systex | 2b9fa999c91ae94c864785e508a02c42e1a37e1c03b81075f12dc37e2ae86387

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260701-w72axsd16w
SHA256 2b9fa999c91ae94c864785e508a02c42e1a37e1c03b81075f12dc37e2ae86387
MD5 b9c4dace37adcb2e2e523ed2938ba8a2
SHA1 b572a8d1474ecc4202ea22c2cca798a6b74ef162
SHA512 2cd9bc077be13da449e5e9ce10a465a4a4c75621325ff511dd615ec7fbad4c6b5c55214ee74922815b7869d7ae9ff1f0b7f91f42247c7b6396757f6c5677b796
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1840	toigaysqlidbvtnl.exe
1488	toigaysqlidbvtnl.sys
2848	CreateProcess.exe
5500	vtnlgdyvtn.exe
5796	CreateProcess.exe
3144	CreateProcess.exe
3552	i_vtnlgdyvtn.exe
4368	faxvqnifay.sys
4200	CreateProcess.exe
4396	xvtnlfdxvq.exe
5344	CreateProcess.exe
3292	CreateProcess.exe
4920	i_xvtnlfdxvq.exe
1924	caxsqkicav.sys
5300	CreateProcess.exe
704	xvpnhfaxsp.exe
4956	CreateProcess.exe
5368	CreateProcess.exe
4908	i_xvpnhfaxsp.exe
5884	hfzxspnhfc.sys
2688	CreateProcess.exe
1056	hfcauspnhf.exe
2648	CreateProcess.exe
5148	CreateProcess.exe
2836	i_hfcauspnhf.exe
3036	smkhczurmk.sys
824	CreateProcess.exe
4444	rpjhbzxupm.exe
3100	CreateProcess.exe
3932	CreateProcess.exe
4120	i_rpjhbzxupm.exe
4524	mkecwuomhe.sys
616	CreateProcess.exe
4920	ezwrojgezw.exe
2424	CreateProcess.exe
2764	CreateProcess.exe
3704	i_ezwrojgezw.exe
3696	romgezwroj.sys
2568	CreateProcess.exe
5356	uomgeywroj.exe
4908	CreateProcess.exe
1408	CreateProcess.exe
3372	i_uomgeywroj.exe
52	bvtqojgbyw.sys
840	CreateProcess.exe
1080	ywqomgdbzt.exe
108	CreateProcess.exe
1316	CreateProcess.exe
5488	i_ywqomgdbzt.exe
5316	idbvtnlgdy.sys
2616	CreateProcess.exe
2960	dbvtnlfdyv.exe
820	CreateProcess.exe
2664	CreateProcess.exe
4300	i_dbvtnlfdyv.exe
4608	nlgdyvqolg.sys
5960	CreateProcess.exe
1880	dxvqnigays.exe
2456	CreateProcess.exe
4224	CreateProcess.exe
5704	i_dxvqnigays.exe
4480	qnlfdavtnl.sys
1440	CreateProcess.exe
4880	nkicaysqki.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1661398503\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1583697256\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1583697256\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1661398503\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1661398503\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1661398503\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_927568136\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1855733291\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1855733291\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_464964697\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_464964697\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1583697256\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_1583697256\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomgdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rligebvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rligebvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmheczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmheczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoifdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoifdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcauspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigaysqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcauspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hurpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomgdbzt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6096	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1784	ipconfig.exe
692	ipconfig.exe
1980	ipconfig.exe
4228	ipconfig.exe
4228	ipconfig.exe
2328	ipconfig.exe
3776	ipconfig.exe
5788	ipconfig.exe
2072	ipconfig.exe
3448	ipconfig.exe
5404	ipconfig.exe
2644	ipconfig.exe
3040	ipconfig.exe
3776	ipconfig.exe
3432	ipconfig.exe
624	ipconfig.exe
3156	ipconfig.exe
884	ipconfig.exe
3952	ipconfig.exe
3284	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274044836313837"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{911F05BD-2982-4D52-89B3-DD71BC2AFFA5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
1840	toigaysqlidbvtnl.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
1840	toigaysqlidbvtnl.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
1840	toigaysqlidbvtnl.exe
1840	toigaysqlidbvtnl.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
1840	toigaysqlidbvtnl.exe
1840	toigaysqlidbvtnl.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
1840	toigaysqlidbvtnl.exe
1840	toigaysqlidbvtnl.exe
1840	toigaysqlidbvtnl.exe
1840	toigaysqlidbvtnl.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	i_vtnlgdyvtn.exe
Token: SeDebugPrivilege	4920	i_xvtnlfdxvq.exe
Token: SeDebugPrivilege	4908	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	2836	i_hfcauspnhf.exe
Token: SeDebugPrivilege	4120	i_rpjhbzxupm.exe
Token: SeDebugPrivilege	3704	i_ezwrojgezw.exe
Token: SeDebugPrivilege	3372	i_uomgeywroj.exe
Token: SeDebugPrivilege	5488	i_ywqomgdbzt.exe
Token: SeDebugPrivilege	4300	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	5704	i_dxvqnigays.exe
Token: SeDebugPrivilege	6072	i_nkicaysqki.exe
Token: SeDebugPrivilege	1228	i_khfzxspkic.exe
Token: SeDebugPrivilege	364	i_upmheczusm.exe
Token: SeDebugPrivilege	3200	i_hurpjhczur.exe
Token: SeDebugPrivilege	3704	i_trmjecwuom.exe
Token: SeDebugPrivilege	3196	i_bztrojgebw.exe
Token: SeDebugPrivilege	3252	i_rligebvtql.exe
Token: SeDebugPrivilege	3716	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	4148	i_qoifdavtnl.exe
Token: SeDebugPrivilege	3448	i_xusqkicavs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 1840	4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 4336 wrote to memory of 4572	4336	2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4572 wrote to memory of 1652	4572	iexplore.exe	90
