systex | cc8df6d9f3df5e6e3032fa44221822e7a8abecbabd545fa7f46a5c5fdf016366

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260707-bxh2daft2z
SHA256 cc8df6d9f3df5e6e3032fa44221822e7a8abecbabd545fa7f46a5c5fdf016366
MD5 b1584c96f6e16e3d3f4b6019c1b30ba1
SHA1 9410a20e517a6364e1d70b7318acb6bead4a2bf0
SHA512 8526a84112e5b527fb8c02e26b8caec3b1ffb0daac8f8a215c517726b460db0f5510acf36f6e9f0f7dda9726020e291f62136c7e534c5a3454b84329a4fee5fe
SSDEEP 3072:UtgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:UtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1300	ljdbwtomgeywqojg.exe
6036	ljdbwtomgeywqojg.sys
6048	CreateProcess.exe
5984	ljdbwtrlje.exe
5428	CreateProcess.exe
5372	CreateProcess.exe
752	i_ljdbwtrlje.exe
2024	tnlgdbvtol.sys
2792	CreateProcess.exe
3672	lidbvtnlfd.exe
5912	CreateProcess.exe
572	CreateProcess.exe
3900	i_lidbvtnlfd.exe
5216	nlxvqnifdx.sys
5920	CreateProcess.exe
5492	davsnifays.exe
5276	CreateProcess.exe
4740	CreateProcess.exe
3316	i_davsnifays.exe
796	vsnlfdxvpn.sys
3076	CreateProcess.exe
1888	kifayspkic.exe
2584	CreateProcess.exe
4052	CreateProcess.exe
4444	i_kifayspkic.exe
2900	qkhfaxspkh.sys
1852	CreateProcess.exe
1860	pkhfzxvpnk.exe
4188	CreateProcess.exe
1156	CreateProcess.exe
3668	i_pkhfzxvpnk.exe
2500	pmkecausmk.sys
3248	CreateProcess.exe
5560	pnhfzxrpjh.exe
4384	CreateProcess.exe
1404	CreateProcess.exe
1312	i_pnhfzxrpjh.exe
4460	pmkeurmkec.sys
3192	CreateProcess.exe
4500	jhezxrpjhc.exe
4992	CreateProcess.exe
4600	CreateProcess.exe
1752	i_jhezxrpjhc.exe
2412	mgeczxrpjh.sys
1592	CreateProcess.exe
2808	mjhezwujeb.exe
3312	CreateProcess.exe
5320	CreateProcess.exe
2388	i_mjhezwujeb.exe
2920	uomgeywqoj.sys
5236	CreateProcess.exe
5712	ojgeywtomg.exe
2972	CreateProcess.exe
4088	CreateProcess.exe
712	i_ojgeywtomg.exe
2896	bywqoigdbv.sys
856	CreateProcess.exe
1232	eywqnljgby.exe
2812	CreateProcess.exe
1064	CreateProcess.exe
3336	i_eywqnljgby.exe
776	igaytqljdb.sys
4456	CreateProcess.exe
1968	yvqoigaysq.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_665974857\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_1391023355\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_579545168\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_665974857\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_665974857\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_665974857\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_1241423684\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_1391023355\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4020_579545168\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhezwujeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgeywtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqnljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgeywtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifayspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tojgdywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqnljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifayspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhezwujeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tojgdywqol.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5128	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2116	ipconfig.exe
3120	ipconfig.exe
2908	ipconfig.exe
4888	ipconfig.exe
6072	ipconfig.exe
3916	ipconfig.exe
696	ipconfig.exe
3552	ipconfig.exe
3964	ipconfig.exe
2024	ipconfig.exe
5308	ipconfig.exe
1776	ipconfig.exe
3380	ipconfig.exe
1752	ipconfig.exe
712	ipconfig.exe
4920	ipconfig.exe
5772	ipconfig.exe
3988	ipconfig.exe
1776	ipconfig.exe
1280	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{B3B4FAF1-4C65-4371-B879-BED352DF0C0F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe
1300	ljdbwtomgeywqojg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	i_ljdbwtrlje.exe
Token: SeDebugPrivilege	3900	i_lidbvtnlfd.exe
Token: SeDebugPrivilege	3316	i_davsnifays.exe
Token: SeDebugPrivilege	4444	i_kifayspkic.exe
Token: SeDebugPrivilege	3668	i_pkhfzxvpnk.exe
Token: SeDebugPrivilege	1312	i_pnhfzxrpjh.exe
Token: SeDebugPrivilege	1752	i_jhezxrpjhc.exe
Token: SeDebugPrivilege	2388	i_mjhezwujeb.exe
