systex | 0678326d5e6bce1550a25112c76798d163794ae77e6a2340d504ee2638db2b1d

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260628-wecrvsaz3p
SHA256 0678326d5e6bce1550a25112c76798d163794ae77e6a2340d504ee2638db2b1d
MD5 fa1e2ef73e45c6306d1b76a520235d28
SHA1 28dcc7b4fcc09e043aa1bd14329685d69791c6c2
SHA512 0911c2ec25c6f35ec337fafe5a4ed6f9587e17aa208b8921e1d239dc4e4a713da5130fb3613948984c017ff921cca5b0ea5f1642c32a44feeb590d782334efd5
SSDEEP 3072:Juxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4272	dxvpnifaxsqkicav.exe
952	dxvpnifaxsqkicav.sys
5576	CreateProcess.exe
5968	usmkifaxsm.exe
5724	CreateProcess.exe
5408	CreateProcess.exe
3576	i_usmkifaxsm.exe
2684	ifaxspkica.sys
3140	CreateProcess.exe
5244	zxrpmkicax.exe
2456	CreateProcess.exe
3884	CreateProcess.exe
3068	i_zxrpmkicax.exe
5920	pjhbzurmke.sys
1372	CreateProcess.exe
8	jhczusmkec.exe
1692	CreateProcess.exe
5988	CreateProcess.exe
2760	i_jhczusmkec.exe
4504	ecwuomhecw.sys
4540	CreateProcess.exe
672	mjhbzwurlj.exe
3196	CreateProcess.exe
6048	CreateProcess.exe
3664	i_mjhbzwurlj.exe
2916	bzwromjhbz.sys
4764	CreateProcess.exe
2320	jgbzwromgb.exe
1884	CreateProcess.exe
4460	CreateProcess.exe
3796	i_jgbzwromgb.exe
5920	rljgeywtrl.sys
5332	CreateProcess.exe
3060	ebwtoljgey.exe
4992	CreateProcess.exe
1960	CreateProcess.exe
4644	i_ebwtoljgey.exe
1800	qnljdaywtn.sys
4376	CreateProcess.exe
3332	gdbvtqligd.exe
2596	CreateProcess.exe
2860	CreateProcess.exe
3912	i_gdbvtqligd.exe
6072	nlidaytqlj.sys
3852	CreateProcess.exe
4980	fdaysqkiga.exe
3164	CreateProcess.exe
948	CreateProcess.exe
6016	i_fdaysqkiga.exe
4708	vsqnifdays.sys
3684	CreateProcess.exe
772	fdxvqnigay.exe
5892	CreateProcess.exe
5340	CreateProcess.exe
1800	i_fdxvqnigay.exe
5712	icausnkica.sys
2312	CreateProcess.exe
1844	kicaxvpnki.exe
932	CreateProcess.exe
5524	CreateProcess.exe
1812	i_kicaxvpnki.exe
2868	xupmkfcwus.sys
832	CreateProcess.exe
1956	fcauspnhec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1031168385\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1437822249\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1198248306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1198248306\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_695892396\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1031168385\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1031168385\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_695892396\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_1031168385\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkiczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkifaxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkifaxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtqligd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcaysqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbzwromgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkiczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzwurlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtoljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcauspnhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztromjdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtoljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtqligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtqligd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcauspnhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztromjdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkhfzxurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzwurlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxvpnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkicaxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifaxsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbzwromgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdaysqkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkicaxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdaysqkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxvpnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtqligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcaysqnli.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 21 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5220	ipconfig.exe
4924	ipconfig.exe
2824	ipconfig.exe
2156	ipconfig.exe
2400	ipconfig.exe
1020	ipconfig.exe
572	ipconfig.exe
968	ipconfig.exe
5524	ipconfig.exe
3184	ipconfig.exe
1568	ipconfig.exe
2152	ipconfig.exe
5960	ipconfig.exe
1748	ipconfig.exe
5424	ipconfig.exe
5608	ipconfig.exe
5052	ipconfig.exe
3252	ipconfig.exe
5428	ipconfig.exe
4996	ipconfig.exe
3000	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271425919936516"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{014068BE-853A-439F-AA64-26527D29E625}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe
4272	dxvpnifaxsqkicav.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	i_usmkifaxsm.exe
Token: SeDebugPrivilege	3068	i_zxrpmkicax.exe
Token: SeDebugPrivilege	2760	i_jhczusmkec.exe
Token: SeDebugPrivilege	3664	i_mjhbzwurlj.exe
Token: SeDebugPrivilege	3796	i_jgbzwromgb.exe
Token: SeDebugPrivilege	4644	i_ebwtoljgey.exe
Token: SeDebugPrivilege	3912	i_gdbvtqligd.exe
Token: SeDebugPrivilege	6016	i_fdaysqkiga.exe
Token: SeDebugPrivilege	1800	i_fdxvqnigay.exe
Token: SeDebugPrivilege	1812	i_kicaxvpnki.exe
Token: SeDebugPrivilege	2580	i_fcauspnhec.exe
Token: SeDebugPrivilege	1064	i_mheurpjhbz.exe
Token: SeDebugPrivilege	5864	i_wuomjhezwu.exe
Token: SeDebugPrivilege	4128	i_ztromjdbwt.exe
Token: SeDebugPrivilege	5608	i_geywqoigay.exe
Token: SeDebugPrivilege	3184	i_gdywqoigay.exe
Token: SeDebugPrivilege	4436	i_xvtqligayv.exe
Token: SeDebugPrivilege	5392	i_hfcaysqnli.exe
Token: SeDebugPrivilege	1064	i_vpnkicaxvs.exe
Token: SeDebugPrivilege	1540	i_mkiczxupmk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4272	4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4836 wrote to memory of 4348	4836	2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4348 wrote to memory of 2540	4348	iexplore.exe	91
PID 2540 wrote to memory of 3144	2540	msedge.exe	92
PID 2540 wrote to memory of 4928	2540	msedge.exe	93
PID 2540 wrote to memory of 5076	2540	msedge.exe	94
