systex | bf3f49ddf937a5d00739a26cbe13ca11daace5a868ea283dcf4f16ecff5472a4

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260701-xctg9set3z
SHA256 bf3f49ddf937a5d00739a26cbe13ca11daace5a868ea283dcf4f16ecff5472a4
MD5 aa967e1f499c85dd232b290f96007e61
SHA1 d67db7b83ff90f3e1e624ea677658bcd4138e537
SHA512 d25b43d244518430a4a9e4766960a9c379061105c6e9ac98853e58c2bcfc69ff64e3efc3584782969bc56eba494a31233351b177a90b548d15815d7ab9e9694b
SSDEEP 3072:iuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
980	xrpkhczurpmhfzxu.exe
2872	xrpkhczurpmhfzxu.sys
1560	CreateProcess.exe
4972	zurpkhcauj.exe
1600	CreateProcess.exe
6108	CreateProcess.exe
2924	i_zurpkhcauj.exe
4916	bzxrpjhecw.sys
5612	CreateProcess.exe
5192	urmjebztrm.exe
2120	CreateProcess.exe
3432	CreateProcess.exe
4432	i_urmjebztrm.exe
1784	rmjebztrmj.sys
3956	CreateProcess.exe
5004	rojhbztrlj.exe
2276	CreateProcess.exe
1112	CreateProcess.exe
5420	i_rojhbztrlj.exe
5140	jebvtrljdb.sys
5068	CreateProcess.exe
5876	jgeywtomge.exe
1152	CreateProcess.exe
3540	CreateProcess.exe
3720	i_jgeywtomge.exe
4212	dbvtnlgdyw.sys
5744	CreateProcess.exe
3268	aytqlidbvt.exe
3104	CreateProcess.exe
1952	CreateProcess.exe
5172	i_aytqlidbvt.exe
2680	gayvqnlgdy.sys
6024	CreateProcess.exe
5060	vtnkigdyvq.exe
5580	CreateProcess.exe
5964	CreateProcess.exe
720	i_vtnkigdyvq.exe
4152	avtnlfdxvp.sys
3172	CreateProcess.exe
1412	sqnifaysqk.exe
5140	CreateProcess.exe
4112	CreateProcess.exe
4664	i_sqnifaysqk.exe
856	spkicaxspn.sys
4288	CreateProcess.exe
4880	spnkfdxvpn.exe
5872	CreateProcess.exe
3456	CreateProcess.exe
204	i_spnkfdxvpn.exe
800	upmkecaxrp.sys
904	CreateProcess.exe
2488	mkeczxrpkh.exe
2936	CreateProcess.exe
5640	CreateProcess.exe
1360	i_mkeczxrpkh.exe
6076	usmkecxupm.sys
3544	CreateProcess.exe
2368	mjeczurmke.exe
1864	CreateProcess.exe
2388	CreateProcess.exe
5528	i_mjeczurmke.exe
4664	CreateProcess.exe
4856	omkebztrpj.exe
4280	CreateProcess.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_449724867\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1466055894\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1466055894\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1170494178\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_449724867\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1391856656\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1391856656\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1466055894\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1466055894\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpkhcauj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnkigdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczurpmhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkebztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpkhcauj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxukecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnkigdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxukecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkebztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausnkfc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3644	ipconfig.exe
1304	ipconfig.exe
5568	ipconfig.exe
552	ipconfig.exe
1712	ipconfig.exe
5932	ipconfig.exe
1148	ipconfig.exe
1668	ipconfig.exe
3372	ipconfig.exe
5552	ipconfig.exe
1836	ipconfig.exe
2916	ipconfig.exe
4532	ipconfig.exe
5604	ipconfig.exe
1552	ipconfig.exe
5252	ipconfig.exe
3592	ipconfig.exe
4432	ipconfig.exe
3428	ipconfig.exe
6096	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274049872375570"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{6D9C68B6-A73D-4318-9E7C-9A830514FB35}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe
980	xrpkhczurpmhfzxu.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	i_zurpkhcauj.exe
Token: SeDebugPrivilege	4432	i_urmjebztrm.exe
Token: SeDebugPrivilege	5420	i_rojhbztrlj.exe
Token: SeDebugPrivilege	3720	i_jgeywtomge.exe
Token: SeDebugPrivilege	5172	i_aytqlidbvt.exe
Token: SeDebugPrivilege	720	i_vtnkigdyvq.exe
Token: SeDebugPrivilege	4664	i_sqnifaysqk.exe
Token: SeDebugPrivilege	204	i_spnkfdxvpn.exe
Token: SeDebugPrivilege	1360	i_mkeczxrpkh.exe
Token: SeDebugPrivilege	3396	i_omkebztrpj.exe
Token: SeDebugPrivilege	484	i_wtomgeywro.exe
Token: SeDebugPrivilege	3488	i_ljdbytqlig.exe
Token: SeDebugPrivilege	3896	i_lidbvtnlgd.exe
Token: SeDebugPrivilege	5756	i_vqnigayvqn.exe
Token: SeDebugPrivilege	696	i_kfcausnkfc.exe
Token: SeDebugPrivilege	4216	i_kfcausmkec.exe
Token: SeDebugPrivilege	3220	i_jhfzxukecz.exe
Token: SeDebugPrivilege	5364	i_jhczurmkec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 980	3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 3460 wrote to memory of 1972	3460	2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1972 wrote to memory of 3464	1972	iexplore.exe	90
PID 3464 wrote to memory of 5352	3464	msedge.exe	91
PID 3464 wrote to memory of 4636	3464	msedge.exe	93
PID 3464 wrote to memory of 2080	3464	msedge.exe	95
PID 3464 wrote to memory of 2080	3464	msedge.exe	95
PID 3464 wrote to memory of 6092	3464	msedge.exe	96
PID 3464 wrote to memory of 6092	3464	msedge.exe	96
PID 3464 wrote to memory of 6092	3464	msedge.exe	96
PID 3464 wrote to memory of 800	3464	msedge.exe	97
PID 3464 wrote to memory of 800	3464	msedge.exe	97
PID 3464 wrote to memory of 800	3464	msedge.exe	97
PID 3464 wrote to memory of 4608	3464	msedge.exe	94
PID 3464 wrote to memory of 4608	3464	msedge.exe	94
PID 3464 wrote to memory of 4608	3464	msedge.exe	94
PID 3464 wrote to memory of 5756	3464	msedge.exe	98
