
1492	kfcxuspfzx.exe
2856	CreateProcess.exe
5940	CreateProcess.exe
5316	i_kfcxuspfzx.exe
4928	kecwupmhfz.sys
5164	CreateProcess.exe
5880	eczusmkecx.exe
6084	CreateProcess.exe
756	CreateProcess.exe
2068	i_eczusmkecx.exe
5108	hezxrpmhez.sys
4100	CreateProcess.exe
1200	hbztrmjecw.exe
1712	CreateProcess.exe
5256	CreateProcess.exe
5044	i_hbztrmjecw.exe
2824	omjebzwuom.sys
3512	CreateProcess.exe
6008	ljgbztrlje.exe
3312	CreateProcess.exe
2064	CreateProcess.exe
5128	i_ljgbztrlje.exe
1260	tomjebwuom.sys
1040	CreateProcess.exe
604	trljgbzwqo.exe
5996	CreateProcess.exe
5908	CreateProcess.exe
4656	i_trljgbzwqo.exe
960	rljgebvtnl.sys
3164	CreateProcess.exe
3304	qligaytqoi.exe
4160	CreateProcess.exe
5604	CreateProcess.exe
4572	i_qligaytqoi.exe
2088	idaysqniga.sys
1672	CreateProcess.exe
1348	igdxvsqkig.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1472017332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_1472017332\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_979344786\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_979344786\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_979344786\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_979344786\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_2016133138\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_63034096\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping356_63034096\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgbzwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligaytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdxvsqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkidaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxuspfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligaytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdxvsqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvsqlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvsqlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbytqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxuspfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhezwrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywtoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkidaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbytqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifdavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbzwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhezwrojg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2980	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
820	ipconfig.exe
5168	ipconfig.exe
5252	ipconfig.exe
1448	ipconfig.exe
2528	ipconfig.exe
2708	ipconfig.exe
2012	ipconfig.exe
4736	ipconfig.exe
2832	ipconfig.exe
6040	ipconfig.exe
5792	ipconfig.exe
2676	ipconfig.exe
4572	ipconfig.exe
5820	ipconfig.exe
5836	ipconfig.exe
2756	ipconfig.exe
3348	ipconfig.exe
3324	ipconfig.exe
2764	ipconfig.exe
5952	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{7E774447-1B91-484E-96C2-F74EC01DB5ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe
6108	bvtolgeywtoljdby.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe
356	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	i_geywqoigby.exe
Token: SeDebugPrivilege	1344	i_dbvsqlfdyv.exe
Token: SeDebugPrivilege	3488	i_nkidaysqki.exe
Token: SeDebugPrivilege	4516	i_fdxvpnifax.exe
Token: SeDebugPrivilege	5316	i_kfcxuspfzx.exe
Token: SeDebugPrivilege	2068	i_eczusmkecx.exe
Token: SeDebugPrivilege	5044	i_hbztrmjecw.exe
Token: SeDebugPrivilege	5128	i_ljgbztrlje.exe
Token: SeDebugPrivilege	4656	i_trljgbzwqo.exe
Token: SeDebugPrivilege	4572	i_qligaytqoi.exe
Token: SeDebugPrivilege	2340	i_igdxvsqkig.exe
Token: SeDebugPrivilege	5276	i_ifaxsqnifd.exe
Token: SeDebugPrivilege	912	i_ausnkfvpnh.exe
Token: SeDebugPrivilege	5828	i_fzxrpkhczu.exe
Token: SeDebugPrivilege	4560	i_czurpjhbzu.exe
Token: SeDebugPrivilege	2672	i_eywuomjecw.exe
Token: SeDebugPrivilege	1732	i_ojhezwrojg.exe
Token: SeDebugPrivilege	5836	i_lgdbytqolg.exe
Token: SeDebugPrivilege	5276	i_dbvqnigdyv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 6108	4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4648 wrote to memory of 2136	4648	2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 2136 wrote to memory of 356	2136	iexplore.exe	92
PID 356 wrote to memory of 4612	356	msedge.exe	93
PID 356 wrote to memory of 2980	356	msedge.exe	94
PID 356 wrote to memory of 2868	356	msedge.exe	95
PID 356 wrote to memory of 2868	356	msedge.exe	95
PID 356 wrote to memory of 2868	356	msedge.exe	95
PID 356 wrote to memory of 1364	356	msedge.exe	96
PID 356 wrote to memory of 1364	356	msedge.exe	96
PID 356 wrote to memory of 2304	356	msedge.exe	98
PID 356 wrote to memory of 2304	356	msedge.exe	98
PID 356 wrote to memory of 2304	356	msedge.exe	98
PID 356 wrote to memory of 4204	356	msedge.exe	99
PID 356 wrote to memory of 4204	356	msedge.exe	99
PID 356 wrote to memory of 4204	356	msedge.exe	99
PID 356 wrote to memory of 3416	356	msedge.exe	100
PID 356 wrote to memory of 3416	356	msedge.exe	100
PID 356 wrote to memory of 3416	356	msedge.exe	100
PID 356 wrote to memory of 2760	356	msedge.exe	101
PID 356 wrote to memory of 2760	356	msedge.exe	101
PID 356 wrote to memory of 2760	356	msedge.exe	101
PID 356 wrote to memory of 5420	356	msedge.exe	102
PID 356 wrote to memory of 5420	356	msedge.exe	102
PID 356 wrote to memory of 4652	356	msedge.exe	104