PID 2540 wrote to memory of 5076	2540	msedge.exe	94
PID 2540 wrote to memory of 5076	2540	msedge.exe	94
PID 2540 wrote to memory of 4452	2540	msedge.exe	95
PID 2540 wrote to memory of 4452	2540	msedge.exe	95
PID 2540 wrote to memory of 1060	2540	msedge.exe	97
PID 2540 wrote to memory of 3136	2540	msedge.exe	98
PID 2540 wrote to memory of 1060	2540	msedge.exe	97
PID 2540 wrote to memory of 1060	2540	msedge.exe	97
PID 2540 wrote to memory of 3136	2540	msedge.exe	98
PID 2540 wrote to memory of 3136	2540	msedge.exe	98
PID 2540 wrote to memory of 3200	2540	msedge.exe	99
PID 2540 wrote to memory of 4552	2540	msedge.exe	100
PID 2540 wrote to memory of 3200	2540	msedge.exe	99
PID 2540 wrote to memory of 3200	2540	msedge.exe	99
PID 2540 wrote to memory of 4552	2540	msedge.exe	100
PID 2540 wrote to memory of 4552	2540	msedge.exe	100
PID 2540 wrote to memory of 2412	2540	msedge.exe	101
PID 2540 wrote to memory of 2412	2540	msedge.exe	101
PID 4272 wrote to memory of 5576	4272	dxvpnifaxsqkicav.exe	105
PID 2540 wrote to memory of 2484	2540	msedge.exe	108
PID 2540 wrote to memory of 1544	2540	msedge.exe	107
PID 2540 wrote to memory of 2484	2540	msedge.exe	108
PID 2540 wrote to memory of 1544	2540	msedge.exe	107
PID 5968 wrote to memory of 5724	5968	usmkifaxsm.exe	110
PID 2540 wrote to memory of 948	2540	msedge.exe	114
PID 2540 wrote to memory of 4976	2540	msedge.exe	117
PID 2540 wrote to memory of 4976	2540	msedge.exe	117
PID 2540 wrote to memory of 5504	2540	msedge.exe	118
PID 2540 wrote to memory of 5504	2540	msedge.exe	118
PID 4272 wrote to memory of 5408	4272	dxvpnifaxsqkicav.exe	119
PID 4272 wrote to memory of 3140	4272	dxvpnifaxsqkicav.exe	123
PID 5244 wrote to memory of 2456	5244	zxrpmkicax.exe	125
PID 4272 wrote to memory of 3884	4272	dxvpnifaxsqkicav.exe	128
PID 4272 wrote to memory of 1372	4272	dxvpnifaxsqkicav.exe	132
PID 8 wrote to memory of 1692	8	jhczusmkec.exe	134
PID 4272 wrote to memory of 5988	4272	dxvpnifaxsqkicav.exe	137
PID 4272 wrote to memory of 4540	4272	dxvpnifaxsqkicav.exe	141
PID 672 wrote to memory of 3196	672	mjhbzwurlj.exe	143
PID 4272 wrote to memory of 6048	4272	dxvpnifaxsqkicav.exe	147
PID 2540 wrote to memory of 2432	2540	msedge.exe	149
PID 2540 wrote to memory of 2948	2540	msedge.exe	150
PID 2540 wrote to memory of 2324	2540	msedge.exe	151
PID 4272 wrote to memory of 4764	4272	dxvpnifaxsqkicav.exe	154
PID 2320 wrote to memory of 1884	2320	jgbzwromgb.exe	156
PID 4272 wrote to memory of 4460	4272	dxvpnifaxsqkicav.exe	159
PID 4272 wrote to memory of 5332	4272	dxvpnifaxsqkicav.exe	163
PID 3060 wrote to memory of 4992	3060	ebwtoljgey.exe	165
PID 4272 wrote to memory of 1960	4272	dxvpnifaxsqkicav.exe	168
PID 4272 wrote to memory of 4376	4272	dxvpnifaxsqkicav.exe	172
PID 3332 wrote to memory of 2596	3332	gdbvtqligd.exe	174
PID 4272 wrote to memory of 2860	4272	dxvpnifaxsqkicav.exe	177
PID 4272 wrote to memory of 3852	4272	dxvpnifaxsqkicav.exe	181
PID 4980 wrote to memory of 3164	4980	fdaysqkiga.exe	183
PID 4272 wrote to memory of 948	4272	dxvpnifaxsqkicav.exe	186
PID 2540 wrote to memory of 4380	2540	msedge.exe	190
PID 2540 wrote to memory of 4380	2540	msedge.exe	190
PID 4272 wrote to memory of 3684	4272	dxvpnifaxsqkicav.exe	194
PID 772 wrote to memory of 5892	772	fdxvqnigay.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_fa1e2ef73e45c6306d1b76a520235d28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Temp\dxvpnifaxsqkicav.exe
  C:\Temp\dxvpnifaxsqkicav.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkifaxsm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5576
  - - C:\Temp\usmkifaxsm.exe
      C:\Temp\usmkifaxsm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkifaxsm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5408
  - - C:\Temp\i_usmkifaxsm.exe
      C:\Temp\i_usmkifaxsm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmkicax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\zxrpmkicax.exe
      C:\Temp\zxrpmkicax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmkicax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3884
  - - C:\Temp\i_zxrpmkicax.exe
      C:\Temp\i_zxrpmkicax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1372
  - - C:\Temp\jhczusmkec.exe
      C:\Temp\jhczusmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:8
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5988
  - - C:\Temp\i_jhczusmkec.exe
      C:\Temp\i_jhczusmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhbzwurlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\mjhbzwurlj.exe
      C:\Temp\mjhbzwurlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhbzwurlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6048
  - - C:\Temp\i_mjhbzwurlj.exe
      C:\Temp\i_mjhbzwurlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbzwromgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\jgbzwromgb.exe
      C:\Temp\jgbzwromgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbzwromgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\i_jgbzwromgb.exe
      C:\Temp\i_jgbzwromgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtoljgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5332
  - - C:\Temp\ebwtoljgey.exe
      C:\Temp\ebwtoljgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtoljgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\i_ebwtoljgey.exe
      C:\Temp\i_ebwtoljgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtqligd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4376
  - - C:\Temp\gdbvtqligd.exe
      C:\Temp\gdbvtqligd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtqligd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2860
  - - C:\Temp\i_gdbvtqligd.exe
      C:\Temp\i_gdbvtqligd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdaysqkiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3852
  - - C:\Temp\fdaysqkiga.exe
      C:\Temp\fdaysqkiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdaysqkiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:948
  - - C:\Temp\i_fdaysqkiga.exe
      C:\Temp\i_fdaysqkiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3684
  - - C:\Temp\fdxvqnigay.exe
