systex | 01dfc90dd992bfe56b38f713bc5bbd14596dd440948da766489c5545c7dea715

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261001-ps4zyatgnf
SHA256 01dfc90dd992bfe56b38f713bc5bbd14596dd440948da766489c5545c7dea715
MD5 6d864005c033e6422c9c27430f28094f
SHA1 778b7be899b14c42ce496aae990c578d3981e555
SHA512 c809816c9681c32c95e6c42f8dd0dd328e15eaa705cb1490fab0fdbf5c4a584700d0d2ea35544e8af16504200f6b87b34a689d9541bc1406c592184dbf5c9ae5
SSDEEP 3072:ljyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4628	zwuomkhczurpecwu.exe
5828	zwuomkhczurpecwu.sys
1696	CreateProcess.exe
2332	hbzuomjecz.exe
4312	CreateProcess.exe
4136	CreateProcess.exe
6068	i_hbzuomjecz.exe
5252	rojgeywroj.sys
3480	CreateProcess.exe
4208	gebztrmjet.exe
4360	CreateProcess.exe
3364	CreateProcess.exe
1840	i_gebztrmjet.exe
3488	ljebwtomge.sys
248	CreateProcess.exe
2488	eywqojgeyv.exe
5724	CreateProcess.exe
4768	CreateProcess.exe
3180	i_eywqojgeyv.exe
5028	aytqljdbvt.sys
5844	CreateProcess.exe
4264	tnigavtnlj.exe
4640	CreateProcess.exe
5336	CreateProcess.exe
4196	i_tnigavtnlj.exe
4272	vqnigaysqk.sys
1124	CreateProcess.exe
1176	lidavqnigd.exe
4832	CreateProcess.exe
4348	CreateProcess.exe
3528	i_lidavqnigd.exe
4184	nlfdxvsnlf.sys
3588	CreateProcess.exe
3128	xsqkidxvpn.exe
1292	CreateProcess.exe
728	CreateProcess.exe
2852	i_xsqkidxvpn.exe
5284	pnhfzxspki.sys
1220	CreateProcess.exe
1996	hfaxspkhca.exe
2616	CreateProcess.exe
3312	CreateProcess.exe
4232	i_hfaxspkhca.exe
6084	zxrpmkhcau.sys
5652	CreateProcess.exe
3560	fcwusmkhcz.exe
2180	CreateProcess.exe
4948	CreateProcess.exe
3512	i_fcwusmkhcz.exe
4884	gecwurpjhc.sys
1544	CreateProcess.exe
2964	bzxrpjhezw.exe
4492	CreateProcess.exe
4028	CreateProcess.exe
5004	i_bzxrpjhezw.exe
6084	hbzwrojhbz.sys
2992	CreateProcess.exe
2800	wtrojgbztr.exe
5216	CreateProcess.exe
3460	CreateProcess.exe
1440	i_wtrojgbztr.exe
3512	bztrojgbyw.sys
1964	CreateProcess.exe
4132	wqomgeywtr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_360755222\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1369351387\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1656343630\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1656343630\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1936852879\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1936852879\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1369351387\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1936852879\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3036_1936852879\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicavsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqnljgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzuomjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgeyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcwusmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkidxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromhezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqnljgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnigavtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavqnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavqnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomkhczurpecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebztrmjet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgeyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzuomjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcwusmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnigavtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkidxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebztrmjet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicavsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromhezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrojgeyw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4300	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
920	ipconfig.exe
6140	ipconfig.exe
252	ipconfig.exe
6104	ipconfig.exe
2196	ipconfig.exe
2092	ipconfig.exe
3324	ipconfig.exe
4776	ipconfig.exe
1360	ipconfig.exe
2152	ipconfig.exe
2492	ipconfig.exe
3408	ipconfig.exe
3448	ipconfig.exe
2748	ipconfig.exe
2876	ipconfig.exe
5808	ipconfig.exe
5112	ipconfig.exe
4608	ipconfig.exe
5284	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{10C549C5-B01F-4CA4-B8BE-CB36675A9E49}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
4628	zwuomkhczurpecwu.exe
4628	zwuomkhczurpecwu.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4628	zwuomkhczurpecwu.exe
1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	6068	i_hbzuomjecz.exe
Token: SeDebugPrivilege	1840	i_gebztrmjet.exe
Token: SeDebugPrivilege	3180	i_eywqojgeyv.exe
Token: SeDebugPrivilege	4196	i_tnigavtnlj.exe
Token: SeDebugPrivilege	3528	i_lidavqnigd.exe
Token: SeDebugPrivilege	2852	i_xsqkidxvpn.exe
Token: SeDebugPrivilege	4232	i_hfaxspkhca.exe
Token: SeDebugPrivilege	3512	i_fcwusmkhcz.exe
Token: SeDebugPrivilege	5004	i_bzxrpjhezw.exe
Token: SeDebugPrivilege	1440	i_wtrojgbztr.exe
Token: SeDebugPrivilege	2092	i_wqomgeywtr.exe
Token: SeDebugPrivilege	1668	i_wqnljgaytq.exe
Token: SeDebugPrivilege	5656	i_axvsnkfdxv.exe
Token: SeDebugPrivilege	5112	i_spkicavsmk.exe
Token: SeDebugPrivilege	5220	i_xspkhczurp.exe
Token: SeDebugPrivilege	2060	i_wurpjhczur.exe
Token: SeDebugPrivilege	6120	i_wromhezwro.exe
Token: SeDebugPrivilege	3748	i_bzwrojgeyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 4628	1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1920 wrote to memory of 4576	1920	2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4576 wrote to memory of 3036	4576	iexplore.exe	91
PID 3036 wrote to memory of 4400	3036	msedge.exe	92
PID 3036 wrote to memory of 4300	3036	msedge.exe	93
PID 3036 wrote to memory of 4116	3036	msedge.exe	94
PID 3036 wrote to memory of 5396	3036	msedge.exe	95
PID 3036 wrote to memory of 4116	3036	msedge.exe	94
PID 3036 wrote to memory of 4116	3036	msedge.exe	94
PID 3036 wrote to memory of 5396	3036	msedge.exe	95