PID 356 wrote to memory of 4652	356	msedge.exe	104
PID 356 wrote to memory of 4652	356	msedge.exe	104
PID 356 wrote to memory of 3316	356	msedge.exe	107
PID 356 wrote to memory of 3316	356	msedge.exe	107
PID 356 wrote to memory of 3316	356	msedge.exe	107
PID 356 wrote to memory of 4280	356	msedge.exe	109
PID 356 wrote to memory of 5200	356	msedge.exe	108
PID 356 wrote to memory of 4280	356	msedge.exe	109
PID 356 wrote to memory of 5200	356	msedge.exe	108
PID 6108 wrote to memory of 4876	6108	bvtolgeywtoljdby.exe	111
PID 356 wrote to memory of 6024	356	msedge.exe	113
PID 5968 wrote to memory of 5660	5968	geywqoigby.exe	115
PID 356 wrote to memory of 3200	356	msedge.exe	118
PID 356 wrote to memory of 3200	356	msedge.exe	118
PID 356 wrote to memory of 3388	356	msedge.exe	121
PID 356 wrote to memory of 3388	356	msedge.exe	121
PID 6108 wrote to memory of 4900	6108	bvtolgeywtoljdby.exe	122
PID 356 wrote to memory of 1036	356	msedge.exe	124
PID 356 wrote to memory of 1036	356	msedge.exe	124
PID 356 wrote to memory of 1036	356	msedge.exe	124
PID 6108 wrote to memory of 4352	6108	bvtolgeywtoljdby.exe	127
PID 1128 wrote to memory of 4368	1128	dbvsqlfdyv.exe	129
PID 6108 wrote to memory of 360	6108	bvtolgeywtoljdby.exe	132
PID 6108 wrote to memory of 1600	6108	bvtolgeywtoljdby.exe	136
PID 5496 wrote to memory of 5152	5496	nkidaysqki.exe	138
PID 6108 wrote to memory of 5420	6108	bvtolgeywtoljdby.exe	141
PID 6108 wrote to memory of 3820	6108	bvtolgeywtoljdby.exe	146
PID 3004 wrote to memory of 1628	3004	fdxvpnifax.exe	148
PID 6108 wrote to memory of 2316	6108	bvtolgeywtoljdby.exe	151
PID 356 wrote to memory of 4860	356	msedge.exe	153
PID 356 wrote to memory of 1300	356	msedge.exe	154
PID 356 wrote to memory of 1904	356	msedge.exe	155
PID 6108 wrote to memory of 1644	6108	bvtolgeywtoljdby.exe	158
PID 1492 wrote to memory of 2856	1492	kfcxuspfzx.exe	160
PID 6108 wrote to memory of 5940	6108	bvtolgeywtoljdby.exe	163
PID 6108 wrote to memory of 5164	6108	bvtolgeywtoljdby.exe	167
PID 5880 wrote to memory of 6084	5880	eczusmkecx.exe	169
PID 6108 wrote to memory of 756	6108	bvtolgeywtoljdby.exe	172
PID 6108 wrote to memory of 4100	6108	bvtolgeywtoljdby.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6358a1abd3333cc346abba4615cb6a22_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Temp\bvtolgeywtoljdby.exe
  C:\Temp\bvtolgeywtoljdby.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4876
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvsqlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4352
  - - C:\Temp\dbvsqlfdyv.exe
      C:\Temp\dbvsqlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvsqlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:360
  - - C:\Temp\i_dbvsqlfdyv.exe
      C:\Temp\i_dbvsqlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkidaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Temp\nkidaysqki.exe
      C:\Temp\nkidaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkidaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5420
  - - C:\Temp\i_nkidaysqki.exe
      C:\Temp\i_nkidaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3820
  - - C:\Temp\fdxvpnifax.exe
      C:\Temp\fdxvpnifax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2316
  - - C:\Temp\i_fdxvpnifax.exe
      C:\Temp\i_fdxvpnifax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxuspfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1644
  - - C:\Temp\kfcxuspfzx.exe
      C:\Temp\kfcxuspfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxuspfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5940
  - - C:\Temp\i_kfcxuspfzx.exe
      C:\Temp\i_kfcxuspfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5164
  - - C:\Temp\eczusmkecx.exe
      C:\Temp\eczusmkecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\i_eczusmkecx.exe
      C:\Temp\i_eczusmkecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\hbztrmjecw.exe
      C:\Temp\hbztrmjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5256
  - - C:\Temp\i_hbztrmjecw.exe
      C:\Temp\i_hbztrmjecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3512
  - - C:\Temp\ljgbztrlje.exe
      C:\Temp\ljgbztrlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\i_ljgbztrlje.exe
      C:\Temp\i_ljgbztrlje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgbzwqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1040
  - - C:\Temp\trljgbzwqo.exe
      C:\Temp\trljgbzwqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgbzwqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5908
  - - C:\Temp\i_trljgbzwqo.exe
      C:\Temp\i_trljgbzwqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligaytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3164
  - - C:\Temp\qligaytqoi.exe
      C:\Temp\qligaytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligaytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5604
  - - C:\Temp\i_qligaytqoi.exe
      C:\Temp\i_qligaytqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdxvsqkig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1672
  - - C:\Temp\igdxvsqkig.exe
      C:\Temp\igdxvsqkig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdxvsqkig.exe ups_ins
    3⤵
    PID:3508
  - - C:\Temp\i_igdxvsqkig.exe
      C:\Temp\i_igdxvsqkig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxsqnifd.exe ups_run
    3⤵
    PID:1148