      C:\Temp\fdxvqnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\i_fdxvqnigay.exe
      C:\Temp\i_fdxvqnigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaxvpnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2312
  - - C:\Temp\kicaxvpnki.exe
      C:\Temp\kicaxvpnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaxvpnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5524
  - - C:\Temp\i_kicaxvpnki.exe
      C:\Temp\i_kicaxvpnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcauspnhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:832
  - - C:\Temp\fcauspnhec.exe
      C:\Temp\fcauspnhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcauspnhec.exe ups_ins
    3⤵
    PID:3504
  - - C:\Temp\i_fcauspnhec.exe
      C:\Temp\i_fcauspnhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mheurpjhbz.exe ups_run
    3⤵
    PID:5680
  - - C:\Temp\mheurpjhbz.exe
      C:\Temp\mheurpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mheurpjhbz.exe ups_ins
    3⤵
    PID:5452
  - - C:\Temp\i_mheurpjhbz.exe
      C:\Temp\i_mheurpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjhezwu.exe ups_run
    3⤵
    PID:5848
  - - C:\Temp\wuomjhezwu.exe
      C:\Temp\wuomjhezwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjhezwu.exe ups_ins
    3⤵
    PID:1544
  - - C:\Temp\i_wuomjhezwu.exe
      C:\Temp\i_wuomjhezwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztromjdbwt.exe ups_run
    3⤵
    PID:684
  - - C:\Temp\ztromjdbwt.exe
      C:\Temp\ztromjdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztromjdbwt.exe ups_ins
    3⤵
    PID:1324
  - - C:\Temp\i_ztromjdbwt.exe
      C:\Temp\i_ztromjdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigay.exe ups_run
    3⤵
    PID:5012
  - - C:\Temp\geywqoigay.exe
      C:\Temp\geywqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigay.exe ups_ins
    3⤵
    PID:5520
  - - C:\Temp\i_geywqoigay.exe
      C:\Temp\i_geywqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run
    3⤵
    PID:1572
  - - C:\Temp\gdywqoigay.exe
      C:\Temp\gdywqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_gdywqoigay.exe
      C:\Temp\i_gdywqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtqligayv.exe ups_run
    3⤵
    PID:2688
  - - C:\Temp\xvtqligayv.exe
      C:\Temp\xvtqligayv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtqligayv.exe ups_ins
    3⤵
    PID:1996
  - - C:\Temp\i_xvtqligayv.exe
      C:\Temp\i_xvtqligayv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcaysqnli.exe ups_run
    3⤵
    PID:5052
  - - C:\Temp\hfcaysqnli.exe
      C:\Temp\hfcaysqnli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcaysqnli.exe ups_ins
    3⤵
    PID:4336
  - - C:\Temp\i_hfcaysqnli.exe
      C:\Temp\i_hfcaysqnli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkicaxvs.exe ups_run
    3⤵
    PID:2744
  - - C:\Temp\vpnkicaxvs.exe
      C:\Temp\vpnkicaxvs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnkicaxvs.exe ups_ins
    3⤵
    PID:2324
  - - C:\Temp\i_vpnkicaxvs.exe
      C:\Temp\i_vpnkicaxvs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkiczxupmk.exe ups_run
    3⤵
    PID:2864
  - - C:\Temp\mkiczxupmk.exe
      C:\Temp\mkiczxupmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkiczxupmk.exe ups_ins
    3⤵
    PID:3724
  - - C:\Temp\i_mkiczxupmk.exe
      C:\Temp\i_mkiczxupmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omkhfzxurp.exe ups_run
    3⤵
    PID:1528
  - - C:\Temp\omkhfzxurp.exe
      C:\Temp\omkhfzxurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:968
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x398,0x7ffbc7f6c188,0x7ffbc7f6c194,0x7ffbc7f6c1a0
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,8769922259498277978,10679658945969645102,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
      4⤵
      System Time Discovery
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,8605809407631454164,9740702089739189362,262144 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,478598205011972102,17681638688804065362,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,5203908674412434198,17444745659936942575,2097152 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,1931689212440097028,17053818050709088966,2097152 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,12962988237845752100,11212209855237428020,2097152 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,2350453181998406833,12175478133683191867,2097152 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9565782016900746177,9263388310809814902,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,2106191097840739780,1015786659569129279,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,7948143099987131830,278918715596106542,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10216133969915689803,11046929258442365653,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10216133969915689803,11046929258442365653,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,8903399543753688407,3155841178784831889,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,5060765623671223249,17888979970576607854,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,1963440821869857974,16430097812651926751,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,7848547592495976235,16773035628983593008,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,9535323872767025394,11465829273644662079,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13741913161456156723,13842711851248117570,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9113085716041097771,9345159230749434166,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,1501769696527838242,10026617543612148549,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,411508274037029401,7883596349461263704,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3760,i,13100920350018918501,17800511393287630318,262144 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:10
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,7539624886596649156,1042012382468122501,524288 --field-trial-handle=2212,i,3034100222167772845,10511846656049553413,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:916