PID 1652 wrote to memory of 1128	1652	msedge.exe	91
PID 1652 wrote to memory of 5660	1652	msedge.exe	93
PID 1652 wrote to memory of 6096	1652	msedge.exe	94
PID 1652 wrote to memory of 5660	1652	msedge.exe	93
PID 1652 wrote to memory of 5660	1652	msedge.exe	93
PID 1652 wrote to memory of 1232	1652	msedge.exe	95
PID 1652 wrote to memory of 1232	1652	msedge.exe	95
PID 1652 wrote to memory of 5932	1652	msedge.exe	97
PID 1652 wrote to memory of 3432	1652	msedge.exe	96
PID 1652 wrote to memory of 5932	1652	msedge.exe	97
PID 1652 wrote to memory of 5932	1652	msedge.exe	97
PID 1652 wrote to memory of 3432	1652	msedge.exe	96
PID 1652 wrote to memory of 3432	1652	msedge.exe	96
PID 1652 wrote to memory of 2908	1652	msedge.exe	98
PID 1652 wrote to memory of 5264	1652	msedge.exe	99
PID 1652 wrote to memory of 2908	1652	msedge.exe	98
PID 1652 wrote to memory of 2908	1652	msedge.exe	98
PID 1652 wrote to memory of 5264	1652	msedge.exe	99
PID 1652 wrote to memory of 5264	1652	msedge.exe	99
PID 1652 wrote to memory of 2032	1652	msedge.exe	100
PID 1652 wrote to memory of 2032	1652	msedge.exe	100
PID 1652 wrote to memory of 820	1652	msedge.exe	104
PID 1652 wrote to memory of 820	1652	msedge.exe	104
PID 1652 wrote to memory of 5648	1652	msedge.exe	105
PID 1652 wrote to memory of 5648	1652	msedge.exe	105
PID 1840 wrote to memory of 2848	1840	toigaysqlidbvtnl.exe	106
PID 1652 wrote to memory of 5084	1652	msedge.exe	109
PID 5500 wrote to memory of 5796	5500	vtnlgdyvtn.exe	111
PID 1652 wrote to memory of 2544	1652	msedge.exe	116
PID 1652 wrote to memory of 2544	1652	msedge.exe	116
PID 1652 wrote to memory of 4332	1652	msedge.exe	117
PID 1652 wrote to memory of 4332	1652	msedge.exe	117
PID 1840 wrote to memory of 3144	1840	toigaysqlidbvtnl.exe	118
PID 1840 wrote to memory of 4200	1840	toigaysqlidbvtnl.exe	122
PID 4396 wrote to memory of 5344	4396	xvtnlfdxvq.exe	124
PID 1840 wrote to memory of 3292	1840	toigaysqlidbvtnl.exe	127
PID 1840 wrote to memory of 5300	1840	toigaysqlidbvtnl.exe	131
PID 704 wrote to memory of 4956	704	xvpnhfaxsp.exe	133
PID 1840 wrote to memory of 5368	1840	toigaysqlidbvtnl.exe	136
PID 1840 wrote to memory of 2688	1840	toigaysqlidbvtnl.exe	140
PID 1056 wrote to memory of 2648	1056	hfcauspnhf.exe	142
PID 1840 wrote to memory of 5148	1840	toigaysqlidbvtnl.exe	146
PID 1652 wrote to memory of 4680	1652	msedge.exe	148
PID 1652 wrote to memory of 2028	1652	msedge.exe	149
PID 1652 wrote to memory of 5488	1652	msedge.exe	150
PID 1840 wrote to memory of 824	1840	toigaysqlidbvtnl.exe	153
PID 4444 wrote to memory of 3100	4444	rpjhbzxupm.exe	155
PID 1840 wrote to memory of 3932	1840	toigaysqlidbvtnl.exe	158
PID 1840 wrote to memory of 616	1840	toigaysqlidbvtnl.exe	162
PID 4920 wrote to memory of 2424	4920	ezwrojgezw.exe	164
PID 1840 wrote to memory of 2764	1840	toigaysqlidbvtnl.exe	167
PID 1840 wrote to memory of 2568	1840	toigaysqlidbvtnl.exe	171
PID 5356 wrote to memory of 4908	5356	uomgeywroj.exe	173
PID 1840 wrote to memory of 1408	1840	toigaysqlidbvtnl.exe	176
PID 1840 wrote to memory of 840	1840	toigaysqlidbvtnl.exe	180
PID 1080 wrote to memory of 108	1080	ywqomgdbzt.exe	182
PID 1840 wrote to memory of 1316	1840	toigaysqlidbvtnl.exe	185
PID 1652 wrote to memory of 1912	1652	msedge.exe	189
PID 1652 wrote to memory of 1912	1652	msedge.exe	189
PID 1840 wrote to memory of 2616	1840	toigaysqlidbvtnl.exe	193
PID 2960 wrote to memory of 820	2960	dbvtnlfdyv.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_b9c4dace37adcb2e2e523ed2938ba8a2_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Temp\toigaysqlidbvtnl.exe
  C:\Temp\toigaysqlidbvtnl.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdyvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2848
  - - C:\Temp\vtnlgdyvtn.exe
      C:\Temp\vtnlgdyvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Temp\i_vtnlgdyvtn.exe
      C:\Temp\i_vtnlgdyvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4200
  - - C:\Temp\xvtnlfdxvq.exe
      C:\Temp\xvtnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3292
  - - C:\Temp\i_xvtnlfdxvq.exe
      C:\Temp\i_xvtnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\xvpnhfaxsp.exe
      C:\Temp\xvpnhfaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5368
  - - C:\Temp\i_xvpnhfaxsp.exe
      C:\Temp\i_xvpnhfaxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcauspnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\hfcauspnhf.exe
      C:\Temp\hfcauspnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcauspnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5148
  - - C:\Temp\i_hfcauspnhf.exe
      C:\Temp\i_hfcauspnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:824
  - - C:\Temp\rpjhbzxupm.exe
      C:\Temp\rpjhbzxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3932
  - - C:\Temp\i_rpjhbzxupm.exe
      C:\Temp\i_rpjhbzxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrojgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\ezwrojgezw.exe
      C:\Temp\ezwrojgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrojgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\i_ezwrojgezw.exe
      C:\Temp\i_ezwrojgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2568
  - - C:\Temp\uomgeywroj.exe
      C:\Temp\uomgeywroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1408
  - - C:\Temp\i_uomgeywroj.exe
      C:\Temp\i_uomgeywroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqomgdbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:840
  - - C:\Temp\ywqomgdbzt.exe
      C:\Temp\ywqomgdbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqomgdbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1316
  - - C:\Temp\i_ywqomgdbzt.exe