PID 3036 wrote to memory of 124	3036	msedge.exe	97
PID 3036 wrote to memory of 240	3036	msedge.exe	98
PID 3036 wrote to memory of 124	3036	msedge.exe	97
PID 3036 wrote to memory of 124	3036	msedge.exe	97
PID 3036 wrote to memory of 240	3036	msedge.exe	98
PID 3036 wrote to memory of 240	3036	msedge.exe	98
PID 3036 wrote to memory of 1968	3036	msedge.exe	99
PID 3036 wrote to memory of 5808	3036	msedge.exe	100
PID 3036 wrote to memory of 1968	3036	msedge.exe	99
PID 3036 wrote to memory of 1968	3036	msedge.exe	99
PID 3036 wrote to memory of 5808	3036	msedge.exe	100
PID 3036 wrote to memory of 5808	3036	msedge.exe	100
PID 3036 wrote to memory of 5640	3036	msedge.exe	102
PID 3036 wrote to memory of 5640	3036	msedge.exe	102
PID 3036 wrote to memory of 5108	3036	msedge.exe	103
PID 3036 wrote to memory of 5108	3036	msedge.exe	103
PID 3036 wrote to memory of 5108	3036	msedge.exe	103
PID 3036 wrote to memory of 2148	3036	msedge.exe	106
PID 3036 wrote to memory of 2148	3036	msedge.exe	106
PID 3036 wrote to memory of 2148	3036	msedge.exe	106
PID 4628 wrote to memory of 1696	4628	zwuomkhczurpecwu.exe	107
PID 2332 wrote to memory of 4312	2332	hbzuomjecz.exe	110
PID 4628 wrote to memory of 4136	4628	zwuomkhczurpecwu.exe	113
PID 3036 wrote to memory of 4668	3036	msedge.exe	115
PID 3036 wrote to memory of 3792	3036	msedge.exe	116
PID 3036 wrote to memory of 4668	3036	msedge.exe	115
PID 3036 wrote to memory of 3792	3036	msedge.exe	116
PID 3036 wrote to memory of 4832	3036	msedge.exe	118
PID 3036 wrote to memory of 3176	3036	msedge.exe	119
PID 3036 wrote to memory of 3176	3036	msedge.exe	119
PID 3036 wrote to memory of 3336	3036	msedge.exe	122
PID 3036 wrote to memory of 3336	3036	msedge.exe	122
PID 4628 wrote to memory of 3480	4628	zwuomkhczurpecwu.exe	125
PID 4208 wrote to memory of 4360	4208	gebztrmjet.exe	127
PID 4628 wrote to memory of 3364	4628	zwuomkhczurpecwu.exe	130
PID 4628 wrote to memory of 248	4628	zwuomkhczurpecwu.exe	134
PID 2488 wrote to memory of 5724	2488	eywqojgeyv.exe	136
PID 4628 wrote to memory of 4768	4628	zwuomkhczurpecwu.exe	139
PID 3036 wrote to memory of 6100	3036	msedge.exe	144
PID 3036 wrote to memory of 6100	3036	msedge.exe	144
PID 3036 wrote to memory of 6100	3036	msedge.exe	144
PID 4628 wrote to memory of 5844	4628	zwuomkhczurpecwu.exe	145
PID 4264 wrote to memory of 4640	4264	tnigavtnlj.exe	147
PID 3036 wrote to memory of 1760	3036	msedge.exe	150
PID 3036 wrote to memory of 1760	3036	msedge.exe	150
PID 3036 wrote to memory of 1760	3036	msedge.exe	150
PID 4628 wrote to memory of 5336	4628	zwuomkhczurpecwu.exe	151
PID 3036 wrote to memory of 2952	3036	msedge.exe	153
PID 3036 wrote to memory of 716	3036	msedge.exe	154
PID 3036 wrote to memory of 4972	3036	msedge.exe	155
PID 4628 wrote to memory of 1124	4628	zwuomkhczurpecwu.exe	158
PID 1176 wrote to memory of 4832	1176	lidavqnigd.exe	160
PID 4628 wrote to memory of 4348	4628	zwuomkhczurpecwu.exe	163
PID 4628 wrote to memory of 3588	4628	zwuomkhczurpecwu.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6d864005c033e6422c9c27430f28094f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Temp\zwuomkhczurpecwu.exe
  C:\Temp\zwuomkhczurpecwu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzuomjecz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1696
  - - C:\Temp\hbzuomjecz.exe
      C:\Temp\hbzuomjecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzuomjecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\i_hbzuomjecz.exe
      C:\Temp\i_hbzuomjecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebztrmjet.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3480
  - - C:\Temp\gebztrmjet.exe
      C:\Temp\gebztrmjet.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebztrmjet.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3364
  - - C:\Temp\i_gebztrmjet.exe
      C:\Temp\i_gebztrmjet.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqojgeyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:248
  - - C:\Temp\eywqojgeyv.exe
      C:\Temp\eywqojgeyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqojgeyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4768
  - - C:\Temp\i_eywqojgeyv.exe
      C:\Temp\i_eywqojgeyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnigavtnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\tnigavtnlj.exe
      C:\Temp\tnigavtnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnigavtnlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\i_tnigavtnlj.exe
      C:\Temp\i_tnigavtnlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidavqnigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1124
  - - C:\Temp\lidavqnigd.exe
      C:\Temp\lidavqnigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidavqnigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4348
  - - C:\Temp\i_lidavqnigd.exe
      C:\Temp\i_lidavqnigd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqkidxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3588
  - - C:\Temp\xsqkidxvpn.exe
      C:\Temp\xsqkidxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqkidxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:728
  - - C:\Temp\i_xsqkidxvpn.exe
      C:\Temp\i_xsqkidxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Temp\hfaxspkhca.exe
      C:\Temp\hfaxspkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3312
  - - C:\Temp\i_hfaxspkhca.exe
      C:\Temp\i_hfaxspkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcwusmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5652
  - - C:\Temp\fcwusmkhcz.exe
      C:\Temp\fcwusmkhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcwusmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\i_fcwusmkhcz.exe
      C:\Temp\i_fcwusmkhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxrpjhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1544
  - - C:\Temp\bzxrpjhezw.exe
      C:\Temp\bzxrpjhezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4028
  - - C:\Temp\i_bzxrpjhezw.exe