C:\Temp\dxvpnifaxsqkicav.sys
C:\Temp\dxvpnifaxsqkicav.sys
1⤵
- Executes dropped EXE
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3060

C:\Temp\ifaxspkica.sys
C:\Temp\ifaxspkica.sys
1⤵
- Executes dropped EXE
PID:2684

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
- Executes dropped EXE
PID:5920

C:\Temp\ecwuomhecw.sys
C:\Temp\ecwuomhecw.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\bzwromjhbz.sys
C:\Temp\bzwromjhbz.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\rljgeywtrl.sys
C:\Temp\rljgeywtrl.sys
1⤵
- Executes dropped EXE
PID:5920

C:\Temp\qnljdaywtn.sys
C:\Temp\qnljdaywtn.sys
1⤵
- Executes dropped EXE
PID:1800

C:\Temp\nlidaytqlj.sys
C:\Temp\nlidaytqlj.sys
1⤵
- Executes dropped EXE
PID:6072

C:\Temp\vsqnifdays.sys
C:\Temp\vsqnifdays.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\icausnkica.sys
C:\Temp\icausnkica.sys
1⤵
- Executes dropped EXE
PID:5712

C:\Temp\xupmkfcwus.sys
C:\Temp\xupmkfcwus.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\zuspkhfzxu.sys
C:\Temp\zuspkhfzxu.sys
1⤵
PID:2556

C:\Temp\uomhezxrpj.sys
C:\Temp\uomhezxrpj.sys
1⤵
PID:4592

C:\Temp\jgeywromjh.sys
C:\Temp\jgeywromjh.sys
1⤵
PID:1096

C:\Temp\ywqomjhbyw.sys
C:\Temp\ywqomjhbyw.sys
1⤵
PID:2436

C:\Temp\bvtolgdywt.sys
C:\Temp\bvtolgdywt.sys
1⤵
PID:4552

C:\Temp\lidavtqolf.sys
C:\Temp\lidavtqolf.sys
1⤵
PID:5644

C:\Temp\pnifdxvtnd.sys
C:\Temp\pnifdxvtnd.sys
1⤵
PID:2156

C:\Temp\lfcxusqkif.sys
C:\Temp\lfcxusqkif.sys
1⤵
PID:2780

C:\Temp\hfcxusmkec.sys
C:\Temp\hfcxusmkec.sys
1⤵
PID:2720

C:\Temp\czxrpmkecw.sys
C:\Temp\czxrpmkecw.sys
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzwromjhbz.sys

Path C:\Temp\bzwromjhbz.sys
Size 293KB
SHA256 10596ae81d6469c83e8be44e4f6699824a163fbdae3e9d783ea6f2d1b7915642
MD5 c5b8342217a1c5e1d820cde2c1f671cc
SHA1 e14bb6b41132e4236b83d4b6a70758d75ba73a1e
SHA512 4e7454c242495d6993029d62b794953597f3c254e43187c8371cc8b6d7f49a8ae5ae58de57b4f007d76486b7bf2d65679ff82dcb32f545a3a50f5b1db2e08f4b
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifaxsqkicav.exe