PID 3464 wrote to memory of 5580	3464	msedge.exe	99
PID 3464 wrote to memory of 5756	3464	msedge.exe	98
PID 3464 wrote to memory of 5756	3464	msedge.exe	98
PID 3464 wrote to memory of 5580	3464	msedge.exe	99
PID 3464 wrote to memory of 5580	3464	msedge.exe	99
PID 3464 wrote to memory of 708	3464	msedge.exe	100
PID 3464 wrote to memory of 708	3464	msedge.exe	100
PID 3464 wrote to memory of 708	3464	msedge.exe	100
PID 3464 wrote to memory of 4212	3464	msedge.exe	101
PID 3464 wrote to memory of 4212	3464	msedge.exe	101
PID 3464 wrote to memory of 4884	3464	msedge.exe	103
PID 3464 wrote to memory of 4884	3464	msedge.exe	103
PID 3464 wrote to memory of 4884	3464	msedge.exe	103
PID 980 wrote to memory of 1560	980	xrpkhczurpmhfzxu.exe	106
PID 3464 wrote to memory of 5456	3464	msedge.exe	107
PID 3464 wrote to memory of 2832	3464	msedge.exe	108
PID 3464 wrote to memory of 5456	3464	msedge.exe	107
PID 3464 wrote to memory of 2832	3464	msedge.exe	108
PID 4972 wrote to memory of 1600	4972	zurpkhcauj.exe	111
PID 3464 wrote to memory of 4836	3464	msedge.exe	115
PID 3464 wrote to memory of 5244	3464	msedge.exe	116
PID 3464 wrote to memory of 5244	3464	msedge.exe	116
PID 3464 wrote to memory of 3456	3464	msedge.exe	119
PID 3464 wrote to memory of 3456	3464	msedge.exe	119
PID 980 wrote to memory of 6108	980	xrpkhczurpmhfzxu.exe	120
PID 980 wrote to memory of 5612	980	xrpkhczurpmhfzxu.exe	124
PID 5192 wrote to memory of 2120	5192	urmjebztrm.exe	126
PID 980 wrote to memory of 3432	980	xrpkhczurpmhfzxu.exe	129
PID 980 wrote to memory of 3956	980	xrpkhczurpmhfzxu.exe	133
PID 5004 wrote to memory of 2276	5004	rojhbztrlj.exe	135
PID 980 wrote to memory of 1112	980	xrpkhczurpmhfzxu.exe	138
PID 980 wrote to memory of 5068	980	xrpkhczurpmhfzxu.exe	143
PID 5876 wrote to memory of 1152	5876	jgeywtomge.exe	145
PID 980 wrote to memory of 3540	980	xrpkhczurpmhfzxu.exe	148
PID 3464 wrote to memory of 2012	3464	msedge.exe	150
PID 3464 wrote to memory of 360	3464	msedge.exe	151
PID 3464 wrote to memory of 120	3464	msedge.exe	152
PID 980 wrote to memory of 5744	980	xrpkhczurpmhfzxu.exe	155
PID 3268 wrote to memory of 3104	3268	aytqlidbvt.exe	157
PID 980 wrote to memory of 1952	980	xrpkhczurpmhfzxu.exe	160
PID 980 wrote to memory of 6024	980	xrpkhczurpmhfzxu.exe	164
PID 5060 wrote to memory of 5580	5060	vtnkigdyvq.exe	166
PID 980 wrote to memory of 5964	980	xrpkhczurpmhfzxu.exe	169
PID 980 wrote to memory of 3172	980	xrpkhczurpmhfzxu.exe	173
PID 1412 wrote to memory of 5140	1412	sqnifaysqk.exe	175
PID 980 wrote to memory of 4112	980	xrpkhczurpmhfzxu.exe	178
PID 980 wrote to memory of 4288	980	xrpkhczurpmhfzxu.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_aa967e1f499c85dd232b290f96007e61_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Temp\xrpkhczurpmhfzxu.exe
  C:\Temp\xrpkhczurpmhfzxu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpkhcauj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1560
  - - C:\Temp\zurpkhcauj.exe
      C:\Temp\zurpkhcauj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpkhcauj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\i_zurpkhcauj.exe
      C:\Temp\i_zurpkhcauj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjebztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\urmjebztrm.exe
      C:\Temp\urmjebztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjebztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\i_urmjebztrm.exe
      C:\Temp\i_urmjebztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3956
  - - C:\Temp\rojhbztrlj.exe
      C:\Temp\rojhbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\i_rojhbztrlj.exe
      C:\Temp\i_rojhbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5068
  - - C:\Temp\jgeywtomge.exe
      C:\Temp\jgeywtomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3540
  - - C:\Temp\i_jgeywtomge.exe
      C:\Temp\i_jgeywtomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5744
  - - C:\Temp\aytqlidbvt.exe
      C:\Temp\aytqlidbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1952
  - - C:\Temp\i_aytqlidbvt.exe
      C:\Temp\i_aytqlidbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnkigdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\vtnkigdyvq.exe
      C:\Temp\vtnkigdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnkigdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5964
  - - C:\Temp\i_vtnkigdyvq.exe
      C:\Temp\i_vtnkigdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3172
  - - C:\Temp\sqnifaysqk.exe
      C:\Temp\sqnifaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4112
  - - C:\Temp\i_sqnifaysqk.exe
      C:\Temp\i_sqnifaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\spnkfdxvpn.exe
      C:\Temp\spnkfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Temp\i_spnkfdxvpn.exe
      C:\Temp\i_spnkfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:904
  - - C:\Temp\mkeczxrpkh.exe
      C:\Temp\mkeczxrpkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\i_mkeczxrpkh.exe
      C:\Temp\i_mkeczxrpkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjeczurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3544
  - - C:\Temp\mjeczurmke.exe
      C:\Temp\mjeczurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjeczurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2388
  - - C:\Temp\i_mjeczurmke.exe
      C:\Temp\i_mjeczurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omkebztrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\omkebztrpj.exe