Token: SeDebugPrivilege	712	i_ojgeywtomg.exe
Token: SeDebugPrivilege	3336	i_eywqnljgby.exe
Token: SeDebugPrivilege	2900	i_yvqoigaysq.exe
Token: SeDebugPrivilege	2896	i_fdayvqniga.exe
Token: SeDebugPrivilege	796	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	2872	i_pmkhfzxupn.exe
Token: SeDebugPrivilege	3992	i_jhezxrpjhb.exe
Token: SeDebugPrivilege	3764	i_wuomgecwur.exe
Token: SeDebugPrivilege	1328	i_omjebzwroj.exe
Token: SeDebugPrivilege	1360	i_tojgdywqol.exe
Token: SeDebugPrivilege	5484	i_vtnlfdbywq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1300	5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 5016 wrote to memory of 5708	5016	2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 5708 wrote to memory of 4020	5708	iexplore.exe	89
PID 4020 wrote to memory of 264	4020	msedge.exe	90
PID 4020 wrote to memory of 5584	4020	msedge.exe	92
PID 4020 wrote to memory of 5128	4020	msedge.exe	93
PID 4020 wrote to memory of 5584	4020	msedge.exe	92
PID 4020 wrote to memory of 5584	4020	msedge.exe	92
PID 4020 wrote to memory of 4072	4020	msedge.exe	94
PID 4020 wrote to memory of 4072	4020	msedge.exe	94
PID 4020 wrote to memory of 4912	4020	msedge.exe	95
PID 4020 wrote to memory of 4912	4020	msedge.exe	95
PID 4020 wrote to memory of 4056	4020	msedge.exe	96
PID 4020 wrote to memory of 4912	4020	msedge.exe	95
PID 4020 wrote to memory of 4056	4020	msedge.exe	96
PID 4020 wrote to memory of 4056	4020	msedge.exe	96
PID 4020 wrote to memory of 1420	4020	msedge.exe	97
PID 4020 wrote to memory of 2972	4020	msedge.exe	98
PID 4020 wrote to memory of 1420	4020	msedge.exe	97
PID 4020 wrote to memory of 1420	4020	msedge.exe	97
PID 4020 wrote to memory of 2972	4020	msedge.exe	98
PID 4020 wrote to memory of 2972	4020	msedge.exe	98
PID 4020 wrote to memory of 2412	4020	msedge.exe	99
PID 4020 wrote to memory of 2412	4020	msedge.exe	99
PID 4020 wrote to memory of 2412	4020	msedge.exe	99
PID 4020 wrote to memory of 6140	4020	msedge.exe	101
PID 4020 wrote to memory of 6140	4020	msedge.exe	101
PID 4020 wrote to memory of 3676	4020	msedge.exe	103
PID 4020 wrote to memory of 3676	4020	msedge.exe	103
PID 4020 wrote to memory of 3676	4020	msedge.exe	103
PID 1300 wrote to memory of 6048	1300	ljdbwtomgeywqojg.exe	105
PID 4020 wrote to memory of 2424	4020	msedge.exe	108
PID 4020 wrote to memory of 4944	4020	msedge.exe	109
PID 4020 wrote to memory of 2424	4020	msedge.exe	108
PID 4020 wrote to memory of 4944	4020	msedge.exe	109
PID 5984 wrote to memory of 5428	5984	ljdbwtrlje.exe	110
PID 4020 wrote to memory of 4792	4020	msedge.exe	114
PID 4020 wrote to memory of 1288	4020	msedge.exe	115
PID 4020 wrote to memory of 1288	4020	msedge.exe	115
PID 4020 wrote to memory of 6004	4020	msedge.exe	118
PID 4020 wrote to memory of 6004	4020	msedge.exe	118
PID 1300 wrote to memory of 5372	1300	ljdbwtomgeywqojg.exe	119
PID 1300 wrote to memory of 2792	1300	ljdbwtomgeywqojg.exe	123
PID 3672 wrote to memory of 5912	3672	lidbvtnlfd.exe	125
PID 1300 wrote to memory of 572	1300	ljdbwtomgeywqojg.exe	128
PID 4020 wrote to memory of 3480	4020	msedge.exe	130
PID 4020 wrote to memory of 3480	4020	msedge.exe	130
PID 4020 wrote to memory of 3480	4020	msedge.exe	130
PID 1300 wrote to memory of 5920	1300	ljdbwtomgeywqojg.exe	133
PID 5492 wrote to memory of 5276	5492	davsnifays.exe	135
PID 1300 wrote to memory of 4740	1300	ljdbwtomgeywqojg.exe	138
PID 1300 wrote to memory of 3076	1300	ljdbwtomgeywqojg.exe	142
PID 1888 wrote to memory of 2584	1888	kifayspkic.exe	144
PID 1300 wrote to memory of 4052	1300	ljdbwtomgeywqojg.exe	147
PID 4020 wrote to memory of 4272	4020	msedge.exe	149
PID 4020 wrote to memory of 1004	4020	msedge.exe	150
PID 4020 wrote to memory of 4092	4020	msedge.exe	151
PID 1300 wrote to memory of 1852	1300	ljdbwtomgeywqojg.exe	154
PID 1860 wrote to memory of 4188	1860	pkhfzxvpnk.exe	156
PID 1300 wrote to memory of 1156	1300	ljdbwtomgeywqojg.exe	159
PID 1300 wrote to memory of 3248	1300	ljdbwtomgeywqojg.exe	163
PID 5560 wrote to memory of 4384	5560	pnhfzxrpjh.exe	165
PID 1300 wrote to memory of 1404	1300	ljdbwtomgeywqojg.exe	168
PID 1300 wrote to memory of 3192	1300	ljdbwtomgeywqojg.exe	172