      C:\Temp\i_bzxrpjhezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2992
  - - C:\Temp\wtrojgbztr.exe
      C:\Temp\wtrojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3460
  - - C:\Temp\i_wtrojgbztr.exe
      C:\Temp\i_wtrojgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqomgeywtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1964
  - - C:\Temp\wqomgeywtr.exe
      C:\Temp\wqomgeywtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqomgeywtr.exe ups_ins
    3⤵
    PID:6104
  - - C:\Temp\i_wqomgeywtr.exe
      C:\Temp\i_wqomgeywtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqnljgaytq.exe ups_run
    3⤵
    PID:5700
  - - C:\Temp\wqnljgaytq.exe
      C:\Temp\wqnljgaytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqnljgaytq.exe ups_ins
    3⤵
    PID:5456
  - - C:\Temp\i_wqnljgaytq.exe
      C:\Temp\i_wqnljgaytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqnlfdxv.exe ups_run
    3⤵
    PID:3448
  - - C:\Temp\dxvqnlfdxv.exe
      C:\Temp\dxvqnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqnlfdxv.exe ups_ins
    3⤵
    PID:4884
  - - C:\Temp\i_dxvqnlfdxv.exe
      C:\Temp\i_dxvqnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvsnkfdxv.exe ups_run
    3⤵
    PID:4200
  - - C:\Temp\axvsnkfdxv.exe
      C:\Temp\axvsnkfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvsnkfdxv.exe ups_ins
    3⤵
    PID:4600
  - - C:\Temp\i_axvsnkfdxv.exe
      C:\Temp\i_axvsnkfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicavsmk.exe ups_run
    3⤵
    PID:5676
  - - C:\Temp\spkicavsmk.exe
      C:\Temp\spkicavsmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicavsmk.exe ups_ins
    3⤵
    PID:2892
  - - C:\Temp\i_spkicavsmk.exe
      C:\Temp\i_spkicavsmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkhczurp.exe ups_run
    3⤵
    PID:3692
  - - C:\Temp\xspkhczurp.exe
      C:\Temp\xspkhczurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkhczurp.exe ups_ins
    3⤵
    PID:2008
  - - C:\Temp\i_xspkhczurp.exe
      C:\Temp\i_xspkhczurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpjhczur.exe ups_run
    3⤵
    PID:2728
  - - C:\Temp\wurpjhczur.exe
      C:\Temp\wurpjhczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpjhczur.exe ups_ins
    3⤵
    PID:5524
  - - C:\Temp\i_wurpjhczur.exe
      C:\Temp\i_wurpjhczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromhezwro.exe ups_run
    3⤵
    PID:6028
  - - C:\Temp\wromhezwro.exe
      C:\Temp\wromhezwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromhezwro.exe ups_ins
    3⤵
    PID:4508
  - - C:\Temp\i_wromhezwro.exe
      C:\Temp\i_wromhezwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwrojgeyw.exe ups_run
    3⤵
    PID:4688
  - - C:\Temp\bzwrojgeyw.exe
      C:\Temp\bzwrojgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwrojgeyw.exe ups_ins
    3⤵
    PID:5972
  - - C:\Temp\i_bzwrojgeyw.exe
      C:\Temp\i_bzwrojgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x324,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a0
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,8769510036491820811,5211765219959763223,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
      4⤵
      System Time Discovery
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,5801467270515919394,5709047062944135174,262144 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,6876074972505090136,5824379251515697934,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,12128900658080610464,819024942207144880,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,2302353112300613200,12329230888015159321,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,3741413659387060858,6187949443974205934,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,17055887809200133072,507133839745619103,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9123793735854095516,1249259866647335865,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5300,i,4026473298705367010,13607945006761581691,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3596,i,12668660213733696403,10959630203303943713,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,13485723739846605131,11903620379627335753,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,16193041603852267685,16297567346132251710,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6317938438958826809,13050737069760054821,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6317938438958826809,13050737069760054821,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,2043911917541221176,16491266597273407486,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,14039098063552906604,8211473064409920485,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6576,i,8009410754828420602,3487729828115114413,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5528,i,4986512980620981762,3237169829194347257,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,13077179254940364747,13495456760556758569,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,637153447045491230,1918063011724625192,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,1020543246886547306,14881309708633509217,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3728,i,14887389034190694919,7997013652079937827,2097152 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,11549657403317208056,11096524721896521929,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,3120338990639378669,1853862073256229214,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,13263121818158731316,13214406519818549131,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,6916374608713159265,14139179340953955454,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3756,i,751418827078713190,6034944662887376168,262144 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:10
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,12614844046843265207,3929503892160678774,524288 --field-trial-handle=2320,i,6593757164707126999,13401268549307564780,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1716