  - - C:\Temp\ifaxsqnifd.exe
      C:\Temp\ifaxsqnifd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxsqnifd.exe ups_ins
    3⤵
    PID:5028
  - - C:\Temp\i_ifaxsqnifd.exe
      C:\Temp\i_ifaxsqnifd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfvpnh.exe ups_run
    3⤵
    PID:1992
  - - C:\Temp\ausnkfvpnh.exe
      C:\Temp\ausnkfvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfvpnh.exe ups_ins
    3⤵
    PID:1892
  - - C:\Temp\i_ausnkfvpnh.exe
      C:\Temp\i_ausnkfvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhczu.exe ups_run
    3⤵
    PID:4592
  - - C:\Temp\fzxrpkhczu.exe
      C:\Temp\fzxrpkhczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhczu.exe ups_ins
    3⤵
    PID:3256
  - - C:\Temp\i_fzxrpkhczu.exe
      C:\Temp\i_fzxrpkhczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpjhbzu.exe ups_run
    3⤵
    PID:2576
  - - C:\Temp\czurpjhbzu.exe
      C:\Temp\czurpjhbzu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpjhbzu.exe ups_ins
    3⤵
    PID:5012
  - - C:\Temp\i_czurpjhbzu.exe
      C:\Temp\i_czurpjhbzu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywuomjecw.exe ups_run
    3⤵
    PID:5856
  - - C:\Temp\eywuomjecw.exe
      C:\Temp\eywuomjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywuomjecw.exe ups_ins
    3⤵
    PID:2804
  - - C:\Temp\i_eywuomjecw.exe
      C:\Temp\i_eywuomjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhezwrojg.exe ups_run
    3⤵
    PID:3920
  - - C:\Temp\ojhezwrojg.exe
      C:\Temp\ojhezwrojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojhezwrojg.exe ups_ins
    3⤵
    PID:5844
  - - C:\Temp\i_ojhezwrojg.exe
      C:\Temp\i_ojhezwrojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbytqolg.exe ups_run
    3⤵
    PID:5092
  - - C:\Temp\lgdbytqolg.exe
      C:\Temp\lgdbytqolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbytqolg.exe ups_ins
    3⤵
    PID:2612
  - - C:\Temp\i_lgdbytqolg.exe
      C:\Temp\i_lgdbytqolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvqnigdyv.exe ups_run
    3⤵
    PID:5292
  - - C:\Temp\dbvqnigdyv.exe
      C:\Temp\dbvqnigdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvqnigdyv.exe ups_ins
    3⤵
    PID:1936
  - - C:\Temp\i_dbvqnigdyv.exe
      C:\Temp\i_dbvqnigdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifdavsq.exe ups_run
    3⤵
    PID:4872
  - - C:\Temp\sqnifdavsq.exe
      C:\Temp\sqnifdavsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa0d1dc188,0x7ffa0d1dc194,0x7ffa0d1dc1a0
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,15063559126100528059,17182115736698055591,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:11
      4⤵
      System Time Discovery
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16953924288243752205,14888145455225573651,262144 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,4098757006311986416,14729240650398101857,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,9926423254011878431,13688531188805366038,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,10776244469840855216,15580421617825162055,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,13689415121094460752,9259530449446361798,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,489372285931332672,3181945914614012339,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,5736785517718805708,7179682095896319136,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5260,i,3277145577055040960,9640431160862860321,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3588,i,3870646861837697660,10742779742865676300,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,17220643071938362942,14747735902400119694,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,16114083384276852406,4830043265369306049,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16383004447730976903,16124917645643631128,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16383004447730976903,16124917645643631128,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,682538841182928417,13714765888497405622,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,11124782488725431751,4158915275347050922,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6408,i,6091651512767404328,9126198012134249682,2097152 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,40813814518228109,16592206395105716702,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,5117094571222898309,5707228185530205930,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,4783664983862214839,10866762924156815549,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,1919219621813821264,15126041156707437951,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,15769487662728085812,3292334424749989913,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,5718399843932302742,18432341384663291605,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2923252944088842720,9805854931741627146,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2112,i,13417889583740903800,22368980126965198,262144 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:10
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,6026867125605847654,10414350683850711229,524288 --field-trial-handle=2876,i,2962172998424469090,13193089750780302318,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
      4⤵
      PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