      C:\Temp\i_ywqomgdbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2616
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5960
  - - C:\Temp\dxvqnigays.exe
      C:\Temp\dxvqnigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4224
  - - C:\Temp\i_dxvqnigays.exe
      C:\Temp\i_dxvqnigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1440
  - - C:\Temp\nkicaysqki.exe
      C:\Temp\nkicaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicaysqki.exe ups_ins
    3⤵
    PID:2028
  - - C:\Temp\i_nkicaysqki.exe
      C:\Temp\i_nkicaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxspkic.exe ups_run
    3⤵
    PID:2304
  - - C:\Temp\khfzxspkic.exe
      C:\Temp\khfzxspkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxspkic.exe ups_ins
    3⤵
    PID:4232
  - - C:\Temp\i_khfzxspkic.exe
      C:\Temp\i_khfzxspkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmheczusm.exe ups_run
    3⤵
    PID:2840
  - - C:\Temp\upmheczusm.exe
      C:\Temp\upmheczusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmheczusm.exe ups_ins
    3⤵
    PID:3104
  - - C:\Temp\i_upmheczusm.exe
      C:\Temp\i_upmheczusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hurpjhczur.exe ups_run
    3⤵
    PID:3616
  - - C:\Temp\hurpjhczur.exe
      C:\Temp\hurpjhczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hurpjhczur.exe ups_ins
    3⤵
    PID:2036
  - - C:\Temp\i_hurpjhczur.exe
      C:\Temp\i_hurpjhczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run
    3⤵
    PID:2788
  - - C:\Temp\trmjecwuom.exe
      C:\Temp\trmjecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    PID:988
  - - C:\Temp\i_trmjecwuom.exe
      C:\Temp\i_trmjecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrojgebw.exe ups_run
    3⤵
    PID:2068
  - - C:\Temp\bztrojgebw.exe
      C:\Temp\bztrojgebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrojgebw.exe ups_ins
    3⤵
    PID:3420
  - - C:\Temp\i_bztrojgebw.exe
      C:\Temp\i_bztrojgebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rligebvtql.exe ups_run
    3⤵
    PID:1284
  - - C:\Temp\rligebvtql.exe
      C:\Temp\rligebvtql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rligebvtql.exe ups_ins
    3⤵
    PID:3856
  - - C:\Temp\i_rligebvtql.exe
      C:\Temp\i_rligebvtql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    PID:3596
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    PID:4248
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoifdavtnl.exe ups_run
    3⤵
    PID:2492
  - - C:\Temp\qoifdavtnl.exe
      C:\Temp\qoifdavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoifdavtnl.exe ups_ins
    3⤵
    PID:5580
  - - C:\Temp\i_qoifdavtnl.exe
      C:\Temp\i_qoifdavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusqkicavs.exe ups_run
    3⤵
    PID:3608
  - - C:\Temp\xusqkicavs.exe
      C:\Temp\xusqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusqkicavs.exe ups_ins
    3⤵
    PID:2868
  - - C:\Temp\i_xusqkicavs.exe
      C:\Temp\i_xusqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffc699c188,0x7fffc699c194,0x7fffc699c1a0
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,6262038710229023781,1174513815227392334,262144 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17816916886094349255,5820622752736194266,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:11
      4⤵
      System Time Discovery
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,13351657732329218739,3001089699084734285,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,10347810272109895143,2171213566385443030,2097152 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,6953250005850434351,608021580742659024,2097152 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,14826672230151823226,3680770610039881497,2097152 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3587704178181649274,17982449950589959930,2097152 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:9
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,6608356747040217936,3553945367740190262,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,10966278501771171919,11215534101368004965,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17808388747227229220,6630024624281141946,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6132326548174047371,14426083736614329645,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6132326548174047371,14426083736614329645,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9281072492945629974,13362530644176449782,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,4284348298395682160,14687901254014972856,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,10092118956523813526,6187962195787018308,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,15340956963802311631,13861190913390438174,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,15384996945455611974,7848049990392335004,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6465822054051569974,8620908748167771142,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,15468927742661584427,9466051535672534561,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,14653080720602484280,16014407107686908452,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,14648611665446374279,5090052644538271545,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14018741799139793570,7053259369282043901,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,11028142891864604113,1966260788910756496,262144 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:10
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14820493573861327566,2654092148924261127,524288 --field-trial-handle=1828,i,3342298617036592409,7149714602038459403,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1756