C:\Temp\zwuomkhczurpecwu.sys
C:\Temp\zwuomkhczurpecwu.sys
1⤵
- Executes dropped EXE
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4788

C:\Temp\rojgeywroj.sys
C:\Temp\rojgeywroj.sys
1⤵
- Executes dropped EXE
PID:5252

C:\Temp\ljebwtomge.sys
C:\Temp\ljebwtomge.sys
1⤵
- Executes dropped EXE
PID:3488

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:5028

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\nlfdxvsnlf.sys
C:\Temp\nlfdxvsnlf.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:5284

C:\Temp\zxrpmkhcau.sys
C:\Temp\zxrpmkhcau.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\gecwurpjhc.sys
C:\Temp\gecwurpjhc.sys
1⤵
- Executes dropped EXE
PID:4884

C:\Temp\hbzwrojhbz.sys
C:\Temp\hbzwrojhbz.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\bztrojgbyw.sys
C:\Temp\bztrojgbyw.sys
1⤵
- Executes dropped EXE
PID:3512

C:\Temp\olgdbytqol.sys
C:\Temp\olgdbytqol.sys
1⤵
PID:4144

C:\Temp\ayvqoigayv.sys
C:\Temp\ayvqoigayv.sys
1⤵
PID:864

C:\Temp\pnkicavsnk.sys
C:\Temp\pnkicavsnk.sys
1⤵
PID:4196

C:\Temp\usmkfcausp.sys
C:\Temp\usmkfcausp.sys
1⤵
PID:5064

C:\Temp\wupmhezxrp.sys
C:\Temp\wupmhezxrp.sys
1⤵
PID:1112

C:\Temp\gezwrpjhbz.sys
C:\Temp\gezwrpjhbz.sys
1⤵
PID:5592

C:\Temp\wuomjhbzwr.sys
C:\Temp\wuomjhbzwr.sys
1⤵
PID:2232

C:\Temp\rljgbytqoi.sys
C:\Temp\rljgbytqoi.sys
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 4ad3c0c171512612c98467878eb6872e20587206681c3572926fc1e02092013f
MD5 900d6fe22c7e4ae783159de5f4507030
SHA1 eee0192561100601b14bf94decf4d5496e844e85
SHA512 38bb1c926f0db42e547d4afceadcd980661c66348afcc31a77d21961cf913c07cfbadf5443dcd9dc3df86ab5254857c4fba0b67690386edd3e19e82a25c2834a
TLSH
T18F71238396B8D9F3C1DA5BF002C35648F1FF22380B3330600B555556AB30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

aytqljdbvt.sys

Path C:\Temp\aytqljdbvt.sys
Size 293KB
SHA256 2cdd8a017db360352d431c64436e3329699f666a8989f2c31b97062f2443a4f6
MD5 5041a3d091365111122ac532b045d4b4
SHA1 d6b7dfb4fdb5ede47bdab7f3ab607240d9e499f1
SHA512 a07151dfa97bd91d83d5b8c9e3c0c0564ec195c040b746f3c1b3429b368db086a96c847b0fe8624c994f87e7085305dfc362ba29ba9eafebfaf26d69fe798d18
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgeyv.exe