      C:\Temp\omkebztrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omkebztrpj.exe ups_ins
    3⤵
    PID:6092
  - - C:\Temp\i_omkebztrpj.exe
      C:\Temp\i_omkebztrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgeywro.exe ups_run
    3⤵
    PID:2916
  - - C:\Temp\wtomgeywro.exe
      C:\Temp\wtomgeywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgeywro.exe ups_ins
    3⤵
    PID:2736
  - - C:\Temp\i_wtomgeywro.exe
      C:\Temp\i_wtomgeywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbytqlig.exe ups_run
    3⤵
    PID:2244
  - - C:\Temp\ljdbytqlig.exe
      C:\Temp\ljdbytqlig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbytqlig.exe ups_ins
    3⤵
    PID:3492
  - - C:\Temp\i_ljdbytqlig.exe
      C:\Temp\i_ljdbytqlig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidbvtnlgd.exe ups_run
    3⤵
    PID:5144
  - - C:\Temp\lidbvtnlgd.exe
      C:\Temp\lidbvtnlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlgd.exe ups_ins
    3⤵
    PID:4760
  - - C:\Temp\i_lidbvtnlgd.exe
      C:\Temp\i_lidbvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnigayvqn.exe ups_run
    3⤵
    PID:2816
  - - C:\Temp\vqnigayvqn.exe
      C:\Temp\vqnigayvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnigayvqn.exe ups_ins
    3⤵
    PID:4196
  - - C:\Temp\i_vqnigayvqn.exe
      C:\Temp\i_vqnigayvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcausnkfc.exe ups_run
    3⤵
    PID:2948
  - - C:\Temp\kfcausnkfc.exe
      C:\Temp\kfcausnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcausnkfc.exe ups_ins
    3⤵
    PID:2092
  - - C:\Temp\i_kfcausnkfc.exe
      C:\Temp\i_kfcausnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcausmkec.exe ups_run
    3⤵
    PID:4292
  - - C:\Temp\kfcausmkec.exe
      C:\Temp\kfcausmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcausmkec.exe ups_ins
    3⤵
    PID:3896
  - - C:\Temp\i_kfcausmkec.exe
      C:\Temp\i_kfcausmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfzxukecz.exe ups_run
    3⤵
    PID:5972
  - - C:\Temp\jhfzxukecz.exe
      C:\Temp\jhfzxukecz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfzxukecz.exe ups_ins
    3⤵
    PID:2720
  - - C:\Temp\i_jhfzxukecz.exe
      C:\Temp\i_jhfzxukecz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczurmkec.exe ups_run
    3⤵
    PID:5552
  - - C:\Temp\jhczurmkec.exe
      C:\Temp\jhczurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczurmkec.exe ups_ins
    3⤵
    PID:4528
  - - C:\Temp\i_jhczurmkec.exe
      C:\Temp\i_jhczurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztromj.exe ups_run
    3⤵
    PID:3120
  - - C:\Temp\pjhbztromj.exe
      C:\Temp\pjhbztromj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5252
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff17bec188,0x7fff17bec194,0x7fff17bec1a0
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,17814333798845696358,5486585536190841356,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:11
      4⤵
      System Time Discovery
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,9323102673814773521,18249607205352269384,262144 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:2
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,16214472146681344303,4284731598336148127,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,17088659030338100510,16846757846689859148,2097152 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15331081833122984414,8729924994446004216,2097152 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7845478416754472242,4949260875639258894,2097152 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,90971290804114205,6912787923967766221,2097152 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5300,i,4129001844938175035,17512184724433063611,2097152 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,15095168791513277384,15347697446683672054,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3760,i,11152927994439173730,1313722143112360924,2097152 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,6696024074431424238,982588994977246637,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,1253244164912721714,3890863533500548743,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11484850365473329129,5877060396047622325,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11484850365473329129,5877060396047622325,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16941208846395763729,17943504827989393733,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,14669502969608675468,2695703537964788396,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,14215216999069146870,9602227891125237420,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,15476419131723599235,6078106636834686854,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,9377461747422813300,16529520171496744601,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,16450607836975697867,10645006917975512169,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,16621536715501642326,3562178390887692611,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,6719100146464288389,6569282039763728481,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1340,i,3161471647545637548,9781592042955191916,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6980,i,10598179447919147230,281895594032157982,262144 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,14565885037058833575,10067848047948062041,524288 --field-trial-handle=2972,i,7282815218015654915,6111100267763904922,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5828