C:\Users\Admin\AppData\Local\Temp\2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b1584c96f6e16e3d3f4b6019c1b30ba1_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Temp\ljdbwtomgeywqojg.exe
  C:\Temp\ljdbwtomgeywqojg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6048
  - - C:\Temp\ljdbwtrlje.exe
      C:\Temp\ljdbwtrlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5372
  - - C:\Temp\i_ljdbwtrlje.exe
      C:\Temp\i_ljdbwtrlje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2792
  - - C:\Temp\lidbvtnlfd.exe
      C:\Temp\lidbvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:572
  - - C:\Temp\i_lidbvtnlfd.exe
      C:\Temp\i_lidbvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5920
  - - C:\Temp\davsnifays.exe
      C:\Temp\davsnifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4740
  - - C:\Temp\i_davsnifays.exe
      C:\Temp\i_davsnifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifayspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3076
  - - C:\Temp\kifayspkic.exe
      C:\Temp\kifayspkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifayspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4052
  - - C:\Temp\i_kifayspkic.exe
      C:\Temp\i_kifayspkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxvpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1852
  - - C:\Temp\pkhfzxvpnk.exe
      C:\Temp\pkhfzxvpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxvpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1156
  - - C:\Temp\i_pkhfzxvpnk.exe
      C:\Temp\i_pkhfzxvpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\pnhfzxrpjh.exe
      C:\Temp\pnhfzxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1404
  - - C:\Temp\i_pnhfzxrpjh.exe
      C:\Temp\i_pnhfzxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3192
  - - C:\Temp\jhezxrpjhc.exe
      C:\Temp\jhezxrpjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4600
  - - C:\Temp\i_jhezxrpjhc.exe
      C:\Temp\i_jhezxrpjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhezwujeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1592
  - - C:\Temp\mjhezwujeb.exe
      C:\Temp\mjhezwujeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhezwujeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5320
  - - C:\Temp\i_mjhezwujeb.exe
      C:\Temp\i_mjhezwujeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgeywtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5236
  - - C:\Temp\ojgeywtomg.exe
      C:\Temp\ojgeywtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgeywtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Temp\i_ojgeywtomg.exe
      C:\Temp\i_ojgeywtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqnljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:856
  - - C:\Temp\eywqnljgby.exe
      C:\Temp\eywqnljgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqnljgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1064
  - - C:\Temp\i_eywqnljgby.exe
      C:\Temp\i_eywqnljgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Temp\yvqoigaysq.exe
      C:\Temp\yvqoigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    PID:2128
  - - C:\Temp\i_yvqoigaysq.exe
      C:\Temp\i_yvqoigaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdayvqniga.exe ups_run
    3⤵
    PID:2116
  - - C:\Temp\fdayvqniga.exe
      C:\Temp\fdayvqniga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdayvqniga.exe ups_ins
    3⤵
    PID:5628
  - - C:\Temp\i_fdayvqniga.exe
      C:\Temp\i_fdayvqniga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    PID:5996
  - - C:\Temp\xvpnhfaxsp.exe
      C:\Temp\xvpnhfaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    PID:2072
  - - C:\Temp\i_xvpnhfaxsp.exe
      C:\Temp\i_xvpnhfaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkhfzxupn.exe ups_run
    3⤵
    PID:5292
  - - C:\Temp\pmkhfzxupn.exe
      C:\Temp\pmkhfzxupn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkhfzxupn.exe ups_ins
    3⤵
    PID:4792
  - - C:\Temp\i_pmkhfzxupn.exe
      C:\Temp\i_pmkhfzxupn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezxrpjhb.exe ups_run
    3⤵
    PID:5216
  - - C:\Temp\jhezxrpjhb.exe
      C:\Temp\jhezxrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezxrpjhb.exe ups_ins
    3⤵
    PID:1856
  - - C:\Temp\i_jhezxrpjhb.exe
      C:\Temp\i_jhezxrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgecwur.exe ups_run
    3⤵
    PID:4788
  - - C:\Temp\wuomgecwur.exe
      C:\Temp\wuomgecwur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgecwur.exe ups_ins
    3⤵
    PID:4944
  - - C:\Temp\i_wuomgecwur.exe
      C:\Temp\i_wuomgecwur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebzwroj.exe ups_run
    3⤵
    PID:1364
  - - C:\Temp\omjebzwroj.exe
      C:\Temp\omjebzwroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebzwroj.exe ups_ins
    3⤵
    PID:6084
  - - C:\Temp\i_omjebzwroj.exe
      C:\Temp\i_omjebzwroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tojgdywqol.exe ups_run
    3⤵
    PID:5296
  - - C:\Temp\tojgdywqol.exe
      C:\Temp\tojgdywqol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tojgdywqol.exe ups_ins
    3⤵
    PID:4876
  - - C:\Temp\i_tojgdywqol.exe
      C:\Temp\i_tojgdywqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdbywq.exe ups_run
    3⤵
    PID:2344
  - - C:\Temp\vtnlfdbywq.exe
      C:\Temp\vtnlfdbywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdbywq.exe ups_ins
    3⤵
    PID:752
  - - C:\Temp\i_vtnlfdbywq.exe
      C:\Temp\i_vtnlfdbywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run
    3⤵
    PID:5400
  - - C:\Temp\dyvqoigays.exe
      C:\Temp\dyvqoigays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9e174c188,0x7ff9e174c194,0x7ff9e174c1a0
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,9331711264148050799,1379880943994314492,262144 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,16383848105433701790,17197773010706637555,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:11
      4⤵
      System Time Discovery
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,3258457138890022128,3507629749962840639,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,11615362559885280109,3977280163964612026,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,4730326099021132495,3567369666593510124,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,10454696917994599902,4428774322045311998,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,4627309450148647208,9184454360118744006,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:9
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5304,i,8835424667495123564,4503495568987358246,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,15969980520649558295,14250952566504856244,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5324,i,11331305123460344713,8053985885750266459,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,11135602580034841669,15305795635253192512,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,4930681142579604613,18008732719395713231,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1259757154069903484,17410155662798894409,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1259757154069903484,17410155662798894409,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,12392618080646768982,9758622100095909798,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,9160088312842332861,14522829516645432928,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6156,i,12279781599063874607,6685601502358573676,2097152 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2097144131857780761,11530954581142826979,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:14
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,1708979730531949881,4152063790436381457,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,15331366891535336296,5174318954632060551,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,13898447225725687420,14805132067733150376,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,13659139643612599227,16069613589621563134,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,11413557130929516378,5695703532132948844,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12038396786476348538,955535691603778632,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4224,i,4608723337905912088,824683492213662185,262144 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:10
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,619155105825858369,1430841554249223235,524288 --field-trial-handle=2624,i,14654354993457398394,15549375964479854583,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14
      4⤵
      PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1064