C:\Temp\bvtolgeywtoljdby.sys
C:\Temp\bvtolgeywtoljdby.sys
1⤵
- Executes dropped EXE
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3768

C:\Temp\lidbvtqlid.sys
C:\Temp\lidbvtqlid.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\sqnigayvqn.sys
C:\Temp\sqnigayvqn.sys
1⤵
- Executes dropped EXE
PID:5316

C:\Temp\tnlfdxnhfa.sys
C:\Temp\tnlfdxnhfa.sys
1⤵
- Executes dropped EXE
PID:4476

C:\Temp\fcaxspnhfc.sys
C:\Temp\fcaxspnhfc.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\kecwupmhfz.sys
C:\Temp\kecwupmhfz.sys
1⤵
- Executes dropped EXE
PID:4928

C:\Temp\hezxrpmhez.sys
C:\Temp\hezxrpmhez.sys
1⤵
- Executes dropped EXE
PID:5108

C:\Temp\omjebzwuom.sys
C:\Temp\omjebzwuom.sys
1⤵
- Executes dropped EXE
PID:2824

C:\Temp\tomjebwuom.sys
C:\Temp\tomjebwuom.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\rljgebvtnl.sys
C:\Temp\rljgebvtnl.sys
1⤵
- Executes dropped EXE
PID:960

C:\Temp\idaysqniga.sys
C:\Temp\idaysqniga.sys
1⤵
- Executes dropped EXE
PID:2088

C:\Temp\pnlidaysqf.sys
C:\Temp\pnlidaysqf.sys
1⤵
PID:5960

C:\Temp\ausqkicavs.sys
C:\Temp\ausqkicavs.sys
1⤵
PID:1552

C:\Temp\zxupnkfcxu.sys
C:\Temp\zxupnkfcxu.sys
1⤵
PID:3348

C:\Temp\zxrpjhbzwu.sys
C:\Temp\zxrpjhbzwu.sys
1⤵
PID:4092

C:\Temp\mgebzurpjh.sys
C:\Temp\mgebzurpjh.sys
1⤵
PID:5456

C:\Temp\omgebwurlj.sys
C:\Temp\omgebwurlj.sys
1⤵
PID:4620

C:\Temp\geyvtrljgb.sys
C:\Temp\geyvtrljgb.sys
1⤵
PID:5344

C:\Temp\igdywqoiga.sys
C:\Temp\igdywqoiga.sys
1⤵
PID:5784

C:\Temp\dxvqnigdyv.sys
C:\Temp\dxvqnigdyv.sys
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtolgeywtoljdby.exe

Path C:\Temp\bvtolgeywtoljdby.exe
Size 376KB
SHA256 1f12a28cd4a3011f5faff5a1ff42cee9c449f9d2eb7fc94ee0f90fdd6e54fe2e
MD5 091692d6ae311fd463950437388ec6ae
SHA1 d89fbba25281a7d55ef10e57429c5c2582d0703d
SHA512 2d3212ec50c2de60dbdaf58490a36deb76d1caa8ca57baa5d02c9b39fa4d7f60f399d3a04371ee17c0c2ff56935f4b3bc126ec4a52b5a253938cb74a1a086157
SSDEEP 3072:XjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywtoljdby.sys

Path C:\Temp\bvtolgeywtoljdby.sys
Size 293KB
SHA256 377acee6fe9900dae92451af622c87140531c1f4dccf96e69cfabc9290f144ff
MD5 2441a27811221aa72b0da6492e3d9a79
SHA1 90203d4f11c71273c45060e1ce32a0013d927cf9
SHA512 e076f87a28714c48687701ba45e64994f09249970a23691fa3ce68b389b23930da2c652b1dd276109c2dce92791966ff69020d650b25557f012d8f96d5f929ab
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T18E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvsqlfdyv.exe