C:\Temp\xrpkhczurpmhfzxu.sys
C:\Temp\xrpkhczurpmhfzxu.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4704

C:\Temp\bzxrpjhecw.sys
C:\Temp\bzxrpjhecw.sys
1⤵
- Executes dropped EXE
PID:4916

C:\Temp\rmjebztrmj.sys
C:\Temp\rmjebztrmj.sys
1⤵
- Executes dropped EXE
PID:1784

C:\Temp\jebvtrljdb.sys
C:\Temp\jebvtrljdb.sys
1⤵
- Executes dropped EXE
PID:5140

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\gayvqnlgdy.sys
C:\Temp\gayvqnlgdy.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\avtnlfdxvp.sys
C:\Temp\avtnlfdxvp.sys
1⤵
- Executes dropped EXE
PID:4152

C:\Temp\spkicaxspn.sys
C:\Temp\spkicaxspn.sys
1⤵
- Executes dropped EXE
PID:856

C:\Temp\upmkecaxrp.sys
C:\Temp\upmkecaxrp.sys
1⤵
- Executes dropped EXE
PID:800

C:\Temp\usmkecxupm.sys
C:\Temp\usmkecxupm.sys
1⤵
- Executes dropped EXE
PID:6076

C:\Temp\trljdbwtrm.sys
C:\Temp\trljdbwtrm.sys
1⤵
PID:2876

C:\Temp\ljdbvtqoig.sys
C:\Temp\ljdbvtqoig.sys
1⤵
PID:4748

C:\Temp\trligdbvto.sys
C:\Temp\trligdbvto.sys
1⤵
PID:4928

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
PID:4904

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
PID:4464

C:\Temp\usnkfusnkf.sys
C:\Temp\usnkfusnkf.sys
1⤵
PID:5888

C:\Temp\mkecaurpnh.sys
C:\Temp\mkecaurpnh.sys
1⤵
PID:4872

C:\Temp\pjhbzurmje.sys
C:\Temp\pjhbzurmje.sys
1⤵
PID:2028

C:\Temp\jheywrojge.sys
C:\Temp\jheywrojge.sys
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqlidbvt.exe