C:\Temp\ljdbwtomgeywqojg.sys
C:\Temp\ljdbwtomgeywqojg.sys
1⤵
- Executes dropped EXE
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3772

C:\Temp\tnlgdbvtol.sys
C:\Temp\tnlgdbvtol.sys
1⤵
- Executes dropped EXE
PID:2024

C:\Temp\nlxvqnifdx.sys
C:\Temp\nlxvqnifdx.sys
1⤵
- Executes dropped EXE
PID:5216

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:796

C:\Temp\qkhfaxspkh.sys
C:\Temp\qkhfaxspkh.sys
1⤵
- Executes dropped EXE
PID:2900

C:\Temp\pmkecausmk.sys
C:\Temp\pmkecausmk.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\pmkeurmkec.sys
C:\Temp\pmkeurmkec.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\mgeczxrpjh.sys
C:\Temp\mgeczxrpjh.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\uomgeywqoj.sys
C:\Temp\uomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:2920

C:\Temp\bywqoigdbv.sys
C:\Temp\bywqoigdbv.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
- Executes dropped EXE
PID:776

C:\Temp\gdyvqoifdx.sys
C:\Temp\gdyvqoifdx.sys
1⤵
PID:5284

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:1060

C:\Temp\smkifzxspk.sys
C:\Temp\smkifzxspk.sys
1⤵
PID:3272

C:\Temp\smkhfzxusm.sys
C:\Temp\smkhfzxusm.sys
1⤵
PID:708

C:\Temp\rpmhezwrom.sys
C:\Temp\rpmhezwrom.sys
1⤵
PID:5440

C:\Temp\omjebzwrom.sys
C:\Temp\omjebzwrom.sys
1⤵
PID:3924

C:\Temp\vtolgeywqo.sys
C:\Temp\vtolgeywqo.sys
1⤵
PID:796

C:\Temp\dbvtqljdby.sys
C:\Temp\dbvtqljdby.sys
1⤵
PID:628

C:\Temp\ayvtnlidbv.sys
C:\Temp\ayvtnlidbv.sys
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

davsnifays.exe

Path C:\Temp\davsnifays.exe
Size 384KB
SHA256 c80e74ce07b32057a9501a18bbdfcb99c770b74d427fc155d3c1fcf1bb31f390
MD5 69e9bfd8ae1dfd4a72b4245bb0ea0f21
SHA1 c0b257ab333f598b24d6fd5244125dceac14dadb
SHA512 b27a38f7bc44012d3eec5b043c9f7b1aaa0065bbba6096a7e7946f6d3caabf82dbe4f53d985bdc73cd1889d7d50e7f90216db14d500ded2b3f44a8cf67a6730e
SSDEEP 3072:wtgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:wtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847B00BAA4F0F6C995043800DFAF36A67E74281726CBC7E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsnifays.exe