Path C:\Temp\dxvpnifaxsqkicav.exe
Size 365KB
SHA256 39efcb72bc5bbda12775e929027f808e371a65f329796d94b36ee967ff234023
MD5 c72d79c757329f1fa1322470bf932a86
SHA1 5e991ca4a1c371a5e5d9a8c7eb0066643bcf710c
SHA512 0510db52118c78bf95b6afc55b3a0cc98e4eb4a96c832b0bc759022a30c0c037c46d3c95968d99ff703c6d0a955e0538bdd1cf2ccdc5efbd0e6585b157112197
SSDEEP 3072:3uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifaxsqkicav.sys

Path C:\Temp\dxvpnifaxsqkicav.sys
Size 293KB
SHA256 a756df0a3697a32c4698d7cc2eb01185a20f814c677e0b8e6550909522b51b6c
MD5 6e2f8b5de95f684a85a000ea6e2f7e8f
SHA1 4b67236633739d83fdf1bdaad72ec6f9e33a2197
SHA512 446587a72dee986ad5783ed9df10867d456d5071b2d76b1244efafd06daed0ccc5a88eca4d0ab9285f2e2ebd9af41e958d53c03c0d66693bdf64587c75bfffbe
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtoljgey.exe

Path C:\Temp\ebwtoljgey.exe
Size 365KB
SHA256 8a6c885f353fb347229e2bfa6942b6a78daa93fafdf22bb8368487b5cc14c66f
MD5 47cbef6468a24cfca9e741263fe3fc46
SHA1 f6965f3a0aeda597c53de69b5c27bc12611b40a2
SHA512 4ab08a677e2451dc7a2c84b95bd9b0d9e8753efe6f23921cde50838a0b2e0612b0e0b881fac12326dcc388cac99b5d84e1641e42e2916e39d32dfecebfdc508b
SSDEEP 3072:Quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhecw.sys

Path C:\Temp\ecwuomhecw.sys
Size 293KB
SHA256 992bbdf5eaf76ec06a59a19ee2ff7fa29cc4600311a69ac28b74b50641ab2288
MD5 dfddb89f6cd737c22cb3dbc67c8f97a0
SHA1 d1951d3144bc6e83d1896703b557355b7682b19b
SHA512 01140add8440eeddd799ff06549b967740da3b19139644a75b602a7f3e2c90082cf5ddb05dafd35ef5fe5816398029311b0624c8a8b188ea93e31868cf9e51c2
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbzwromgb.exe

Path C:\Temp\i_jgbzwromgb.exe
Size 365KB
SHA256 3461ab5c1a53e28120001aae36f3b97d13d1bea8b72f044f4c1cce0148c44a69
MD5 93dbf37e073ba4982c710328376f9e3a
SHA1 d9a45f833056faeed9ce521063efcaab65c1c1fd
SHA512 d739ca34c3f19e365d9a17eb73aba901a432ec4437f5f5b32af1922e4660819f2a12cc1b4a472046ab3ff2d1221ae4d3b19d113fbea10bcd2c5c2098cfbfe6b1
SSDEEP 3072:Ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhczusmkec.exe

Path C:\Temp\i_jhczusmkec.exe
Size 365KB
SHA256 ada564ca7ffa5348d4adbda69210d9c8f7c870f8f52c13dcb60534c5af38fa99
MD5 356c8f36976ce9dc1f8b9c599fef6fff
SHA1 67bbb292bc89d7b3140ac10684786affb0131e57
SHA512 f89037e711e0be435b6114e16d5b1c8707be04434eb5a923dbed455176b816e6f4b922027372d08df8a392267194c5c49f5f6057b029767f4e406f7c64446b38
SSDEEP 3072:9uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhbzwurlj.exe

Path C:\Temp\i_mjhbzwurlj.exe
Size 365KB
SHA256 5caf9526468a74cd31d10846b45eb42fdbba22dc82a675450f66daa42e5b5c5a
MD5 8629e037f174c42560fbdcc62a849678
SHA1 d01cbab94cf5da3550ce2cb923933c9a108581e1
SHA512 6107e7572b7bc256d8d486d557e18c77a2eb294ee668e4be8f1a32b7ed408bcde598ceacccfe6b807c7c7ea03b97d64a35fe0bd8b7fff5b7a934b8158cb043a5
SSDEEP 3072:vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkifaxsm.exe

Path C:\Temp\i_usmkifaxsm.exe
Size 365KB
SHA256 f9b331dc923a8ac09448676387257b191b02e5a7022affb73d9d4d9d81147b44
MD5 c18020aea8d590a44b263c9eb38a001c
SHA1 dca31b8a1f393c24e792f34c2936ffbd908b065a
SHA512 557a8925b334f42bfee056ad7d74c8404df696d8a15fad9d04e4ed1b64a23028b07cbbbc7308f45ca7339b93978c8f7f9330f16f1691491cf5d2510df46610eb
SSDEEP 3072:Duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpmkicax.exe