Path C:\Temp\aytqlidbvt.exe
Size 365KB
SHA256 61c938258551ef29dde350c2c851dccaf6cf318cbd1001bbf709e23977780c2e
MD5 acb730bb80537426928e3d6b1f8d9626
SHA1 d19485cd309ee78ed1d367f2ad1685d31a727d56
SHA512 cb5206254600d9fbe9f1ba7c700291729a1d0deefd36a4daf48b797ef8740ef5392a17c3eaafd35b2b630c6c4975d1b206f3beee51471146e2c8c067ebb505ff
SSDEEP 3072:xuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzxrpjhecw.sys

Path C:\Temp\bzxrpjhecw.sys
Size 293KB
SHA256 3609b2b6634449d13ec8b495f51abdadf159609bd0576952f3290edcb41c5ee2
MD5 3b9e73f702573e5f6c9b0c072751cebc
SHA1 97712ff12d57b113ad8d827432fa0bdb2a8dde53
SHA512 b50720be3dabb27fb84a7a44d283bb2d0f66ab88e18653ab26a2ed79f36b51d62f9f198885f44a50ca1e32ef88790b23ee6278e5dc3b035ed2ab453bc001843a
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdyw.sys

Path C:\Temp\dbvtnlgdyw.sys
Size 293KB
SHA256 472fb97592bdc0912ea74fa65483c042b6519fa8cc53d41a6cab941b73ac41d1
MD5 7cf9c8a451d974ad51a659c04f69b1df
SHA1 bfcff755b433960613090cbaf70285f5cb085a73
SHA512 758c01520bda4143d0c9f9b76a7c088240b32114fbdec0212be71a174965ba950855d2d485892670472c7d447435c28cac969f83046800484232a32126433ad4
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqnlgdy.sys

Path C:\Temp\gayvqnlgdy.sys
Size 293KB
SHA256 a47dd553f72bc8ba6d941fcce440f110e92dfe180eb8a038d3242ae9a12f4e9b
MD5 3ef095eb62ddca9f1fabe678225d1244
SHA1 d647df6892e0f532f4d071e69c98e7b7dc3fe312
SHA512 6361a7a72d13f1bef572c68ccb53d4344c784f7826a4470bd08c9330c6e6b75f8b8153715381541cdb243a11d3326bd20355bcd63a8a76c7c203b33f8ba4f8dc
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqlidbvt.exe

Path C:\Temp\i_aytqlidbvt.exe
Size 365KB
SHA256 7f4bdf9b81005c6d2ae5b9d8dd80147bdab38fa71d3e34d6432facb41b5e12ae
MD5 d662bbef1fd94a84bdc2e344835358fe
SHA1 d79cf68a3ff8a745a316b0edb1153a02904e6aaf
SHA512 a5d338326fc73a8ca6c0d792848a23165f48b72dc7b2e3182e8fd7fa36b24216ea89b3c1f813fa7ac3e6375e695d04e647ba22bfefde3820d2244047c74b58f7
SSDEEP 3072:SuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeywtomge.exe

Path C:\Temp\i_jgeywtomge.exe
Size 365KB
SHA256 db95ea3a6999f9b6a0f9e69b3adbfce3e41e0d78025671fb50cbc55699be6d3d
MD5 e4102729dcaad9a4b111c518168de1f2
SHA1 1ff3ef001f1c7db3902844228f847e1d930d3349
SHA512 d564427394997391b6fa7acee4defe78903de149c15ade18e5fe4d5e511fee685e89de895908724e913390155de1c3c71a7543ed96e3e009d082f76c1e2208ae
SSDEEP 3072:3uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrlj.exe

Path C:\Temp\i_rojhbztrlj.exe
Size 365KB
SHA256 a1f62b60bb2f746c18e3e31744430552490d799b01b0e890e6cc0d7908cd0113
MD5 40fa40dad57923627153b2f7c00fba51
SHA1 7d94e11557dd971c259685d91f2df19e9380330c
SHA512 a13154f9dfe1e9f80aae1361b5bb8862c379c3b2ecd7d47766d2ef4fa80db2d35a78ecc16da19f690d7eb6ab682585e18cbd3898a6c3200dd256f88e9ae9b343
SSDEEP 3072:IuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmjebztrm.exe

Path C:\Temp\i_urmjebztrm.exe
Size 365KB
SHA256 382afa44adc2428a892e6fff024bb60438a2baa42dabbd4618c6fe7a2ee18d84
MD5 d1f4c7c57634982e1f2b16945039fc19
SHA1 cf1181a9345a64fb46b09f3ac27a105094037b8e
SHA512 a3c0cfdea0a3f644c8789c4c7e33853667267b1d845317e17548616add8c531793b521fd333fdf2e94ba1276e8a809e12fda57aea8164fdf556c0b4a546032b2
SSDEEP 3072:BuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurpkhcauj.exe