Path C:\Temp\i_davsnifays.exe
Size 384KB
SHA256 3dcd520fdbbd3912a3bc7ef56d7783e6321da9885546e022e93913b48fb76531
MD5 a45ded248f1bdc8484211cb51429ac69
SHA1 4de1c1d992e8d2ecd6c18e280188f33c977b24c4
SHA512 8d339a050f25d64b88ecd9e14c9154f18b6d3cefbdb8dbc3f1e8dd949068ab01ca15c6d2b29cfe7ad21386136d4269f2c3dc59b1a85a4458655c3ea660e31fe7
SSDEEP 3072:dtgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:dtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifayspkic.exe

Path C:\Temp\i_kifayspkic.exe
Size 384KB
SHA256 128ec31143fdb1a0df1de076be451d49de1b3c5382f66fcb2795a7b55528e98c
MD5 728fe3c8763333081e46dfa9a769c10b
SHA1 3e2f541cb472a3cfaae41f1347f5fa444a416759
SHA512 ace4658df7f408884ecd26dd8a53014b6cf7131786d2f5e0d7ee2d69110055ef4b5c4aa7fbb8a7512a1a94817733746b18732b3e938976b018e03f5704581967
SSDEEP 3072:FtgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:FtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T162847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtnlfd.exe

Path C:\Temp\i_lidbvtnlfd.exe
Size 384KB
SHA256 412a258d4811e2302fc06a9824b6e3f81b0e268ba04790275042e564b9fd1d56
MD5 bff15bbe756e2af9f579ed2320df4ee2
SHA1 cf7643a18f3851b298b549133c264af789ba4d95
SHA512 9a305d2e73ea8245945be9e3ace2fa0ee12c5142df28fb2f8ab0e8f3d77342788ca60a11db1f54e21927ae9c9fa1ee4aa7548a42517e28136d3d8319a03612ed
SSDEEP 3072:ftgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ftNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbwtrlje.exe

Path C:\Temp\i_ljdbwtrlje.exe
Size 384KB
SHA256 9ee03480e4575b71594e73ab541573708cf728a46481d8bbe4b1ad1e75bb983e
MD5 5dd6ffd7c2265a3a96c6e4253869a602
SHA1 49d74348d3d14cb3182e230a5edb1960531f2894
SHA512 32cad3e476ccb9744261d912b0765b63bbfd5af1958b7b2b6949f4973b2626c2eb1b2c526f90b52c19f8f4bedff730748e42523b7569931f6506bb1c5a1fc9e5
SSDEEP 3072:dtgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:dtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhfzxvpnk.exe

Path C:\Temp\i_pkhfzxvpnk.exe
Size 384KB
SHA256 0e959bff002b798974d813505a67c4c399b3c79f9198503d65997b511cba9da2
MD5 0716b1d89d44f50199ca093cbaed2596
SHA1 57c776dde5a413c0dc6805e19764debaada8432e
SHA512 14397188b1826f291bda4b3964b4b26f66df83104aba4e9b050660b2eae8a21018dabf4cb3bca44e74c66255a86342d4ceb386ea3fbe5328993358eba91d987e
SSDEEP 3072:/tgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:/tNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifayspkic.exe

Path C:\Temp\kifayspkic.exe
Size 384KB
SHA256 312d7ea08cb3a4b8c7395e052fd9353ca58aab5456bca8f6a8101631ee915cad
MD5 c9033a863968e057dfe4287e267190fb
SHA1 be355c6a636bc8877671ce3f466e61bda465b6b0
SHA512 3828b86afeafed42e265a4169167caac2d2343e39dd94cbde65939df8f2ec43a397667181c380a3281ff64a7c742010628bc6e761ead008d83df906e993c7616
SSDEEP 3072:DtgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:DtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T106847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.exe

Path C:\Temp\lidbvtnlfd.exe
Size 384KB
SHA256 5b0f000036ba61b0199942be9cfc4f2dcb7b28a86970b36e191626d810965904
MD5 6d66827c85d7aa1134f8544c6f2a06a9
SHA1 6f075fd4c951bc8c8bfbe692d77a51ff02bedaae
SHA512 47aeafdb026916b6f496e3428d5aad4bfcc910bd4a4d2d88ffbb1753d60d79dc7c5c2c0f85042e5d84e9b03210326c999750d8e2a77f16659a2471183fd8174f
SSDEEP 3072:/9tgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pc:FtNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847B00BAA4F0F6C995043804DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomgeywqojg.exe