Path C:\Temp\i_zxrpmkicax.exe
Size 365KB
SHA256 6cb401ea9fa79457e3b87e2e95c1a2e43a2a8f5fa90f3f238f497d60222e6007
MD5 2c72b4cbcf4045d09a2dc63ef2c820df
SHA1 aab056be262141dc63d4de6342381ddde6f96d0e
SHA512 b1289aa516709c3c95887ddd2eae8efdd426bb6a006de36bfd14681a9646d4828e18fc3294d052887dfe56d9ba2fabb5c7eacf205528028ff8772ad4de315e57
SSDEEP 3072:Euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxspkica.sys

Path C:\Temp\ifaxspkica.sys
Size 293KB
SHA256 015ba7f4f3bff0a5f86212c58301dfac4b29030f63f4edcb1b5836e234d19845
MD5 962d0ad8894bfda6e1d432dba22eb202
SHA1 d056ba9cf520ac42c57a76f20b251cb1c5b8fbca
SHA512 a814d6337ceef20e9f1f76f9575e99caf55cc874c9c969fb38f7419f13f38fa3b79557fd0b239df95b825a4255b055e7d6254b5151ec530f15d5db6315773626
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T17B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbzwromgb.exe

Path C:\Temp\jgbzwromgb.exe
Size 365KB
SHA256 60b2bd2a265827353d1eb19a33d795a47961142d1b969d2e24fad95ddca9e024
MD5 6da22eb630e6f8197a72334556b8c939
SHA1 8aa659b15156fd5e1f024a3ce6966f3ceb625746
SHA512 c5a142921ea3f02a3e93c4d6c44e2e4144a13842c43143382272ea830259444d9c0bfd906b230f2b369367adb2192a81a3369fd395e160f45b46f1184734f46a
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.exe

Path C:\Temp\jhczusmkec.exe
Size 365KB
SHA256 c2d9be0d69029dd7409d3c5a33e54db8f0ddf08492cee3794dcb5e5a7f55c6a8
MD5 9fde381274175375f9a7528e0c09d494
SHA1 8da3323a121b5535e587c6aeedc3066f0d33b03b
SHA512 4a6b6307b5311065c20d060075f886c4489f501f5fa3c285dc93ab14bb3c9e08601e08099350a3fd568dfb6b8e5c396f64a1005534ef867ce08a72998e2ed7ad
SSDEEP 6144:X4uxyxtVlIJjiJcbI03GBc3ucY5DCSjXx:ouxyxsGjSGecvX
TLSH
T1FC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbzwurlj.exe

Path C:\Temp\mjhbzwurlj.exe
Size 365KB
SHA256 ffb04a39260c0e9aa5da1cfea457205e0625d0d8a4ea7a002f3e66fbc56dc695
MD5 82a8992bbf53f836185eaeeff3f00982
SHA1 ebb6c16f19b1086cfdee40f5d93aa819e4d5f1fa
SHA512 99c6fa4fbce7f3d9c339586c436493dbbfc0b28e425c67d51a514b65c938d867834a58864c6be1d3b16b1889a4aa770814aba7efd989ff33fbccc899bf4d3f3a
SSDEEP 3072:yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmke.sys

Path C:\Temp\pjhbzurmke.sys
Size 293KB
SHA256 168848327a1b7769244a312a80d54ae2b8c87d43f524c33e4ad79b0ab226296c
MD5 74caecd9fa2281dace30e25218eede8d
SHA1 81010a41a0299ffe6da6eeef1b2b50fdf7607032
SHA512 45bd5e5c69647278baf1f00fb2ce16e75bfc241c3be7641c6f97c82a6e09a7b0169af0876e87614ceeb53d7c357b67ed8f635f45261ac60ff29b02b586a71fef
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgeywtrl.sys

Path C:\Temp\rljgeywtrl.sys
Size 293KB
SHA256 606ec192807498ef9f8be6cb921e6447c704508da6d8f78ff061cb3833a47796
MD5 d7dfc134408bed6629063f33469894dd
SHA1 bfd85309d0124fa0727c662bdc2f62d84b6af7eb
SHA512 45ec2c6d28ac2f1c3a970d39f4c056a59b115f47960fbe1cc4b2c42a4ec0c14b44d9e817607a375da0ea35f0ac2df0c2022c9fcc6a466b1ac39f5714da00d120
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkifaxsm.exe

Path C:\Temp\usmkifaxsm.exe
Size 365KB
SHA256 4eafa29f59904e6510e087357fc841ba6f05a070f9374a8a3218f503c0dbb320
MD5 53d6fd286f36d7b7632f2380db723c3e
SHA1 77ad0f665919446b8df406836bcb26f84a665324
SHA512 1a3de3c17fbb313cfad74fddbb8a8f042336bb31b6ed1a04f27f314540621693b88d809f5262799d243109e662550a88b1682857b748b58075e3de8ff9446655
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpmkicax.exe