C:\Temp\toigaysqlidbvtnl.sys
C:\Temp\toigaysqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5968

C:\Temp\faxvqnifay.sys
C:\Temp\faxvqnifay.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\caxsqkicav.sys
C:\Temp\caxsqkicav.sys
1⤵
- Executes dropped EXE
PID:1924

C:\Temp\hfzxspnhfc.sys
C:\Temp\hfzxspnhfc.sys
1⤵
- Executes dropped EXE
PID:5884

C:\Temp\smkhczurmk.sys
C:\Temp\smkhczurmk.sys
1⤵
- Executes dropped EXE
PID:3036

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\romgezwroj.sys
C:\Temp\romgezwroj.sys
1⤵
- Executes dropped EXE
PID:3696

C:\Temp\bvtqojgbyw.sys
C:\Temp\bvtqojgbyw.sys
1⤵
- Executes dropped EXE
PID:52

C:\Temp\idbvtnlgdy.sys
C:\Temp\idbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:5316

C:\Temp\nlgdyvqolg.sys
C:\Temp\nlgdyvqolg.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\qnlfdavtnl.sys
C:\Temp\qnlfdavtnl.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
PID:5328

C:\Temp\smkhczxrpk.sys
C:\Temp\smkhczxrpk.sys
1⤵
PID:1436

C:\Temp\hecwuspjhf.sys
C:\Temp\hecwuspjhf.sys
1⤵
PID:2176

C:\Temp\uomhezxrpj.sys
C:\Temp\uomhezxrpj.sys
1⤵
PID:1668

C:\Temp\bztrljhbzw.sys
C:\Temp\bztrljhbzw.sys
1⤵
PID:5656

C:\Temp\wtrljdbywt.sys
C:\Temp\wtrljdbywt.sys
1⤵
PID:3908

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
PID:3644

C:\Temp\qnifdxvqnl.sys
C:\Temp\qnifdxvqnl.sys
1⤵
PID:5704

C:\Temp\xvpnkfdays.sys
C:\Temp\xvpnkfdays.sys
1⤵
PID:6008

C:\Temp\snkfcaxvpn.sys
C:\Temp\snkfcaxvpn.sys
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caxsqkicav.sys

Path C:\Temp\caxsqkicav.sys
Size 293KB
SHA256 bcf6c5860a3cc6d6d9031eb7fd450c93be72072983b9644c65f94a44ce8261e0
MD5 fd77f3216326391fbdf47f600a8a6957
SHA1 ac5b1a86ec86219b422fcddfc453c0f6ab62abd4
SHA512 e5496c449fb8bafcc1ad0e270cb7f6e31a862bc41a00e07070d5eb5d450bac9e68d0cb32be5e9c94cefd2f2a1e45815210a4a23b1cbd6c6da383084bcd67b97f
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrojgezw.exe

Path C:\Temp\ezwrojgezw.exe
Size 384KB
SHA256 7683c20c2930bbcb9ac359b7aa3ed6d77ee5b485d4c3ee3f25a334e69f86d03e
MD5 3ab2b255ee9ea8d25932db9395275dd0
SHA1 d7a78de6b9ba87e99c7e434d8f63d5417bfb25ff
SHA512 9c77d2ed46908116503680a51cd2002a46b82638ad9d11fa96cefb7c4c3692b47fd256fdf4422a36534ea0c2762e966b9fda0df9ef7b80c071ccdcc4a2569246
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvqnifay.sys

Path C:\Temp\faxvqnifay.sys
Size 293KB
SHA256 fa4f013bf97aaa8c2100c5357ae80a00886820b6407a85b6567106aea6d5469d
MD5 e71c2efc0c5e7b8b6f2f5df33e782810
SHA1 ac62c2a977c23ebcad1e518d90b22ed3ff831d82
SHA512 6f730528a812b030504b5e0de955613c8fa94857a4e62c27d45a1a7aac60358750ed75146cc5bf4e9dc4b4cf90661361488a64d88b3df648807173728b174f1e
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcauspnhf.exe