Path C:\Temp\ljdbwtomgeywqojg.exe
Size 384KB
SHA256 c40793987d2479a9330246e8f42d9d9a152cb02a552e4a7698d5c311b21a9b35
MD5 d9ea3b4c21e598275391db309bb44744
SHA1 5b24385001374b591dc512d11becaea6c74c52e2
SHA512 37b1e1a1b514a995ddc7aac21a4d64fbfce8465bbcf6d929c0f5e98714c20e8742a299feeb8ce52a34d4d4caa474d8a2762d1b6afe6290eb509ee9588d6ec3da
SSDEEP 3072:etgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:etNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B00BAA4F0F6C995043800DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomgeywqojg.sys

Path C:\Temp\ljdbwtomgeywqojg.sys
Size 293KB
SHA256 2e5bf9ac1fd4fb21899c576330da18831eaa22ee74ed3e635e278e3226cd2841
MD5 342e48ab0c51fa370c912252eeaf9422
SHA1 6f81cd7a3e4b1b444c3e05ff1779d9efa268a35f
SHA512 912b7419ea5b2124e0f3a3313906067b5bc1dc907761ae797103ae15dc2676a323304b2e19745947332c8254e320c80f0abb83572a6a9300ca7eb072ba340d45
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtrlje.exe

Path C:\Temp\ljdbwtrlje.exe
Size 384KB
SHA256 b653d9f54f4d686c97c1076f8b91c9c0918bbbeefbcf6f195ccadbf222620a89
MD5 fb5e22158b84d6f5b128a6b5e0bd0713
SHA1 52b1526bd19e8c537e3c10612c3fb0b9af8819be
SHA512 89c7d8c4f15f17ad34e6046e647b9134985edc9d0bca6590a88680cba56c748ccfaaf3402ea635a5e6480c4fc95fa31989fb4b9c7063bf0d4755b3a53dfaa300
SSDEEP 3072:ztgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ztNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EA847B00BAA4F0F6C995043800DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlxvqnifdx.sys

Path C:\Temp\nlxvqnifdx.sys
Size 293KB
SHA256 f27a033e25202f663f5d63263443cccdcf859699b3c6ebcf1f2a7d0998311fd3
MD5 c78dae60829ad543704babdcc567e955
SHA1 dcc1ed1114b26fd14fb4dbea48a982be7d72c8de
SHA512 b169858ef450508839d640a6ec78b195d9939ceaf389d8d8ccc4cf25c6ab29f7b0393e03f470b077d33ca68dc66f1856d22ca0a45dd5f3757bc0cdb051f36d17
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhfzxvpnk.exe

Path C:\Temp\pkhfzxvpnk.exe
Size 384KB
SHA256 3d5023c1abf955c85f8e83961c3132121caaa1b33a62dbff99db89fdc5ab769b
MD5 abff532dc213c21e191ca9bd215f19db
SHA1 fffb42ea166d4fd72ea74fce87d59a67cd18aed9
SHA512 c9eafc9156f714feff1c0119f0f6ba19bb647ca7d61de1661fd8f98d1085fae42198f56bbc3ea4f577d2b3286dbaeb7ee0ea71998649bdc2fe22125f15ec5698
SSDEEP 3072:btgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:btNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847B00BAA4F0F6C995043800DFAF36A67E74281726CBC3E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkecausmk.sys

Path C:\Temp\pmkecausmk.sys
Size 293KB
SHA256 e0f164be50675600e314c1e70fd229fcbc6fb88bf39a4cddbb08536762426ea9
MD5 c3559a1a7beda7f3604d1a624b344d31
SHA1 2a46d3f5f6c78b0a817bb9048174f7864efc7622
SHA512 642e128d22123b5170347152c99e9600acc2a7f558919390796f3aa877edf17e582a134bfbe30aa0e73dfc52e3561d667919f5241e0a9682dfd16ab572c8e8f1
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrpjh.exe

Path C:\Temp\pnhfzxrpjh.exe
Size 384KB
SHA256 0e8fd810a0a64824fba2a2aa477803242a46adb24e6d90cc910e752761a8efee
MD5 d409d858a85db6013d9601bb661226c0
SHA1 cd8c85d40c07ae03b64bf63f59ddd5ee7c44b7cf
SHA512 6738583864dfc2eabd27caba1200012a69dd1e6e388efc18b2e2a9407a31fb50e6e67c94e477d92441b5702f9295140d53c4e06e96db58986ad1d2ca6d72dea3
SSDEEP 3072:ytgpV8aMz4yztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ytNdIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B00BAA4F0F6C995043800DFAF36A67E74281726CBC7E754CE5DA9513C3AA3579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkhfaxspkh.sys

Path C:\Temp\qkhfaxspkh.sys
Size 293KB
SHA256 1a3eacd8d50c640262daf025fe71bd9946de8ce7ff7d55cf7b8173b4c03f88a4
MD5 12cd0f1ab23d9379950e4016c414c6fe
SHA1 3420b3f5e6955f823a32c2b3bfc317b6299d7882
SHA512 cab6c4686eeda54ed0705d3eb00f8a60917091e77efa32f1b8ed29c9c11bace6562db13bc1b916ab301678d216c0260457bce20a6a8e53a45d683c3f37be7bb3
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdbvtol.sys