Path C:\Temp\i_zurpkhcauj.exe
Size 365KB
SHA256 45c9311aaf0574ba6e9bf284f874d78965fa9a49cb65bbd0fb23056b63513291
MD5 7d117f3d8eb057a356b58ea0eb3fe403
SHA1 37e3e2cd3f193e98983c80b48044a2ec448a97ca
SHA512 cf6b7f5d4a57be9cdea25bf13b5fb5b8f97a6d25f70712e46eff163397d34892263a178a9d56189a92d02b9316c2840aa78c3e9c966928b75fa051e3900561a3
SSDEEP 3072:AuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebvtrljdb.sys

Path C:\Temp\jebvtrljdb.sys
Size 293KB
SHA256 26c1016070cf4e7cfe00627c74ef7835a75b9b003629eca90641ff4060cef257
MD5 6955148051b542f152c8f7165149d7a3
SHA1 bad1452b11878f4328a26eb4eef0047244ce2680
SHA512 4f555202365ced1a4b4c95e373d98b50f2fa53dec3da3b3f5d3e6b6b4236c447171ddd6c508934699ffd4e59ca5c544202db34d2ea1241517bfb9233a5800b36
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywtomge.exe

Path C:\Temp\jgeywtomge.exe
Size 365KB
SHA256 1c744e388850b8aa48b0524a393ed5e1e762cee0df5f104d85cf5146f2cdfd9b
MD5 7001f48c4cca1fbce6ad49b09aacf7de
SHA1 22ce8c94a500bf1a9a92e8105f1e983a0f644c28
SHA512 0f24d548a7c415b288c25fdab2cfa6160fc751b006450a806139da43147ff6425d89594a19c011eb5e7b75727daf2c9e244a463a565ac9dea2d69c6fba13c455
SSDEEP 3072:guxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:guxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebztrmj.sys

Path C:\Temp\rmjebztrmj.sys
Size 293KB
SHA256 43fc4b1ea446ce857325a6488b07879f941b504e989de85a0438ae97670d99a1
MD5 500836c5cf5e1dba20bc5845e0916e0f
SHA1 7c106cf0b649ee910cecd6bcbe2f4e156bfa0f02
SHA512 34e91b64e136f9ecf48e5e4c0e14443f0b8c966d28c49de8ea264255f9243b4386afa610320243d5bb0c4a962343171c47c32cdf013d0ada8fa96ac3f749849a
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrlj.exe

Path C:\Temp\rojhbztrlj.exe
Size 365KB
SHA256 159495c1613301bc5bda3cbec5a3f34a62b7eeac9fbe7df49935be6c8cb0af56
MD5 fa44416f07155844362012c2ef545197
SHA1 7ffc8e11339c9bb035f7e24a74e2614231d2d7e6
SHA512 d3ec5924289770e18f01bea22dca3ac4d15503b90541c83d4382354aaaa52cfb527d46a01e9609559a73e9d89d274575f856cb247fe4e430af5a8bd43257be20
SSDEEP 3072:/uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjebztrm.exe

Path C:\Temp\urmjebztrm.exe
Size 365KB
SHA256 ba3f7c119854be6ce3aca9676af4e93a8684e87afbafd6323d3c22ff7c63d489
MD5 745a3f1781d6213c21a4c462e626e923
SHA1 7b22d34cc00243662ad5620d1c6a2e5bf74528ad
SHA512 eb692541c67f57ce0b70b35a8d85deecbe4abd8e718e17d8656ecb827a7941dafca172e26dfc318f99b95456dca5b8b5b92899ddb2544c4ccc2f0611f1a73b0d
SSDEEP 3072:IuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnkigdyvq.exe

Path C:\Temp\vtnkigdyvq.exe
Size 365KB
SHA256 076168468d23ef3136e5198f150a607dc04f13c269a8fdd89b4f717866578ebf
MD5 534db8ec1c0319f1f059965783773121
SHA1 ba9b52da083edfcd5856a116123542798fad3ef1
SHA512 6eda7ce23b1d0fdc7019357da271470ff09dcd00f5d19086f3061068b578399d344368e4a88cc06736040e5b431b264ac113c1a7e01d2c6b8f8020ddacfdb202
SSDEEP 3072:suxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhczurpmhfzxu.exe

Path C:\Temp\xrpkhczurpmhfzxu.exe
Size 365KB
SHA256 ed5b889c3375cefda3cd77d51b542bf50df7b7210737763114d1597764875812
MD5 7bb87b0f813ea34b2b4e4dd1c5c93592
SHA1 cc3b17f9aee5dd335f43468fddb3072929819b77
SHA512 f0884ebc7ddc995316a44c2691eb65b314b2a51b10faf85e894a7360ae4dc3d16462b67af932e195cb41bce19d314da8fc0ea9b443eb85e4fdd3f1f7b76e5ebe
SSDEEP 3072:DuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhczurpmhfzxu.sys