Path C:\Temp\hfcauspnhf.exe
Size 384KB
SHA256 eeaf1c803c0a6ff159eebc27805be2dae4e4caa31a16b934f36a9e83683d432c
MD5 e346b6b82a326533636f73165bb38d41
SHA1 342076a0233999ddf4927d2665c78f5417a4214c
SHA512 5e9666c33ad6930af5cd6d4ffc98398326333c4c72a027de25e79b7ecd5ccc8f7c235b37e37292e9d8bbccf669f7cfe5fe4791f1fc775a9a377c0edd90a84c08
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspnhfc.sys

Path C:\Temp\hfzxspnhfc.sys
Size 293KB
SHA256 d1e0d5f4bcf40ecb107343ac698d8898dcb8a4f7b3577dbd5942bacf2806918a
MD5 380e2ad83820ce46a43ea0f0a2a2a53a
SHA1 b107d31b85209a83f9a8208a63d01d83eca029a2
SHA512 64d58d9511e2c47442571f26ef8db4e163635b662334b333e1e24fa161bb461e7bf2b7556f9d847fa7e2375b61ded4d40f3d5f7afca6413daf213e635eb1d87b
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T18D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrojgezw.exe

Path C:\Temp\i_ezwrojgezw.exe
Size 384KB
SHA256 c5f94df76140cd4c74a0a2756d5a42256f8ddf106591a61d9f027f2ba5375883
MD5 155b2b282df3327245ceaae7500a8031
SHA1 c6b69f3acf33d62e3772780f80d91cf8503670cf
SHA512 4bdbaad79f51125ed2280f74e3d4a34d2297e655998067b16ebfddc895b3e5ee6d9b6bcb1b77baefdd36d77e77e1391e493546f9ca89593e22b89518ea3d1500
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T136847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcauspnhf.exe

Path C:\Temp\i_hfcauspnhf.exe
Size 384KB
SHA256 974b385c67329c09cd1f1273c1a646cdd3f972f85a4a92fc102ae2477643c842
MD5 01c384ca079a3b79f92d522e917549bc
SHA1 6608f967521f5c53081e5015f6ffee79bf419028
SHA512 e305d21284a61c77dd6790807ff301e10e012fa8a6c8cd1bd087393d149485e22c96b63a4f478f4a15d7ad6a43408be659977d748bd22ee670df72bcf6b682a6
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzxupm.exe

Path C:\Temp\i_rpjhbzxupm.exe
Size 384KB
SHA256 0ea4b177ff938ad7a0846233a33b17e62af5fa932fc6c570df6ec1d4e4a444c9
MD5 be1e9ad99d4f9aa23d58a20738e24925
SHA1 9c76119ad72da6e2f29c58b1069c0d47b43735f2
SHA512 cc40810ee538e13720188ead6fe5b7137765ed8a901ee7911e4ebd876caa4a4483afe51c79548fb6b21a413310649409d9fa2187cd284cba8fb19cdb2db2ab4d
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlgdyvtn.exe

Path C:\Temp\i_vtnlgdyvtn.exe
Size 384KB
SHA256 74e8e4e353abfa0b04315e78b56141a68fe09df8e198f09840c4c2f8fd563de1
MD5 a3b03253f07c70428a30b2e1b8fb15db
SHA1 89c306aca2a394d3a546d233c6ccd5f9ccf5c0a1
SHA512 0805f63ed11d717fde50eedede5112516e4467a613d3de900c4d4f571d377398af0d07a2dbe0705a54e11705ed4fee8795cdc19877295120f391ab61eaa39c44
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfaxsp.exe

Path C:\Temp\i_xvpnhfaxsp.exe
Size 384KB
SHA256 0c9734bd56591f3848b32cad838e92ac125ac7432049c0ca2636ecfe3ffa6851
MD5 9427e23b1f603fa6bf8f548d7b4d3b7d
SHA1 9066ea0434e5fc31c8a16070e2912e1f8873a7e7
SHA512 1c47cb078ad7a2cb8f8e1daf3ed6ab5ca47316de873dc02b2c687d8f14a52b15cf2cf40d5712e51ddefb19c26a42a605a9351d2a9d99006834f62cb8dc07c2f9
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvtnlfdxvq.exe

Path C:\Temp\i_xvtnlfdxvq.exe
Size 384KB
SHA256 1c575273da62e70f52160b691a7360f18a1c179c14d85b25c1510972c52be2eb
MD5 1baa943c21fd7d33e2520e0bf0ac2cf7
SHA1 fedc7a2e02f71892e7aa11f5dfee03c197e5181e
SHA512 e7d77ca1516492631e99bb81c1aaf39096b6927895fadd9764ddb4d9cf6e4a18043c9da8035f89d9d513f1e96cd599d4e595012f491bbd8cea152deebb58df0d
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwuomhe.sys

Path C:\Temp\mkecwuomhe.sys
Size 293KB
SHA256 1cdecf4650289c5582ffb6cbd0899d0720b16e97c477eaffd3d0f44f372efa1c
MD5 35002e7560f4fc8f08df84483e1700f2
SHA1 9c485339bf11d0c4cb03b9f63391a358e9a46bd3
SHA512 55b949771a057750ef0c7e744f0e1f3290978636d9d3578e7be25cb0b14c3e31a00ff190d1306d2a743b66c52250048237187387a72062c6e2be645553bfd50a
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzxupm.exe