Path C:\Temp\zxrpmkicax.exe
Size 365KB
SHA256 5bacc23b5b89082b09f1fb1fe0d7f95eee6dd8d04ce1781876460d53966abb6b
MD5 b81ddf8260d8fee9b5156b03d7a62872
SHA1 f2997f5c723c06a2c15775be68869879438226cd
SHA512 9c815b773fcd9d4f8a80f770b10de7545a2eb738b674f883a79d56b6eb7d9517a7c8d925356efde3f299d4e6fbc90afc64245019bbc9bf632fe5834525692a91
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 47785d82e7ce1e250fe0658f3c6b9ca04726635b7b0b24e2504f0d8e1696b5d6
MD5 1a91c6d30b1b568a15191eb79aeff40e
SHA1 a50f87bca5dd039b04e4aa9d95d26a458d369a92
SHA512 7933775c74ed78ed461c04171c57dee43efd47833dece02c4f331c0e81ae941367b5c60bde7510b75cfe7c2354e85dd4255af94c5005bd8fe2445e5c41568117
TLSH
T104613D71E0EED9A5E7E209FAE0DD208F3377E476B5AB1D11039DBCB89906370B15A124
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592eb7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592eb7.TMP
Size 3KB
SHA256 96965bd1bf758ff778b592cd1462b14acdbadaee111935316da410eb01ed3ad5
MD5 17a39fe4534b82e9ba6fd91aae8e1788
SHA1 4da1af084581229c2c020699d69ac04b322731ab
SHA512 d2bb58efb5c4bca0b4217b1cde0c1deb80e48d1614a2956f0856c1f70cf7ceae324e396503ebd999fd01aace811d1b4ce75c01b9c43137f67711d9ba8e957483
TLSH
T18B613E71E0EED9A5E7E209F6E0ED208F3377E476B5AB1D11039DBCB89906370B15A124
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b3ba6129068a5b87b7daf834fe7dcf373da69461a9d4ef8b389c01a3b89c0a73
MD5 fd86a532e2d9645b3e2652e931a4b08a
SHA1 c40afc5b2f5f3ce9fbe6dfb487776742d48e31df
SHA512 54f6fab44aba75088a4908847bce13d1220aaefbc619d0167a486ab9a3be5f1eb6b81b476f7993458019496a319d21f220969bf509e500c2ed99a9b065286020
TLSH
T181518DF3C2E8856D890196F0BA187E2FCE1D0955832C3D5AC9E4EF5B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 67b6de8480f8e2c248ef6764ee403b1e7e346eab55169e4b14cfd9a88f9d021b
MD5 e86f0ec1dc18748ae137d084f6121213
SHA1 bfc8bfde4ac4e2ed39c0784a2005c3756334cea2
SHA512 d9ed6c94c452abea63c0cb278c132e3adc578f45b9a3c9a93eeab083d43b72f2abfa8883fc6da9e113a3261cc89998ba247fec6f8fd2d73d35e7fd8708995cfe
SSDEEP 192:sxR5ROyM/jK1Ml8wcx/fjsOqIZPeVhSHzoA8p9O/g6+WNCHV/Y4pS6G6IgD6MJ:sxR5wCx/fjsOq2c8/5k/db
TLSH
T19E62EA166A349977CCDBD209FA557F63D7F85573A2901E44A9FC8A0C01E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e9a4b1e7d8a8fecf79ca58478bac7c07f28e24675f2b944f6b95ecb3200b77c2
MD5 dee0b333f9f051a3dbe12305ec7201a8
SHA1 3b5e950c93f883dc3682016a4c844f868dd28b5c
SHA512 ab820f3c84944e11e3c795897b3ffa2025ba8340ddf1af56f3e46795218fd946649049a5aed5da8e83b162d45a568580fdb9f1f0be8f925f14810d9873939428
SSDEEP 192:sxR5ROyM/jK1Ml8UQJcx/fjsOAIZPeVhSHzoA8prO/g6+WNCHV/Y4pW6G6IgDgMJ:sxR5wqex/fjsOA2c6/5k/tp
TLSH
T1E862E916AA349977CCCBD609FA517F63D6F85573A2901E44A9FCCA0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d01b298b224451b940689a0a37e0ca2d4bbe19e7e987398db0171f90836d750
MD5 62ffe1bc6344dfcdc644eead2c49b041
SHA1 54c670d7966e4f328446e655ee1526ad99939574
SHA512 0867be686cb48cde8dc89501302b01f3ea91a8736fe34dfca23d9b16c3244aaddf8456391a64d6155d072a13650e74546c53699ad5073770e63508aca1a2b526
SSDEEP 192:sxRGROyM/jK1Ml8wcx/fjsiqIZPeVhSHzoA8p9O/g6+WNCHV/Y4pS6G6IgVMJ:sxRGwCx/fjsiq2c8/5k/dG
TLSH
T11C62D9156A389977CCDBD209FA557F63D6F95573A2901E44A9FC8A0C00E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 484f2b1f7b5b07e0639f433017bf2b794a418d59e4bae5962816dd712e7d2998
MD5 8af5fb102d8aef5c7b7f5ef9528f4d51
SHA1 7a5cb54cdacf1bf8b7a3118c1728d69fb6ad8e89
SHA512 cc75ce6547e735878bf9f60766c19c5a6ca66a0de1462036a7ceb6ec3ad3206799d4ddbd65a4b177fc61833991f9cb90a3eb8e7a394464b862e0a50cae3b45fa
SSDEEP 768:Nmymc/7pLuL7YpWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/Z3LxgCroRLyHt:Nmymc5E7YpWgvHfSvu1jaMZ3NgZRLyWi
TLSH
T1A7E2ED3B680CCB7F4F844A9DEC29BD9A6DD801CB5A98CD5447EA840C03C6BFB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ca4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ca4b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ef105d027d5db3360fbe640e20971e7cc32016bbc16f5242e22f042bfc21fe2d