Path C:\Temp\tnlgdbvtol.sys
Size 293KB
SHA256 228940f7707bc0689a34f37bb327511bbb68eed755fdf3888f218f54b7790ac4
MD5 4f2317254c4d11218bc08de06033caca
SHA1 b8315c89ea385760255688f6fb9257296c208a0a
SHA512 dd9f290f87bcf51cae862d6dc67c44090e617f2cc2a27667215c6105ea378c1d80b54e8029995682c17c99d6988a8eec145c4bd748e28848da4d6b9f07a8fd59
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvpn.sys

Path C:\Temp\vsnlfdxvpn.sys
Size 293KB
SHA256 f8b2ab423489bb204d477d06bad280209b6f4870561b34be27baac247a4be384
MD5 ddf563634d54020e74a80927c68db9b8
SHA1 34493f43b52522fd80fec8f6325983b73a425355
SHA512 56651286ca3de5aebb30de3ca6421d84b0a364486318020d774b5a6ccde6a91862f1615f07c428e4a427c921bed8b45948087c50ceb1c2f70f098ddb7786f846
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5aa5875fb7c5454af6376189cf4b42aa3ef63ecc2dcfb5bb854751b6d50e3e01
MD5 eb9d094dc3686c0c2d8889bae500ff8a
SHA1 23f7c4af92d5fdf5af70786f32578952347c75da
SHA512 75346e39d91356f315fa1e4daa02407af13a8ad8cde2855a603da74baf4f2446c739992e230c2986d67583a591d8ad4da38b295f7302f46728e3d5c46a3bd6c3
TLSH
T1976119B48336BBD3D7256EBE80F112883D643663428F5E038790D676D80A7315F1A7A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ba1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ba1f.TMP
Size 3KB
SHA256 ce37027e3cf8c99a8350fae9d9277dde6d6ddbc38b8daed442cb320bf2355d60
MD5 82ad64872f746b9825d1af16f989cf58
SHA1 544ac53799c7936f96e1218c4d098289345cd969
SHA512 b72c30dbda7780eef1285b792f2c6c1f56a2ff278e610e4650ee84805166154052fcd980c567270eac8b792bceb764e378c787bbf0a388930081961977ca391d
TLSH
T1CC612AB48336BBD3D7216EBE81F112883D647663428F5E038790D676D80A7305F1A3E0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c5e567a476992fdc4a2a4618ecccaa4220eb4c8c37c7461fddf765be1f30c131
MD5 e381b80b0c0f96941d2d21727a600bfe
SHA1 20433f50311cd81e1aa98259d6d884fe1ece9593
SHA512 eaa2e1fb595647f64587ec520ccad5941636650e8125a4f97b17a94ee2f2bfb460c3625fc1a88dca492deb0b9b9ebd444eeac4ce1a7dc07a87442305e554c3f2
TLSH
T16041CEF3C3E4866DC91196F0AA146E2BCE1D0914432C3D9AC9E4EE5BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0aa35db1078b2fea0c7b7b0c79abd25a79c54da71e8b044d6d56e26f425c8896
MD5 6d3f908404d9386b9888118f5b99d08d
SHA1 c45c0770bc7b6879c98ad4a36ba02405f57e2cfe
SHA512 b9de59aab891c470583acab843776c1c2071a36e0453505bf2d3982412cd0961b54dcf5aa485f283bb29bbd8af3142611bbb2cbeede94382dde373a95dd01985
SSDEEP 192:sxRPRdyM/jK1Ml8wC2/fCsEhMeZdT9k8xlzoA8p9g/g6+WNIYDQTGTIgtJ:sxRPV82/fCsE+Yd5k8xIm/5I03
TLSH
T12052C806AA34993BCCCBD209FA557F53D6F81573A2901E44AAFCCA1C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e05164c417df5779fafa96f692f18652df1e69a99db584f4e518f9e8af9cd3a
MD5 007bff583872d1023eee77669f062bd3
SHA1 d95f48d0b79db018fe3d0fb05cccb7703356e20b
SHA512 59e5f1897aab81daabdc0022d254ed305e86ba9d1099c7a51db16b14a3c3d0924bdc7c2a80116992674a25e34dfa2f94ca89a94eea53bf72fc014cd4a23fc6ac
SSDEEP 192:sxRYRdyM/jK1Ml8wC2/fCsXhMeZdT9k8xlzoA8p9J/g6+WNCwN/YDyTGTIgDvJ:sxRYH82/fCsX+Yd5k8xIr/5H/M9
TLSH
T17F62D906AA34997B8CCBD209FA957B53D6F8557392901E44AAFCCA0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 215aec18904eb199fea26c575e8da8df8c0163c28ff9b2aef4ecb9b87faff560
MD5 21fa830b182d7c935229a5aed82285e7
SHA1 e178b5cb8ff7de6163c6328712eb3121c04e2d2d
SHA512 9abafb36ea45a446446d1f47169703ed3762fe01a4acee8573cdd1f503b6c4a73fe163ec1e728e8888cd730b4a8360ff9218a9b533c1b4c466491686bf886d45
SSDEEP 192:sxRYRdyM/jK1Ml8UQrC2/fCsXhMeZdT9k8xlzoA8prJ/g6+WNCwN/YDmTGTIgDvJ:sxRYHqe2/fCsX+Yd5k8xIF/5H/69
TLSH
T18862D706AA24997BCCCBD209FA957B53D6F8557392900E44AAFCCA0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b1c97ea040a157a71d8ba34852bf2724ace9eca519c350c1805e17ccf1378013
MD5 43c7aa1fa2d829fbac31c5068ebe182a
SHA1 bde1aa934ea22057c1ad7ba0ac81da371b3d294e