Path C:\Temp\rpjhbzxupm.exe
Size 384KB
SHA256 5ac482c97a89f85352204ee644a78b97d62b6d94e79dbe91f3e88c896503feae
MD5 3b1e003bb0d9a63c308fccd7bbe6e224
SHA1 71638bcfaf0e1ce05222692ad827c949ed9e2408
SHA512 b2d879ceea63cca756e79615354b75c4b7259fee1a1c06022caa0ed187e9f488a139017e6420bb7d6c343798dada2ed446cbcc97ca05045903c8f5598003746b
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhczurmk.sys

Path C:\Temp\smkhczurmk.sys
Size 293KB
SHA256 b0bfbc5189c7be06b229c42aea2563e0ccbfb1e53694c22ee978dc0668523077
MD5 f81312430c957ef7e0ead1ba42e1826d
SHA1 0d8a20b4b5872366a3113ddae51c6cf9a3f2d863
SHA512 8b1cb48057553292f987fb93693c9a462bfbe9408f8deed984edbdf00cb9df4f52f5d18cf5681a0e4795e4ead78c74b818789b379c77f50b120458a8acfbb4c8
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toigaysqlidbvtnl.exe

Path C:\Temp\toigaysqlidbvtnl.exe
Size 384KB
SHA256 bf22d8cd2de55dd12652624e64e2a541fb10a7fada050d5836e721ebeb5e91de
MD5 aa5bc0a703195ca6ad6d75464d012b1b
SHA1 24ad83c6ecb33f11daadd3f0977ddb8ae9ccc259
SHA512 4dfc544ef41879bc011927c628cbc1323f4eed7908759c5053441c3218c78365ccb4c0c176a459a7440e03da093b01d354a4bb447c82eebf35b34728da0bd375
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toigaysqlidbvtnl.sys

Path C:\Temp\toigaysqlidbvtnl.sys
Size 293KB
SHA256 b223080d5ae46f41e8cf08907642ad6fb6ca0d6b6aab2952b41c8c118cd1f441
MD5 354d7b40fc1b2b0192fb6631ee4f69b2
SHA1 b9390564025fbc9d1bc6278b112b46990827b1a8
SHA512 bf521033f6c4cb7a9304e2e999042bc0a63686fb7f10f8ed90ab1874a8ad54fb56a7adc9fb499ea5b36d34b9ee127dc93af7a7a30641405ff3aa73538dec9337
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvtn.exe

Path C:\Temp\vtnlgdyvtn.exe
Size 384KB
SHA256 a055d074e62a40d7888298cc5cb077a00541314d475d0e0c8a2800b6633a317a
MD5 f7f03723027252b1a34b4c6d76ff6d89
SHA1 8b9164120460410e5db98b06026c5834a34e82a6
SHA512 7c8a751cabade6eec49c3d5a78647068f49ea44442e25c5fe5bbea849f02fa9712e2af9a1fdf8a5af34637ee976006899be7cfe0306d8069d73095ef77f739a9
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfaxsp.exe

Path C:\Temp\xvpnhfaxsp.exe
Size 384KB
SHA256 fd8ff2cb7f1a87ed5d898a9faf04a4ce55e57006e88d916173ab626fdd889149
MD5 1a88be281893970fd4d230c9c63d48b5
SHA1 05119e1a3f0c5230800e39e68ca524ec953bd651
SHA512 20512c906cc1a0299b3b70277c687bc6f7be8d7db7884628d4d6864f21e9ebb4e9e9502112816fec9f6f829cc2131abe663482cc302dec13a095e34e801128e8
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnlfdxvq.exe

Path C:\Temp\xvtnlfdxvq.exe
Size 384KB
SHA256 983de318c8143c96b9d52cde72db4c0fd3201a308a92b0f55d2401ceeccda66c
MD5 baac786905999252d2fdb00c038b90da
SHA1 819256d56256ad084f9136c19e2414a56b2ca3f2
SHA512 19743d1fda7f664cca8c7657f93779b33638c1d3fe23d97363c8535f9abbdc063a7274a631f1a1f1c9cad8c70ee0dfa8166d110568af6be614ac623a40e4ae92
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CE846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b4b91e2c6408056d62e9ab108c4a1bc3372697cc673aea50cc1ab639cb36d31
MD5 31627e295d41c3cf43475c41d5522c43
SHA1 03580db0a47167f6acdfbb28d1db3e5fd631377d
SHA512 b71b6edd012c155ef24382afc691d07b436ca311747e424ecd928e1ae50b54eb9c2cef7113ea3e73a4f92dfa3cafacd84c0410c0f05a6860d79a46a87ba532f3
TLSH
T192D0C0293D44FC02C1891070760133D0755001F03056C3C59002E02DDC3814083DB09B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 37abd39218624bea608ed1c31cedc29697ad7dcee756e85d36f477bc96d5d79e
MD5 02d5d30f7a50d6501cf8e28620d036a8
SHA1 7b35285f7d86d5c3e0211627a1949eba907bccc2
SHA512 75c5013e8f146add9f0df252bb7669ce045b68d4f02b1aa7609d01a9ab18fda0f9b2e387ce15f36d76b8019dce58f4ed010f4a4528819164adeaf356a9fdc485
TLSH
T1FFD0C02D3D44FC02C1891070760033D0756001F03056C3C59002E01DDC3814083DB0AF
MD5 SHA1 SHA512 TLSH