Path C:\Temp\xrpkhczurpmhfzxu.sys
Size 293KB
SHA256 c1d7a564faeab3babeb5109f225ea1e6b1214a6d472d03b5b98d354d1dd5409c
MD5 48ccd7ee9d0c62313eaddf1ea7695225
SHA1 56b0bf391fe3f34d2577c3d77d0b2ae1a338fb78
SHA512 d9abc1446477de980d4a6239cb8ab40c2cc48790b4edb28fa72f21ea686c2576da61d9615c5822ff82f4d29056b2b98e998e0e79248ec8bf45d32dfb1a80f095
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpkhcauj.exe

Path C:\Temp\zurpkhcauj.exe
Size 365KB
SHA256 b8818b9e3189b80bc3d7f1cdc723a40e62ccc9db9bd70347a094815fb398ae91
MD5 ecc41b58a893d9836603fb2da1c78a75
SHA1 5d16fdb0392d28e6013c3b6ca0ea0ff9a7f5bc70
SHA512 7fc3f56f0dc15665dd99f2856d8fdf6982f6ed263e4738c6e414187bf102c6f3952ee82b09dfc31a1a78b50265dfddb9014f9ef939c9fa60a1dba83e66074ffd
SSDEEP 3072:MuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0dd92d7bec58bfc038975f69c418a48fe11ea00e3c05c165d727ad20855dd27a
MD5 a230d31596ca855cc3afdbf9ac6696ff
SHA1 1184b0fe26ce64c077644d8a2d7d4210b0134ed6
SHA512 14107d844746c48b441a744885c9bd99d2341944baeb4a35c1e43d8cc1dec66eb2db6278fd343d3f44e3ced1732e7a40782d6b0a4132b1c0e88347f05d425018
TLSH
T1A46182513BB709D2C7DD5876ADF3188ABF70F0D1A3032E1721C9A838B48B75468217C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595ccc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595ccc.TMP
Size 3KB
SHA256 94aa606cc56754c7db41b5794d3aa98b53193adb8987bee5b89d4b3bbef456c7
MD5 2faf432eb2f0d96362a680bb83140b31
SHA1 6f5c0d08e37221ab7d7893a69be3265f5e75868a
SHA512 1d5e5a7e9a9797b77ecebc206516951455db5e4f51608318a3962614de5a928611c9acdb8a722b6472790961e2a69056b33ce1fcf394e0453c1f16b616e43dda
TLSH
T1C56182523BB709D2C7DD5876ADF3188ABF70F0D1A3072E1720C9A838B48B715A8617C2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ba4bc26c1f6a2930269f24606a78dcc854276a4f9b6675bdcf7075e815da1e16
MD5 c4ddae12f98b7fb0a6adc1c514faa35f
SHA1 e9fe70b1ecf051cff6f94335f5d6b2ba67119e57
SHA512 c461b8346c37b9a6cd9e7274cf6dd3370ab5b49dd853864af02bf7d70a2f2cac953775df39f9b09baeabc70216b97255830058c0997de0cc362eeee1b802623a
TLSH
T19351BFF7C3E4866DC90186F4BA187E1BCE1D0915832C7D5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 525739d10ec9eee1c91439147e559927ddb182a8fd0002f70e5dea3b5ab4a42f
MD5 bc2df4ddd83dc86b46248e2a9bad30f2
SHA1 eab96656d780b1b8b00dfcace6f8b8e7e7b7c393
SHA512 42105fc7ee810c326b19bd255fd906b92fbc905bf7c161c05d9c2e23f0ca402f2f3a4e21da77b5022432d8bb554054cfda21be6899db907da1de376d7b9250ed
SSDEEP 192:sxR1RIyM/jK1Ml8wcp/fw5sYySPmaZ1QBnzoA8p9k/g6+WNCj5/YTvVZ+GJIgD+J:sxR1SCp/fqsYBPmM2oK/50/UZzO
TLSH
T11D62E906AA3459778CDBD21DFA41BB53D2F81573A2941E44AAFC8A0C05E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 468416a9b38defeb12251b6679184c289c24139dfec76ffabffa3c18f37a16ee
MD5 b802f3bb2656175469804af39db20a11
SHA1 6ef3e38cd9c81c7edbd80341fe30b4ac18ebe910
SHA512 87d97bf15201e003bd011f132d8702409d4c74d817d32a981cb1e45444939d1c5e10c35806299aeff86f187f5742f7f94ed32057ac1ad5557ec00301eeb99ae3
SSDEEP 192:sxRiRIyM/jK1Ml8wcp/fw5ssySPmaZ1QBnzoA8p9k/g6+WNCj5/YTvVZ+GJIgtJ:sxRiSCp/fqssBPmM2oK/50/UZz3
TLSH
T14A62E9066A245977CCDBD20DFA55BB53D2F81533A2541E44EAFC8A0C05E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2689e21f2923265906359ea829c6a8931345e88aa817349ca30c59320c82ad46
MD5 f1b9f66b1c67343a34d7c4f86e3f5edc
SHA1 a126745c08e9c73e893b445581898c68713e9a34
SHA512 2fdb81bc1e4116a681bd33ea149c7d6546b92754918e3608eb885e68afdf595fd7efe58f277fd610e54535ab09316498533bfc7ac19a2193eb7be4b93bb0a80c
SSDEEP 192:sxR1RIyM/jK1Ml8UQzcp/fw5sYyWPmaZ1QBnzoA8prk/g6+WNCj5/YTPVZ+GJIgo:sxR1SqYp/fqsYFPmM2o4/50/SZzo