Path C:\Temp\dbvsqlfdyv.exe
Size 376KB
SHA256 e476314648c18540313af938519202105adb65ed75320b7a15d8b9d529534fc5
MD5 f4233df17f714a9734bddd34580f2a16
SHA1 56ada4a6eae4d58bf665ab521ac6366a89ed1582
SHA512 3e237c56cf2e31a043e0b6c05c3e5dacb39bfa078a760e6c7f39a190eafa51e6fe32da05f196b7ae2acee15820e7e77537e6d2691da37fc75a4c8e1f6fd6e25f
SSDEEP 3072:OjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:AyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T149847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcaxspnhfc.sys

Path C:\Temp\fcaxspnhfc.sys
Size 293KB
SHA256 d60fa68fe12584771dbb97135178c5481ceed5df6636259efb0f7bba6233c832
MD5 ac77596df67b9eca2cc1966919745da8
SHA1 b05174545142aa386fc020c69d1266b4e8aff1fd
SHA512 c4c795b7e9541f2df0899783e30590a6a0a7b6e189c42ff40d0f6f0aedecbb2e9637da0fc7e16c47b861a9b0000a02a95aaadd31f6cb5b7237a263b4af58fdc5
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifax.exe

Path C:\Temp\fdxvpnifax.exe
Size 376KB
SHA256 a50df4554d8116e1b13bf158cc70c6d2f0103e0d6fe4c0a6f379feaabf40b62f
MD5 209fa34ca6af697200e49a51bb931448
SHA1 90cbecda74fee51d68fa22dac80b16881ddad1af
SHA512 7deb7cf27adcf0600c42411f36d428f605dadb8e5109158a63bfdb29bdd82a4eee163b36e6140adffff44d63e85f6c808c98885cd5178c77626d99d31f97a0ff
SSDEEP 3072:CjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T181847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.exe

Path C:\Temp\geywqoigby.exe
Size 376KB
SHA256 f75d9973cc96a008d46ab6e7e0fed91b1b6aba5bb6589fa9cbb887d06563632d
MD5 793972832c7dee4612d5d74fbbaa48fe
SHA1 ae974159368ef7ba840e3d6f173569135a8cc7b1
SHA512 c363caca512d092f435654bf774d390a4160c92e3c0ee76c1bb3e308b108e980a656b95e79238701494773247e0bd5106064eecb7c84fbf2a0440f6cf8f1d5fb
SSDEEP 3072:2jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:oyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvsqlfdyv.exe

Path C:\Temp\i_dbvsqlfdyv.exe
Size 376KB
SHA256 98bd514ff29bf88ce5706767a9fbdb110812f973bb9b80bbf065ab8ae9cbde90
MD5 cd08826fe137561416a036d29845c023
SHA1 88ddfa28ed885fdd059a73ac8391c9a7ad426f44
SHA512 50e0a3db71a540560dcffaa218ce2a1f50c8502e4bc22e95bd856b41dbcf09d130a1ab45714c7ff5118be2798237d512ea0fcffbad15f420e9987759ddb67197
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BA847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifax.exe

Path C:\Temp\i_fdxvpnifax.exe
Size 376KB
SHA256 94f2e1c493d1119d0a183bd4a64f6043ecb8149a24f38cf53ec8cc7ae7fec9ff
MD5 2c5e399ffe32bb3a29048ceaeae51299
SHA1 7821dfde1ecdd3ea2091da385a06dfa9b96b58c2
SHA512 b4c3821108dc70ef76ddc2e1b37bee13d7e34486473f8c05cb4d9dc0754a77d6933ae1429aa3247383abd2e2111329d563c8b2f0bce1a25cb7ad274aef50139c
SSDEEP 3072:ZjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigby.exe

Path C:\Temp\i_geywqoigby.exe
Size 376KB
SHA256 46be52509ae90401d8c9e47d98aec59f0bd7ecd4a112fd5a51b5c788812b69de
MD5 76afbbb9b8e6db481af0f8412226cab1
SHA1 74008cd4c3d3d5c57311718ca874ac0bb84a4417
SHA512 1cfee18b427c385588af937db6c7ab05265b08f92b1eeaa885131211aa5fe10ad200fe85eb3ba2d3e0cd9f96fc530d36d6d3e97bcd058e767b033e652024e559
SSDEEP 3072:ljyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxuspfzx.exe

Path C:\Temp\i_kfcxuspfzx.exe
Size 376KB
SHA256 8fea26caf069a759e0eb439912b287d7717aa083f792edf22f052561f1dee5f6
MD5 97550ad7e9b540b8ef55b43242bbd755
SHA1 83ce0bdc2c3442f7f8ab9cd43861539620a9df45
SHA512 85400269f064d78e9abec5257923035b9a042402f28e9b59c8b07798b54aabb3cba617ab808dbafaaf4d9b7c142c88db4ca7cb4e1288995fdeaee1a9503cbc81
SSDEEP 3072:yjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkidaysqki.exe