Submit Download

6134c231-035c-4317-96a5-455d0ed38d9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6134c231-035c-4317-96a5-455d0ed38d9f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6ef086c0c43eb3eeb65da79f5fab686588c03c2072d8b8b24c732411bd76b12f
MD5 371607938bc63722920550955dbc2bb4
SHA1 dbe0b5d2e475eca37c2873364f3fcf9a47c7739e
SHA512 1878cb06634093d601498e517f2ea42b3af6244473bd6ca0268bce30165338c24c4d3421f01c2a1eccf40cda8737bbc77eac7637c7953d33f9da3e680870c1fb
TLSH
T1F261502F542E0B58D73A50B60DDE1798FF7480950F876F52469DAAF6282B3DC70A2721
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f037.TMP
Size 3KB
SHA256 095ae2ceb28f21a1e23c90420e1aded803f02197a2f0fd7fe63a9fdb606a212b
MD5 40f88359336b8eeca7470ec84174cf56
SHA1 f0941ffb88f0282d42b686ff2ac965d078b1752a
SHA512 80c4e9f10c4e81ac16f6b5b647e1dbc568fcb1fc55f32e429edf965cade3e90ba4f276c8fa6b493c5b46a91f16564754c0d2daee9222e770d7e2cf8131210920
TLSH
T16461612F192E0B58D73A50B60DDD1798FF7080950F876F5246ADAAF6286B3DC70A2721
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