Path C:\Temp\eywqojgeyv.exe
Size 376KB
SHA256 101195f64e2e10e86e30add9125a17553d73f9d1b3f9f9befa06ff479ddd2446
MD5 e58ee06c152494d38e0541b33831749e
SHA1 377ea1c477263f3d495273ac6e052277283f56fe
SHA512 bf1bfbe32bc15f3310a6e8cd935b087a912bfbe9973270d46ed9ab839ff4a5a6f2f39d3895a34088bb94f7bb420e62d93548bfaae6ada1bee4d585f008fcac2a
SSDEEP 3072:AjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebztrmjet.exe

Path C:\Temp\gebztrmjet.exe
Size 376KB
SHA256 0d3120a5dbd4c0a595cc3e1417c8de475bf3effb05d2270fb6573470855a2386
MD5 9a41209cab7a1d63415f8f40c758c659
SHA1 1badcaeb851fdc1dbc7dc7884dcedec2fae10793
SHA512 ba5fd177fdb95a21723bef669136e7d444230cc75da8c9ecb9cb83d7ff68dc0a65a8c2793bd870e9338b323866c0bfa13f27a099c14af581a9f23a89acc53e20
SSDEEP 3072:SjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:syLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzuomjecz.exe

Path C:\Temp\hbzuomjecz.exe
Size 376KB
SHA256 50b7e7b137af5de7221185310817e0f1a3f3e5b6d62714ab0e0b76dfa818a7d9
MD5 8d3341ceec1a0e613a3d77c31f5758da
SHA1 ca60cbc48cde080e8ca89bd764673d6ffbdfae18
SHA512 951ede0ed286a316be91cb379b0064955fb1f494650f011186f79b05b62d1ab130c1c2966c028a1c7f9d427e90a3f3b88f3554e4c84b055f16567d32dfd7db2d
SSDEEP 3072:xjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T177847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqojgeyv.exe

Path C:\Temp\i_eywqojgeyv.exe
Size 376KB
SHA256 9303cd5bbe23296cf149c297e785e93713d8141a9cffbde2f0da3c440c974692
MD5 1af0c06b242421c869176257da815e7b
SHA1 24d6e64cf287232159d129bd4d1458ec25611921
SHA512 7583b4beabd94ea52fb983812d3622866b7bfb0774b24084f4d100b8897a2ec43bf0feb7034aa14ac10589bc3481552fc67eb332f52797f316e51378a8044205
SSDEEP 3072:NjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gebztrmjet.exe

Path C:\Temp\i_gebztrmjet.exe
Size 376KB
SHA256 cd086a93307572d65ba7afb710d1949b9834d1bf9a76ffc5571f3cc1d5929315
MD5 b152ca5db6fb74fca5dc53515f6bedd9
SHA1 658bbd151064f038991386cb5190ce4b2d5c5ca5
SHA512 fe879120a64583f3cd9d9ab77bfab2f25eb707c1aa08360b9a2879632b148ce4b6e5b3d5462f9555eabd463f9fbbba2c726c67cb55a1c64ea24630c53f5e8f5d
SSDEEP 3072:djyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzuomjecz.exe

Path C:\Temp\i_hbzuomjecz.exe
Size 376KB
SHA256 3d987e5639278330a04ba2ec62ecc01572d2617a98ec5a342aae087418c30883
MD5 138788a0a7acc6ff85b0e87ad342cd0b
SHA1 140f9919c444231e814956ac092f0503e51096b3
SHA512 68923a3df570e5893b4628077e3e3e7b181339714801ca865e8cc8c4c9f17ff28ff2d8f9c83d727b683d8c1673f89ba93099a345d1d3b5862cc4520ec0f9670a
SSDEEP 3072:QjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidavqnigd.exe

Path C:\Temp\i_lidavqnigd.exe
Size 376KB
SHA256 faa9f24de8f97cff56c6d32c85f6d392894b4fe17a63bf46087622716ad02067
MD5 40331d4aee059ff6e613ce74c96f6c14
SHA1 de55c3f1ebc669f9cba0b3e3e8a464cd2ff8faeb
SHA512 a2672f506be682291361f980e83da1d0499700315b50529be484ea60773a3cebaf129f837d1ef5696173ccead004d8da7c0d7f5300379006cf1b4ddf3e4cd030
SSDEEP 3072:7jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnigavtnlj.exe