Path C:\Temp\i_nkidaysqki.exe
Size 376KB
SHA256 dd5d3c2a9e47fc132ce9ea628c1add7c101560d9c653e6b25f62dd14b8d12f7d
MD5 55a68546501387ddafec59712af6d39c
SHA1 78678381194def1af0f998ff549eecdd9ffaa171
SHA512 a506afad66f85b55d24fded3da8a5ffaa6a5be45e74968ad9bfde14e610fad4747a9f60535bc2c63ee5018893a02d73065a9c20e98a431e38242cc70a9ffe0fb
SSDEEP 3072:MjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:iyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmhfz.sys

Path C:\Temp\kecwupmhfz.sys
Size 293KB
SHA256 30a3aba508a153a181e81b2951017b48f5b1c8df5185932ebb7ff1727fb7a121
MD5 64d9e76cd3e6458fe159802ed970f237
SHA1 67dd14b9f7cda1bea5b965e07592f65d41b1dd35
SHA512 532380713a20241760c344655f7743aafb2c4fa09a79411194432bdde9e08b840e7f9bc89c85a75f2cdc9f5155847f3eacfdffa99ef46064f16def6ec5ed2d48
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxuspfzx.exe

Path C:\Temp\kfcxuspfzx.exe
Size 376KB
SHA256 6bc5fad6bf59d63c04af155f1bffcbf8dcfc4c1ec37b9f7cfaecb081a414cbc3
MD5 bebb5361a78ca5a57ec44b353ead9f82
SHA1 9c3e1e4818a512245cfb8dda0bd8a7f0b78240ab
SHA512 8bbd9b328fc7b513a253210511077ac65204a4cef96aeb86ee4c97a08971c82125ad882efe67308c34472bbf9057d5c4741b04d0a4dd101ac26613ac206c5083
SSDEEP 3072:5jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtqlid.sys

Path C:\Temp\lidbvtqlid.sys
Size 293KB
SHA256 d45000aab18c14f84a8c9348de45888de310642354164343db2834e52ed4aab1
MD5 cbba956f3ff707e570c27831d065a113
SHA1 e71da088dda9d58d387632f052e1e90cf643118b
SHA512 9acf555186295abf93fa806dc284848fb272af4a6f007ea806b57a2801c0af1b1690ecd7f6158a333e3be160adf0baf0efcc1e45ed2c841d8413e6c698c9d3d6
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T133545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkidaysqki.exe

Path C:\Temp\nkidaysqki.exe
Size 376KB
SHA256 174021fd2cb99b42a70a7a94caae6f791eb4396b34e04bc58c1e0610744e81a6
MD5 5db2b5ec4e51e09bf82bea9e26488f75
SHA1 95dc4f4c80aba1932358516be85541909110a24b
SHA512 a719d3456bfbfcd2bdebf9f018ce56e82ddef3f5e56bd270a353ab1cf4a6ec4f694dcf7f9838ff927e7fdae88b33d6800b8724db7ac8d7b4bb2894802763767e
SSDEEP 3072:gjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigayvqn.sys

Path C:\Temp\sqnigayvqn.sys
Size 293KB
SHA256 dedf09729d5bc7e79929fed6830c238fdfa0692b51d570d51086f0fe6d9c2648
MD5 a46719ff0676fb091438302abcce20b8
SHA1 3edc7ef74576d54b7ad5ec1c7f9bfadd592d5182
SHA512 e173df624a6b632defcd49a7155e9ec2cb89d7ed51e90bff192ed957bc4f81299e658e8a771c0d78263e6f227752a56bf4202ad1f4bf8cc8dcc9b3c101df83e2
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T199545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxnhfa.sys