TLSH
T18362E916AA245977CCDBD21DFA41BB53D2F81573A2941E44AAFCCA0C05E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 196124840df8729e569e3669cdb6209b81f458adfc9d4ed2b68a322a7f613990
MD5 3821c7f4b0729df7af24080c7f1ccfb9
SHA1 5fb9a6f9b45afbc85bf66693f25d1ba74175e7ce
SHA512 7f22cf38a83a49ab66340b9df084cdc34a2931bd8e873e9b30e7894849b02b24bf1b5bc6b7646f20ca21565e5f385bfdc655b9316d02b004079cbabfe859b304
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVs+DzFYEro38T:RGqOBfE7CrWgTvfiXu1jaX+DRYP3g
TLSH
T1DFE2EC7B680CCB7E4F8049ACEC25BD8E6DE801CB56988D5447EA494C03C67FB51165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f850.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f850.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 052ad54e0d9d43f498a4181a48266102bc802d71da06d83cfa31206b7a64e7e7
MD5 5e212e167c8d86e256f74ae6a4c6b094
SHA1 5454fbfa86fcc5cfee723caaabc1223003598c42
SHA512 a70972f3146b6739f6fb94d46f85f14bc2d29488fe76e9c4df009872dccc67a3a25a3a0c16ccc1513c8ec80f584dbcf45bb4204e81e090366f30d936aed7601f
SSDEEP 768:Yrv+4UNbdj3H6sRXXodOiIyN8Y1M1fmBnlRv0B:Ybsbl3H1XodI11+8
TLSH
T11003CF32E86495778CF28288F55772433FF491A78BC50B94DADC6B0E4147AFE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b437be8a6cba09d5e61ad88a452fc7b8fc81b8f5625da8e8d663d0dbdcb95aec
MD5 b408be456f3309aa5e26c6a540ca4e25
SHA1 ac138134214fc06bd66d1731394f1ad1e4480dd0
SHA512 e1451c506211e2cb0c5aafe74690af4e5ff9383fd3c6db2dfd16b4d322f70485d1176750ecdb5bb8e547ed4968bb1af51b8345181576512d5fbc774e10b74233
SSDEEP 768:5j+9+3x26v8oZXodOiIyN8Y1M1fmBnZnc8KzsF:k9+3x2iXodI11MctzsF
TLSH
T1E0F2BF319C62CE634CE6928CF6273B866EF452B396852F48E5EC5B0E05437BD630BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 760403ac4b1d79b055191e09a36bc4be1dc34a9708cabc257bbc67149f23e6f6
MD5 6c13f5fe9935b316ffae356990986e9e
SHA1 111a86a9a55234bb5e16e9e469c32e3d2b3881ab
SHA512 84ffc9619f4e3a0e56324b4a72bfa131ecd71c6fa371c181b522d3688e47c0c6e44986d404a29ba17f732e1b06d3cc6844d9d3952085ee88eb5daceeb198995c
SSDEEP 768:mF1j+9F3uwgV26cFW8XodOiIyN8Y1M1fmBnZnc8KzsF:T9F3O2bXodI11MctzsF
TLSH
T1881328F588D38937D8AE4387A73E6E469DFCC163B5885984B7D85D0DCC822BFD206845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

05156e8d-8b44-4f34-afd8-59a988ab6bc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05156e8d-8b44-4f34-afd8-59a988ab6bc7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3464_977769639\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 58ffd847c9565e1ef9dfd3179f875f36b4da73b81207dca46ed3d0287a369f45
MD5 191afc288f3c4a8e4c0eb501c4e30154
SHA1 b49afeac340500563deefd2bef6505fe314c1da6
SHA512 748e874daed45109503879e2ef84371edad3069ee538d8045f4ddda50baf87feb707aa8995380afde1b629b50a5f283f559adf4939695b23853d92c25676630e
TLSH
T11071008357BDC9B2C2DA5BF002835248F1BB23780B3330614B525686AA30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/856-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1784-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2028-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2680-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2872-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4152-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4440-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4464-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4872-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4916-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4928-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download