Path C:\Temp\i_tnigavtnlj.exe
Size 376KB
SHA256 cbf977a35d7a2b07483556ad6fe9dc40bd2cb132b22a8ecea2a3f4202fe05480
MD5 2fb82925442a85e3606a6120ded156ec
SHA1 76c9fdf4588b7304fd9287950da010582cac6288
SHA512 7e29bab1564387ba9468b87a7ebcdd0fd28b03c5976cb2af73e81b54722629500f64df5de8ce4dad0ea6afb25f0f7cbdf19f1daa4b89ede4825d79e7cad142d0
SSDEEP 3072:VjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavqnigd.exe

Path C:\Temp\lidavqnigd.exe
Size 376KB
SHA256 3013053eb3ba5d8b81db30ad6a93c1da9e1b6f803bd439da3351a967c42eaf54
MD5 d52ce865c7b02363ea51958851cd2e64
SHA1 f742d8937882526a9fa5f6964f00169041f29bf8
SHA512 6c66efbae10e0401cb61c82ae45c70dd3e2b95453e60f140bc3e28c5f92be77b7e8a4137aee0bcb7c5ef215e909b308e1a2e8f46efdd704c8438f57e88061aec
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwtomge.sys

Path C:\Temp\ljebwtomge.sys
Size 293KB
SHA256 610d5383bbc9be64fcff3ff77d79472798f0c20225efcc6822150286a55215f4
MD5 59afabfeb9f18f7864fec5bb9b23e80a
SHA1 b15a0f8ab26abe02409ef97911d8434c5db71721
SHA512 786fc9e5c16213c33cf4b5eddc0255e210382015dc679fad2b5b378afe0efed47352f3443aa62910fad9b8e5404f42671b8ffd0b0a3bb5cc1b205bdb84632f8b
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvsnlf.sys

Path C:\Temp\nlfdxvsnlf.sys
Size 293KB
SHA256 0f2df73b8a2b34ac24de52f9670dd59f8214627c5bb99b5d8604b6a01142b9b1
MD5 a1f5e5ea23b7e55c62a1bae577430d0e
SHA1 ba4626a8f4da85956cd0080a0176de65d51c3c6a
SHA512 c0a2edcdea6a3b3498f82dc7a7f7f470fc47685a1c69ff17dfd7c0753d1c8d920526f3916a956818e47e06f34ee55dc1e79fd6d41fc1e9aa0b0ec347886edafd
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T155545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgeywroj.sys

Path C:\Temp\rojgeywroj.sys
Size 293KB
SHA256 176fb56fd9894c6046f035b4ce0fa87821d2b385cbbd2e6750936074b16648ff
MD5 c1794dd51a36fd56772a921ab2dc5444
SHA1 ae0cb3fd19fd2ae8eb96f2765eab1d43b88e0ff8
SHA512 54c5a2cc1bb83ae291582c3ebe5e20991da2ee618010e222fedee2ef34e3e92f10cf611ddb1a5ca13469c024d775e59c89e28ccccc61c25336110b27e3ae0781
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T13D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnigavtnlj.exe

Path C:\Temp\tnigavtnlj.exe
Size 376KB
SHA256 77f4720912fbfa2539800e2f48808057e2d9b6d825d64918f9980e43539b9beb
MD5 04a84ac15f2aae0a068c82b4c8eb3a88
SHA1 3cca11a2d59415a2f1554f9f9bf4c014ae378bc3
SHA512 1ac648eba383decdb01247c16b3b1be0dfdf646ee1b88729b127a750513c49a0c23569edf7270431f68edde52e85fb87733a9fc877c78819040753aabfd8fc0e
SSDEEP 3072:bFjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9S:5yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DE847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaysqk.sys

Path C:\Temp\vqnigaysqk.sys
Size 293KB
SHA256 43f262dbbb2fecf450c0fdae9ef947ec2b3e18d15b5951c53b75c84ae2a66ca8
MD5 a69b445e53ac239bbb5d8c01fca81482
SHA1 42cc21173cef3d6ea93ab7a8af93e20acc01f426
SHA512 05e0bcbc86d067c73b26b0376a92062751eb83b65d66b7232892646149d9e1afc0efc8a1124cd0f80dfeef4c7bc5451040a873927f9916d837ceee9b7ce339ce
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T166545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomkhczurpecwu.exe

Path C:\Temp\zwuomkhczurpecwu.exe
Size 376KB
SHA256 12707ec56168c066740fb93e82758501b98eb1dcc15b6e0ee7f8d64f5850f72a
MD5 3ef3d71cadccc7ff38a828e48c97eea3
SHA1 ab66b8bc4c39499c12df3f19beea97a0bb9502ce
SHA512 44ef4601bf186d3a4602b4b94c4889aa0e38731c4a42bfb2b0b26beb6c31274f3e01ff406977d5662c90ca299e2946243b7624b29194b99dfdd93e933ded0b13
SSDEEP 3072:m2jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9P:moyLJq/IJjiJcbI03GBc3ucY5DCSjXl
TLSH
T1ED847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomkhczurpecwu.sys