Path C:\Temp\tnlfdxnhfa.sys
Size 293KB
SHA256 4203f6bc22f303b0763969e4cc79081fbf6217601298a236b455737964df044f
MD5 f56c61f81589d86b6972a8192a415b26
SHA1 e27b51a6349cbccba66192177fc74640fe64eaf5
SHA512 fdaba2f39a4914df33153d96d82fc012ad844490538ef92db1fc29d4c374707c2d2baac2e8f768acaeaa4cd532900be36d0cf7ac7263f8d8c35e6ead87c60429
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ece0095232b83b0e982715fd8e28c9dd1fd0dc9f107840f0682e64d92dbf36f9
MD5 5ca4d82405cfb30f0035e5df86cec4eb
SHA1 6a641be4fe070b593557b0047978fad7699da5af
SHA512 ae5f7374098fdb1cb0306f32b6fc00c5ac591dc3e2d35faf0b7a77cbc15a83fd17c1298ed6dd0216371858e0f54df08ab1de0e09a119da8959ccad27000a9b51
TLSH
T17971DB70B373C609F75C357640CCC99A3672989DAEF34F15A39B90B4B6C6B6185C0788
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c3b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c3b4.TMP
Size 3KB
SHA256 625adc2bed7f03cac90d0c0d25aabcdce056582f7299190583902c76ce01b657
MD5 7737169b66e40bbc4533690f67d308f2
SHA1 e13951f37aaa96cbf083c7820db078f49d4ae4bb
SHA512 4aeddccf0f85398f0f6e21bb5ac9566a892e27e0343fcf4af06e18e6a2409d4cf5014952f3f93711939a0a6e19dc5a7d85d57f15f43ceb24e57038498517872e
TLSH
T11371DB70B373C609F75C357644CCC99A3676889DAEF34F15A39A80B4B6C6B6185C0388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 27d9db516bde79212f81fe4112f462e1c907c2af2fc16bd3fd61adc1d436e2ac
MD5 2e18bf19f43eaceb386fae60e461194a
SHA1 c100df457e12ac29ededb4f9b0b021e434047574
SHA512 7713710d48bf9bf3db9e6a35393d5a295114d895455d1043a2f19664d36d7bf23f05eb2a5a9b1e1b877ae7d76b2ccc5deb15088d1d9fc7f01de68ea615799483
TLSH
T14C51A1F3C3F8867D890156F4AB182E1BCE2D0958432C3D5AC8E4AE2B97E2471E54199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8a2f5a530bf067fafb89a99b24d28d3e38bb9febb0ce45037cdf6ca49930fcb4
MD5 53426ddc853a5470482fa8705641c379
SHA1 4e8787454c53ae4985c134e02ac272c091630101
SHA512 857a003022605e28ad9056c2cc943bbebb6d20301d46172233b401301582fa4958db3d4eef788554c6a2cf5d717e6f76bc9d9405199f56c55a9363254ded842a
SSDEEP 192:sxRJRMCt/fJsMh3ZZDzoA8p9a/g6+WNCpG/YddH+GefIgV4J:sxRJVt/fJsG3yc/55/YMi
TLSH
T1BD32B815AD68A97B4CCBE21DFB55BF53D3F91032A1D51E48BAFC861C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9f8bd2973dc5b5acfd73ce8847496a974f65a9c53419a7cc29388cb05e065c49
MD5 98cd482a57420c73acc24bbb1c52231e
SHA1 0011b12cfe998f7b0a43f7653ec936020fcf3cc7
SHA512 adddd6e2a1c17ac0aa63437208d68e8879409997f023a75e7eacd11dd07e60932269d8a39349a4603b237041380cd58e964c9013065b47cd7732b2f362b3cd4e
SSDEEP 192:sxRyRMCt/fJsSY3ZZDzoA8p9a/g6+WNCpG/YdhH+GefIgDy4J:sxRyVt/fJs/3yc/55/qML
TLSH
T1E542C715AD68A97B4CCBE20DFB55BF53D3F9503290911E48BAFC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2a5ba61763eb435565506bc722124a1a160803a7b6e6d6a6f18809b708ff1e4d
MD5 38032573e095f025f2b50fbff41a6ff1
SHA1 1892a3014d05304c7ed05f8150a61b72026cfae8
SHA512 c07104f33678a2a5f19fa4decfd7d2f0ce99a80afb2f05a21bae31f61b96d4fa755a8d87d99c342cffb731319fb4dd8f351dd281be8f2c0a88a5d732ded9ae4f
SSDEEP 192:sxRyRMCt/fJsSh3ZZDzoA8p9a/g6+WNCpG/YddH+GefIgDg4J:sxRyVt/fJs43yc/55/YM5
TLSH
T19742B815AE68A97B4CCBE21DFB55BB53D3F9103291D51E48BAFC861C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 006774cd900ecec02c5f834a7ee2cbb7367f3534355cdda7f00dbb4540eff8cb
MD5 2568d93afc3ee00430012a21d18f7603
SHA1 65f266ffdfabb843aff609791d3c40e42729ec2a
SHA512 fa15bf3d1962f5fe77ef4db980b06837060dd1feb0637489f24f76ad97ee9c38e3518f5299379d7b4670743924b7471102ef202e0f54b2f2c63673f927c73616
SSDEEP 768:qF+zcU7pLuLb9oWgU6f8S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPwIIGUGro+4:qF+zcYEb9oWgU6f8Su1jaUwIxU9b
TLSH
T19ED2E97B740CCA7E4F900ADDEC197E9F6DA802CB9698C94047FE941D02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