MD5 c08a3ec36e3f25eebe3d4d954056c17a
SHA1 ced8fd6572718d43a39a28a61525bf3a756dba48
SHA512 2344e1926046a9dab04552c81729d43175b449016d2cd2935a037668c59d62f30a1328365ef0d82efa3d5e1c92821615f5597b2bef1177b13a7996daa02a068d
SSDEEP 768:5jaeqD4MlshiLdMmz3vc5fyjfI7fnA7NpespIRM0UmkTziwjgzSIrZFTW:5qcjhIdMk3WfYfOf6QsZ0UmYo14
TLSH
T1D803BF71D8649DA78CBAEA496A473697AFB001A3C5C43F88DCD95E0D45832DC270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 590d0e90409cb949bebf221ef3acce521e042a041774e1d9d2329cc93dfbe0eb
MD5 60cc3c56cdd7308e0f6808a7cf3b48b0
SHA1 a0586d53d5be6dd2166da269cb859638c7a15b36
SHA512 b55fea3d64b2bdab0eb10a67497bf8c3712409b0292b5e42a752eedcd774a908b985b006f664c9a7827ba2c3095347f5bb8821d214ffb1fb74adcce57ae7aede
SSDEEP 768:3jaeqD4MlshiLdMmf3kDfyjfIpA7NpespIRM0UmkTziwjgzGjnApXLPQTU:3qcjhIdMo3kfYfDQsZ0UmYrnKXD
TLSH
T11103BF3698205EB38CB6E68A264736576FB00253C2C43BC8DCDE6E0D42976DD530B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 859d0e2b8057276418e2ad689e4528c747cc873f03c243c6134d9b99cb7caaf7
MD5 00605dff0f9347f26dd05e4a8431f57e
SHA1 6a408ab37cecd25aefb69f291d6530e37d9bba68
SHA512 2043f078eee7937913f962d7a9559d91a3cdfd48252fb5b3847eb0285a14b4ca44322e1fee6dd8b53e0d75c9eec36bc413fad2ee0c0f461d9d766e9b96b55c1b
SSDEEP 768:ZF1j+9R3mwgFctcfyjfI7f1A7NpespIRM0UmkTziwjgzSIwn12bfZ3C:o9R3efYfOfMQsZ0UmYoKyZ3C
TLSH
T1DF233AF198D38976D9AE9787673D2E069EFCC163B1841984BBC84D4CCC821BFD70A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b58bde640151f43e0948e58ec53bd99345dd78546451e51a03ae9162e7f3643a
MD5 2dae4dd1ee8a9c0c38acb0e4fa22c9a5
SHA1 6cec46d01ea687813e61fbc8aa23fb29501b1618
SHA512 cade9fe940ed669289fb11e658cc496be5f3778ffcbae6c8f375589e70f7ae34638daa8bf0c50173059c40c13f453db3fcf9e05be64645234286d4ac24c65841
SSDEEP 768:Lj+9V3/c5fyjfI7f4A7NpespIRM0UmkTziwjgzSIwn12bfZ3C:e9V3GfYfOftQsZ0UmYoKyZ3C
TLSH
T10DF2AE3198255E638DFAEB8D6A463757AFE0026381C41A4888D98F4D45C779C2B1BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 abb82384fcb9c5dd669db430565f939e68688e581e5e533d8438a400c80f2aa7
MD5 326c807289af5e094a2ab42c3bcda76f
SHA1 8d5972d98e578bbdf4ee5ea042ae9b7e678b89dd
SHA512 f89f58e09380821588b0812b9310218730ed97e3628003499f271ac51e99288e6fdeeab7810e7d7c57401b2348e5720b0696f9fb01cc7c130ebec5a8d7a999cc
SSDEEP 768:4j+9V3oc5fyjfI7f4A7NpespIRM0UmkTziwjgzSIwn12bfZ3C:n9V3RfYfOftQsZ0UmYoKyZ3C
TLSH
T1B6F2AE31D8255E638DFAEB8D6A473747AFE0026381C42A48C8D98F4D45C779C2B1BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d961ffde-60bb-40ed-a3f8-95fc9c617e8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d961ffde-60bb-40ed-a3f8-95fc9c617e8f.tmp
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2540_861489632\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d41ccbd0a417b7d980053b0c65e9005d71292a8ec9fed03a911673c93fcf3780
MD5 792e911c5c82625843ec75438d3d8814
SHA1 f4ee32bbde40ed1e6a965cf315d025a110f83d3c
SHA512 54c78dac5cc061a8a78b5085ff312d191753895264a7bcfb5a388945226c3c211570d7051bc47266ea458c1348a4e6f5db2d3ee9d609103d0fe7a8e9558f2943
TLSH
T1BE71239366F8C9B3C2DA5BF003835244F1FB223C4B2330240B51598BEB30A7A58B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1096-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1800-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2436-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2436-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2780-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4552-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4592-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4644-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4708-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5644-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5712-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5920-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5920-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5920-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download