Path C:\Temp\zwuomkhczurpecwu.sys
Size 293KB
SHA256 2b5dd582f72150a7efab8f19f79202ca0bb087ef8c79f60cadd4e0c9106fadf3
MD5 7577b1ffe2687ff1020ca63bd1a5bd87
SHA1 fa4be1fb318e00c9965cc72cf28e6ab3e773a91b
SHA512 6e82473e318317e925ae81a1725848ec1c41be260186928014fa4b4157b757554ec9e948a0ffb12258a31a99faf8bf8f5ae4088cb91ee27da6320c2a8060bd1c
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37b23c9ef8c13a0debc86aff6cb4ac1daf241d956a4a38475ea836314b73844c
MD5 a66a107eaa5b21ab23ebdddd9794f665
SHA1 36ade33712c8f9ecd91ab59d3bfd067db2b3ad0d
SHA512 0c3de9c777daff86c0951a210e5c959122b2d40b326b8886cdbe57f50cf94d62204fde4e6a53175dba59f78830b48faf62cf7eb883e963f07340e56245e82c36
TLSH
T17A711E4EA759D049E7AC0938FAD0108B3B3087B2AD4F1E12179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598090.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598090.TMP
Size 3KB
SHA256 d0615c598c217f5e84d92ed0a08eb2f0e71ac5889488ecf2435bc9ef0956871d
MD5 c8cb15ae50e9a2de6daecc6698a263d0
SHA1 f9934904595ab924cb4e0247f9e51377c0f26e5f
SHA512 ea33c5f6ce6d819f681d860bb160f669f2105cd95f23dd08b6e50e5683c51c6be416170c05eca8f0ee84b47d84e9fa54e48cd764dfa8878b9f9349c82f8d9784
TLSH
T1D2712D4EA759C049E7AC0938FAD0108B3B3083B2AC8F1F12179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0461042ebb676862a645985ae372afcbdcdcc95347520c27bc2ad9a50147b0bd
MD5 a0a3bd601d1f8131bbdd60b785658e34
SHA1 758bfbb46e3d81b25e8e196558c490bd3e6691df
SHA512 06e583c2b54785e3a66ca36d65187eab7446317151fa88aecc95bee6971b960cf33d47f2fd9cdf9063efabc1c0ccb7721ed3d98d33e9ed6222333ecc5714c95a
TLSH
T14351AFF3C3E8866EC90196F0AA18BE2BCE1D0954832C3D5AC8E49F6B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d9e49a664fe83e63e7fc00fba7387a2461d09c9b48d1b5cc75fcf44bf9d00777
MD5 0bdff404211e193eceead74e11b6bc2d
SHA1 d0b596a50c44803b3db0415bde308da8d033cedb
SHA512 4408c5710a2f9eb35cdeb8b021713c5c0bb7c1954a519b3cab16c2d147c9087aac88fb00e22684afb022d4220c6275e272dec54d9150585dfbda85d2a5995875
SSDEEP 192:sxRnRhCl/f9shuZvCkCzoA8p9Q/g6+WNIYoLNG4SIgVzPJ:sxRn2l/f9shI6kPi/5I7yT
TLSH
T13432A815AD28A97B4CCBD21DBB657F53E2F92032A0951F48EAFC861C15EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c99e42eadb37ec590d9125ef86b5a0768df249c6c03b316d5300367c99cef534
MD5 f13a783c76b6d87a93a00dfce683800f
SHA1 d9201f7438a96a28bbf14d6e13b89bf6a72fb1c0
SHA512 9bd6fd0a6137a46ca20c2f7f06ed0ea14bb2a9298955d50ca1ea1533bce4a9465ace7b396bce545f4574600635f72de5217dcc407b838157efe736d5c27a2373
SSDEEP 192:sxRYRhCl/f9sLuZvCkCzoA8p9Q/g6+WNIYoLNG4SIgDQzPJ:sxRY2l/f9sLI6kPi/5I7yQ
TLSH
T1CA32B715AD28A97B4CCBD21DBB557F53E2F92032A0951F48EAFC8A1C15EB6DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1138e57d47a7b234b87559f99589636237b9afe262353b56733b2a7f98f3742f
MD5 1b89a441e7f6770952cfaa5f13650819
SHA1 be2886b3b56baaf3f03df290fd6d0a2328fbb7a6
SHA512 8fc6ff11ea315f097a392d9a0408e5788e700c01b91ee67cfb4c31ef7bd0217063b7bdfab08f96d9dd09c0690c2fe9032d74d4f2ba00416fc5cc59146b6910eb
SSDEEP 192:sxRYRhCl/f9sMuZvCkCzoA8p9f/g6+WNIYokNG4SIgDizPJ:sxRY2l/f9sMI6kPd/5IGy6
TLSH
T1B642B815AD28A97B8CDBD21DBB557F53E2F9203260951F48AAFCCA1C15EB6DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ae9c768cf387e83911475e140b4cf23b98cf2fd214a6b1cfe3bf343fdc9701be
MD5 dca010107dc13769b1ee2a31ae116f2d
SHA1 cddf9579feaea530261f5988ddc93465c5f53f28
SHA512 719590501ac31d62a60b26666bc94ce7341ae7223b9f5d2e1e8bfb68efc1e98501c4c1729f1c9de878fa36b30ccb37e556fe4d2e3e60444455b85bf702ae7dc8
SSDEEP 768:p/wWfO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVntXH3I4rowB7jD:p/wWfOEbOnWg/Xf1pu1jaQtXXIDC7jD
TLSH