963898da-2a69-4c66-9ac4-c4d08a1570c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\963898da-2a69-4c66-9ac4-c4d08a1570c2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 923ed98dd483f6a3645f3b46665cfce494f440eaa9714631a3943e6952865974
MD5 f361cbe64cd1f6000614c42cd706b7ef
SHA1 39c3af1adb51317a3aa137a1a1f4a59ef53e1091
SHA512 487b8eca913f4913655d36e138ee6cb78e021b25fecc4f2c388ce2dc7e3f7844d85dd3f9fa4a8ee16dcbd1e39fd8b32dd293f7a27555c43665503a827c8cbb22
SSDEEP 768:B/UxvxjgC+CZ33WK3O0it31h3Yogkl5akl8pbHW0AWTVSHvP0Vv:UZj3+I3c1h3Yog05akl4bHW0AUSCv
TLSH
T19A03CF3AECA59D778DF6A284761AA307FFF894635AC4569445DCAF0E02873AD030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 5c61f2d594bf4a2640a1be4ca3dbe2abd050d16260b67f856fb1c79a462a9793
MD5 31257d7d00652cba7cf4c2446752050b
SHA1 bcb7e9172ab5d5342aaabc72c023a578e168b390
SHA512 f78a0f70159c266ee5b5b7bf4e45a07abf4b1fcbc0040a1b4a4327a74de41fe4de329f1181a6f64edd6c83d45e8f8af940cabd802514db56727cea23f4a161f0
SSDEEP 768:E/UxvxjgC+V3zNzzjK3O0itui1h3Yogkl5akl8pbHW0AWDg3DrgvPajo:xZj3+V371h3Yog05akl4bHW0Atzrgoo
TLSH
T1D613BE39A869AE7349E6E244721A6393BFF8647395C45E8889DC9F0D02877ED074FC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 de4e316354da3cda2f24e1aa95d5960fdfaa5e24af8a72856e4e65711f140220
MD5 8c16e981b5cb904d129d03da18a7b5bb
SHA1 224f296a3600807dd6b31be8bad47bac5f99347b
SHA512 48955dbc5bb7ffdd85b6ad33f5285602eb17660f799374ee7dee6665d0eec93dfd13a500d2b2a3dd11bc8f231a1bd326c9ee4e8e252b9a27483956f5c08946aa
SSDEEP 768:qU3uNejK3O0itu71h3Yogkl5akl8pbHW0AWDg3DrgvPaks:qU3m1h3Yog05akl4bHW0AtzrgLs
TLSH
T1F1F2AF34A865DE7349EAE284711A7242BFF8A4739AC84E8494DCDF0D01936EE074FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9e3065c984c5d07ca307f2e5a481e7c2a11afca8a6684e465178f073cbaf4a90
MD5 fd29d32bb0279c93692b344d1476d073
SHA1 6ab7b3d541be8f624402655d5ba967ccc19042a8
SHA512 18a680683c95eb51d36dc4873654786e9b8691aec9caf65ac8b03d9367538763e8c8f99e401fb67d3855122e07f36082c876c6c43de034bcbc3424bbaf72d405
SSDEEP 768:sU3zNejK3O0itu71h3Yogkl5akl8pbHW0AWDg3DrgvPaks:sU3f1h3Yog05akl4bHW0AtzrgLs
TLSH
T1B6F2AF34A865DE7349EAE284711A7242BFF8A4739AC85E8494DCDF0D01936EE074FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a7399b345d386cc11cdf83022bfb8ec8946a73ddcd87a3df3486cbfb52f92147
MD5 9da1f3d6199334988cbc26ab4afddb5d
SHA1 5f13e1956c1574dbdd2b2252b5d717149ef6cf00
SHA512 11d7e444d6f3ec1d66d2b7836cd19e25ef7135882c550c12373db1296c20b5b7ef1f2d65d7074ec7e2f0346ca394e8f88416184acc96a195545e3aa8604f6072
SSDEEP 768:JFQi39wgoNyqe3O0itu51h3Yogkl5akl8pbHW0AWDg3DrgvPaks:Ii3j1h3Yog05akl4bHW0AtzrgLs
TLSH
T16D1328F598D79A76D9AE9787633D6D02AEFCD06375885984B7C85D0CCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

0da86fb3-ede8-4a1b-80e0-c938e342eb2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0da86fb3-ede8-4a1b-80e0-c938e342eb2e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir356_1661858582\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 85a49173c37347494a8dbfabb8f804a194879178afc7fd0f466e62eb0d0037a3
MD5 5956f20860790863df81903a0b75e7b4
SHA1 29989dcf1a982ef2382e219f0044fe481982dd77
SHA512 17e3d4f0f62b19f852c9db6e35f8030372a468825308aa20a1d47b84fb024998e68e8e98506f5fd2fd67fe41b06718fe247c2597e186d08aa2d89623e21e06db
TLSH
T14271008357ACD6B3C1DE5BF102835644F6FB223C472370340BA1558AEA30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1260-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1552-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2088-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2824-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3212-57-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3348-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4476-255-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4928-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5108-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5316-227-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5344-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5784-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5960-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download