128a6903-0971-4426-908a-12433481f39b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\128a6903-0971-4426-908a-12433481f39b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d0c0637e-b305-4221-87ec-8c2aee59e659.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0c0637e-b305-4221-87ec-8c2aee59e659.tmp
Size 2KB
SHA256 728408614ad2bb74981b64f297b62be62cf47cff4262d89f656c3c956accd762
MD5 3ad3dcfece20a08d80bf7567dcdac824
SHA1 60a08efd468f17948ff9f5e3102531ad7eda94c8
SHA512 3bcc397d8db4cadac082297e99cf227bb01ac4971d3794312459483c3ff55bbbe1f747ae5230cbc3be84816557bb9745e1fa59672472e173233d70a14231d67c
TLSH
T1E251BFF7C3E8866DC90185F0BA187E2BCE1D0914832C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c80114288de078a8294cd5b55008591550127789ff27b063648baae8e3643480
MD5 8549dcbf1bbb3f2d7013219c068ab2e3
SHA1 ac8dae61ff4ca3accc4c4bdeda5445b459ce92e9
SHA512 2be237f297c7ada416534d822b9e898efad05ac2144b27268feccea1e43e7daeaa4fa3cbad741305520e4f0f084b658012a600c4a8b7e295fdfbc46dc1ffc8d2
SSDEEP 192:sxRrRhyM/jK1Ml8wcY/fBsDzaPZSREzoA8p9n/g6+WNCtK/YHnRAGEIgtJ:sxRrlCY/fBsDmR4l/5V/QM3
TLSH
T1F562E9166A38593BCCDBD20DFA557B53D2F81573A2941E44AAFC8B0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d8164589148e3fcb68119ff216fdc0b89357c39c98e6f4240f146f77b13fe8bc
MD5 418d6c7b6288c7f80d26463cd0dabb4b
SHA1 373082b23aca81cf4d516506306cb0c4c11812cc
SHA512 02d3770c06e8d2792a1ba8dff3bd49413fe2c7ea830f5f83676fcbfc7df28611372530b38264e8cfb89b7bafb950b038fbfc92df2f651808bd5add868868dd2b
SSDEEP 192:sxRMRhyM/jK1Ml8UQ2cY/fBsjztPZSREzoA8prn/g6+WNCtK/YHZRAGEIgDlJ:sxRMlq1Y/fBsjZR4b/5V/uMD
TLSH
T1CC62EA16AA245937CCDBD20DFA517B53D2F85573A2940E04AAFCCB0C02E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dc3f30a7d42fa4b7209afd9ba7438e153d6109d5ba213ab21218bbbf00ba0909
MD5 bfb2f1c7b609620d5e1c3f3cbaabdc4e
SHA1 4d8fb08b665ff2b1a9a7ca2cfe1428e880b2fbdb
SHA512 ba160be03b854f6070ef02b5f403833a01671b54289ae786de89b9dd17ca2172c8430537a333dff06b177759c0a4e3d64c79cda1b549711ddc568099aa1b4568
SSDEEP 192:sxRMRhyM/jK1Ml8wcY/fBsjzaPZSREzoA8p9n/g6+WNCtK/YHnRAGEIgD/J:sxRMlCY/fBsjmR4l/5V/QMF
TLSH
T11062EA16AA34593BCCDBD20DFA557B53D2F81573A2941E44AAFC8B0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f3703dff9a8a4eb01647931a4e74452a0038a70b20ed361f497adea11b07412f
MD5 6aa7cd15612b008052b231b2e6e6e325
SHA1 4c62682790ff79a5613a8046b40ed4484dbf1d01
SHA512 454d25ce7b99afaa8b0e862c25e881712b65d1a17fdefea77353de3865d405cb9ccb0338f6cdf4d70af952e51143290e84c5791549f608f59a39843d322bb8b5
SSDEEP 768:6laYfO7pLuL7mjWgRNf2b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqIB8Azwxro3J5v:6laYfOE7mjWgRNf2bu1jaR48UwK55v
TLSH
T116E2DB3B680CCB7E4F80499CED297E9AADDC02CF56D8895447EA880C03C67EB55165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0e16aef7d18586b556e25f408459d7f25623479d9b19bcb3b4fb3a44d9b57a59
MD5 e236cc68f9348e1fb9700a294a9baafa
SHA1 9857d58aec9df084fb5ab6e8820b657a3fafe7ab
SHA512 f6bd470c8ed1be144dc54415658e93be9a7bf7d285b0dd0e0b963ce5a1eec6ac15b55747e71c17a6a75a5d6837af88ce0746d724bd2544dbed40f1f7811e95dd
SSDEEP 768:arv+4UNbdB38uC9x+Tf/O1C4fTkRWyvPIINRzWnhIoAl+8r7W:absbT3VTfOC4folgyROIoUDra
TLSH
T12F03CF32E9684A73ECFAD2C87B4B77537EB4416396C60B90C5CC2B4C418B6AE130B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d15b82f7c5d59d69450bd27e763f81a3b289123cf90baa521a10cf8c50a1f52c
MD5 f9c4b981a82d1edc5b75bc30903388db
SHA1 b70cf9098755e8cba6013aa551f8bf917fc8bd40
SHA512 af1535cc364d9a5c24d992090a0c9828b698205906cf90d4a815f265b9a47403b1a2dbe17348317e635bca2844f173a69ac4c85a9016cb901d90649177ebd597
SSDEEP 768:Hj+9I3mjTC9x+Tf/O1C4fTkjfTBWyvPIINRzWnhIoQXc8KzDJd:q9I3WTfOC4fojfhgyROIo+ctzDJd
TLSH
T1A1F2AE36E9664E939CEAE2C8774B37D3AEF4416396C60FA4D5CC1B0C058776E6307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 78d007664442831298468add10c7b2098d8da048bbb3fba6c33c4c1cf4a792ff
MD5 45eae0fa46ba4087d2584205fc6c6848
SHA1 30e986e74f80b63914cdf71d95f0af7bda71ac7a
SHA512 9682a443cc42b67f3a50de16c90184fc51dfbd8ed3d0637493aff84ef41b21944a6e71fdc882feec10292aed54ebe8a9d623f445e4c2014551a3c19a8254682b
SSDEEP 768:prv+4UNbdm338TC9x+Tf/O1C4fTkjfTWWyvPIINRzWnhIoQXeQg:pbsbE3QTfOC4fojfogyROIo+pg
TLSH
T1DE03BE31F9799E639CFBD288B64B77C37EB8146395C60BA4D9CD1B4C054B6AE130B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8779f8b6b36eca9ffebfd378b519c768ebbfe1a1e4bbb73786b1eb070361fa02
MD5 35a81b8b83f194b0b5aa2946589a3180
SHA1 e17d2b2bfca754fa7695f822a5f45ff5127517f9
SHA512 421bc837de932350b9f609dc68911fcb5f3332829f0e1bea215c0a541f5f1c6fb3fd612e2f23c46847cb806cf1087745fcfc7b14a2901bf64655b3c0a77c3c70
SSDEEP 768:Bj+9w3myZMf/O1C4fTkjfT3WyvPIINRzWnhIoQXc8KzDJd:c9w3GfOC4fojfjgyROIo+ctzDJd
TLSH
T1F5133AF594E78972D8AE9387673E7E869DBCC16371890A94F7C81E4CCC8627FD206805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a713d3bc-2b1d-4590-9670-d57f45cfa7ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a713d3bc-2b1d-4590-9670-d57f45cfa7ad.tmp
Size 35KB
SHA256 01c139ca029651c6ce9e928362c87875cc54c69c0b6440045182ba2cabb797ad
MD5 761fd851c91360e96f3ca0f0c22c272a
SHA1 f69b092cb2e33945863d4160c70c737b18991cd7
SHA512 4911baebf8f74d3b529ffc8e74e7cb8039852df82c8f3910b818a8a90301687d640f1d092b4f01b2579fdb52167d43a64a636fa6c4b0ca89acfd88e4440a975e
SSDEEP 768:yj+9I33jTC9x+Tf/O1C4fTkjfTBWyvPIINRzWnhIoQXc8KzDJd:B9I3HTfOC4fojfhgyROIo+ctzDJd
TLSH
T178F2AE76E9664E939CEAD2C8774B37D3AEF44163A6C60FA4D5CC1B0C058776E630780A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

d1735595-d894-4a75-a45b-7c430d47bb5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d1735595-d894-4a75-a45b-7c430d47bb5e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1652_1275920182\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3550a72187908c6a3f13ca6d05ca94827d6c07816f1b3e7eaef8c58e6862c02c
MD5 8a1bb6566da1d4309fa75b067cba6b4c
SHA1 5b2b76928bdf2e7ab77991fae01be501d0cf5e56
SHA512 5a59792bd9eb933244a9a78e643033fca5c27bf5e7ab7fca9589789d9aa36e369a4141a88270a474bf86c497806069622d05fa06dc1357fed163f7313397b7ef
TLSH
T1ED71238356BDCAB3C1DE5BF502835244F2FB22384763302407A555CBAB70E3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/52-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1160-523-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1436-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1488-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1668-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1924-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2176-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3036-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3644-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3696-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3908-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4368-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4524-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5316-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5328-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5704-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5704-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5884-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download