T12BD2E97B740CCA7F4F804ADDDC197E9F6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1bb7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1bb7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3887c2b0cc550164577a415879995f7b22942a20aa204743f09a14f16aec82fc
MD5 21de602afe8fe9d2d357f0f8608ce856
SHA1 f60178341458e7e83dc8f8d2e4e806f33a16690e
SHA512 91da8c8f0cc98360405242b5f9a8bfeef12a7f96212fb35fa59e3fd0b6841ce24195275838577527a9367925e9705bc4bd1e2d57b5394ee157432319d15b645e
SSDEEP 768:Sn3PzykOE+3v/9OA9at01j0iq00+Iais2sAJw:Sn3Pz8wCHq00NaL2sAJw
TLSH
T186F2AF71ECB5CEB36CEBA285B30673C79FF41567D5C98A84C5EA660D00436AA170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6eeb820acaefa796565388ee38e0e2d862dddfa3f085101a80e6d3294e3e8461
MD5 cbfd6c951f758396a3c0c63092d802b1
SHA1 1af96bc7fc4f2092f85acfda2dd2c7d709cd9e8c
SHA512 d5f566943c2bff0b20d82d3427e1fce4e2b2d4bc43f00b6d7ce10ccec6791b5028afbe4942949b539ef07744bb7f0191bf5de72606ae0f75fdc0ab1325cbd8a2
SSDEEP 768:X/UxvxjgC+H3VKEOEA/9OA9at01j0iq00+Ia2/SHxRz:KZj3+H3VZCHq00NaASTz
TLSH
T16903C031ECA19D739CF7B384730A63979FF44663C6C96AA049ED2A0D05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 c107a5aa2c19b8903745ff7d772820d5d8ce435045b442180defdc6174389707
MD5 87df6005d3b47c0aa4eec0f585b7ce81
SHA1 d121b1ef5e1d76a3bb552a49c5dc77d0ee0436b6
SHA512 0858836c575c253dd85c4c10b67b0ba40aa06f39c3d7ed9218b2c5a3e8e1c2e28ad092ab9104ceb9d3ad6728b5ab53179689bd42aae4b79a0acac8650a8094fa
SSDEEP 768:lFH13IwgNz/0IOE+3a/9OA9at01j0iq00+Iais2sAJw:j13WzQ3CHq00NaL2sAJw
TLSH
T1DD1319F198E38A77E8AE5787633D6E868EBCD153B5898980B7D51D0CCC421BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 47ef7878aab1dec46df4b902a355f0488b07242b98b891dbd487f4cc55464bba
MD5 0095f686395e5867eed43129ea3e1639
SHA1 fa0b593213f5b011afc80c3bafcae9d192573aeb
SHA512 7054bfcb5663a0c7fc26c7da42031b2dfd8323f978e8ab231793125360485a4237b60b28b0ff95a560fd129ce152a4dc40cf9971a05b6487dafb8e1c67d0d133
SSDEEP 768:Dn3Tz4kOE+3P/9OA9at01j0iq00+Iais2sAJw:Dn3TzeQCHq00NaL2sAJw
TLSH
T1D2F2AF71ECB5CEB36CEBA285B34673C65FF41567D5C98A84C4EA660D00436AA170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 88af06d6dda44518d6fdbf52eb2c755c7327880d2aa0788b80e4e532933910ce
MD5 e93eb6bcfd3ae00eb1a167aaf2a4cd4b
SHA1 df91bc309a6fee01064d2b7bbd776f05e3393030
SHA512 a893d3ad52e28eba3d0c33a1ca7d4f21628bb3265d40e86334ad185ffa50ae7cc681238acdc454aedde97901a8e97939d25b1fe9fcd99eb22c19f5c63c5199c5
SSDEEP 768:jn3YzakOE+3G/9OA9at01j0iq00+Iais2sAJw:jn3Yz0bCHq00NaL2sAJw
TLSH
T114F2AF71ECB5CEB36CEBA285B30673C65FF41567D5C98A84C5EA660D00436AE170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

4990e255-786e-4fde-b7fa-9caf97273b60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4990e255-786e-4fde-b7fa-9caf97273b60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3036_549706804\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1112-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1368-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3488-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3488-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4144-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-394-0x0000000000840000-0x000000000089F000-memory.dmp

Download

memory/4884-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5028-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5064-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5252-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5284-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5284-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5592-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download