SHA512 36b2e8199225ed92aa2ac1e845c2e2536e4fde640b0dac934632d0669657b1509bbb7ce4acbee6c724c5014e9c3952569e9bb14c110d2c55e5ef44d1d4954fe3
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmRkIn2Rro7DvG:f+4+zBE7eDWgb/fPIu1jaJRkw2q7DvG
TLSH
T188E2EB7B680CCB7E4F404A9DEC29BD9E6DE801CF9698C95447EA880C03C7AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc50cc77-b1bf-4707-9e22-cbe02b164dae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc50cc77-b1bf-4707-9e22-cbe02b164dae.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4110cfc0-0d5b-4798-8bb6-1c3a3f3266e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4110cfc0-0d5b-4798-8bb6-1c3a3f3266e3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e0cda699850fcf5ef593a9c76edf6cb5c3641c4ce29aa9370a61f9bb5d695f2f
MD5 3ad219e8ff47aee22298a73092590295
SHA1 b792693e2620a6c41cd7ee34f7e2b23424825182
SHA512 11d84a60e343780c8eb2a2e218609d5703f265e8f4288282d7b65784cf2c5fdc5659fd6bc1650397df3ba63c585f8859c908dafcfe49ea672b64b1c4253e6512
SSDEEP 768:0rv+4UNbdC312lwifXaHuVboPzkZLNx9OZuUik4K:0bsbs31D9HOawZLNqcUVr
TLSH
T1BC03B036A8749937CDE79288B14B7A477FF4211385C40B88D9EC2B4D46AF4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 585aec2a6da2490d9dcde35893891779ef1d3323f240aa6ed2faf57f566918f6
MD5 14d849698eebcb02b69ef78d0c216004
SHA1 0dc85d6e0f823d6f77d2aa484fbd3690bb662643
SHA512 f776f4e2fd63fb4c2c47f36399f7578cb32aaec0e534000ce45764914be3f9ce248a52c6c09701f3d575b18e18652812345b60804fdcadabeb64c1934239e672
SSDEEP 768:qj+993UMKDTwifoBGaHuVboPzkZLNx9OFub9Ml:J993m433HOawZLNqcb+l
TLSH
T134F2AF71B8618D33CDDB8798B24A3A96BFF01167C5C40E88DDE8AF0D09975AD1B07D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 02892dd349c734c61c4db19d4dfaa07a7c6f30e06dbcc68b31d0291b769849fc
MD5 96f4806cedb353bfcb9ccd33008af8d0
SHA1 f369e83701d73330c399ab8b7ae1870b52bd17ee
SHA512 89c531a927a25ec281a88cf2d0aa6dac8fb9e569ec9f14bfa7dea7c460853be0a62b9317de322aea6fe2749d5d5cb4f9b1d67aa2d7b3410ebf9e28e61013461f
SSDEEP 768:eF1j+993Vwg1MKJOTB3aHuVboPzkZLNx9OFub9Ml:b993dOqHOawZLNqcb+l
TLSH
T1EF1316F698D38937D89E4787A37D2E46AEBCD163B5840984BBC45E0CCC971BFC606911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

adc5b3af-025b-4aef-95ec-cc10f576d9a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\adc5b3af-025b-4aef-95ec-cc10f576d9a3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4020_708923940\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ee4d1b2c582e004c57c5359a5f48700e0ff0c42b61275b8155ae51a8e8163594
MD5 d5aca520d084bc4dbf5d41d07291cd8f
SHA1 c8ca35c426771999c1c7fac9803bcb902a8f6dbe
SHA512 c8cb1d9c9d0d860c620cec8e826e6340e2a005868793dc5183bb21978e433dc61874667c43c555997ad9861fa97359f5f70994c5fd310e8b988d4ef31a434f5d
TLSH
T1B171238357ADD5B3C1DE9BF002835244F5FB223C076370200BA5598AEB31ABA64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/628-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/708-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/776-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/796-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/796-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1060-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-503-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2024-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2920-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2920-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3272-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3924-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5216-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5284-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5440-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download