systex | b4aea8b836d9565644bc7ef17bb972424a06980c3dccac2fe7ae3c50c54f3496

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260708-eks8csat6t
SHA256 b4aea8b836d9565644bc7ef17bb972424a06980c3dccac2fe7ae3c50c54f3496
MD5 ff4ffab1a44aafc9c61b010c5232f21a
SHA1 e87482568449dec522c991928f50d9aca9d034ea
SHA512 cd5fc1831cfd96435a716c9f495a255b539da742828f2d55aa7fab084e14efb0a17e5625591ff75cffcc12a9d33b10bc0d11c5f1f9565e24fdd442c64f084bca
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1684	fdxvpnlicausnkif.exe
2460	fdxvpnlicausnkif.sys
2004	CreateProcess.exe
2668	nkifaysqkx.exe
2728	CreateProcess.exe
4972	CreateProcess.exe
5968	i_nkifaysqkx.exe
3496	nhfaxspkhf.sys
3616	CreateProcess.exe
2460	fzxupnicxu.exe
4928	CreateProcess.exe
460	CreateProcess.exe
1268	i_fzxupnicxu.exe
1844	wupmkfzxrp.sys
5944	CreateProcess.exe
4600	upmhezxrpj.exe
2564	CreateProcess.exe
2772	CreateProcess.exe
5992	i_upmhezxrpj.exe
4460	CreateProcess.exe
2480	pjhecztrpm.exe
5376	CreateProcess.exe
4120	CreateProcess.exe
2044	i_pjhecztrpm.exe
4364	zwurmjebwu.sys
4484	CreateProcess.exe
4944	ojgbytrojg.exe
4248	CreateProcess.exe
2120	CreateProcess.exe
3112	i_ojgbytrojg.exe
1700	wqoigbywqo.sys
5608	CreateProcess.exe
2056	ytroigebzt.exe
3032	CreateProcess.exe
2836	CreateProcess.exe
2600	i_ytroigebzt.exe
4036	nljgayvtnl.sys
2440	CreateProcess.exe
2700	ljdbvqoigd.exe
5768	CreateProcess.exe
5320	CreateProcess.exe
1624	i_ljdbvqoigd.exe
3028	nifdxvqnif.sys
2008	CreateProcess.exe
5704	nigaysqlif.exe
6096	CreateProcess.exe
3824	CreateProcess.exe
4560	i_nigaysqlif.exe
3880	xvsnkidays.sys
5100	CreateProcess.exe
1500	qkicausnki.exe
1952	CreateProcess.exe
5780	CreateProcess.exe
3416	i_qkicausnki.exe
1764	xvpnhfzxsp.sys
1160	CreateProcess.exe
5432	vpnhfaxspk.exe
2332	CreateProcess.exe
4056	CreateProcess.exe
2140	i_vpnhfaxspk.exe
4180	upmhfzxupm.sys
560	CreateProcess.exe
2592	pmkecaxrpm.exe
5068	CreateProcess.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_162143440\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1674754448\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_2129775306\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1288860064\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_162143440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_162143440\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_162143440\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_2129775306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1288860064\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupnicxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbytrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdbvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkifaysqkx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbytrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecaxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkifaysqkx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytroigebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayspkhfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecaxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdbvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpmgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupnicxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhecztrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayspkhfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnlicausnkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhecztrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytroigebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
936	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5464	ipconfig.exe
5868	ipconfig.exe
2716	ipconfig.exe
5972	ipconfig.exe
5940	ipconfig.exe
2172	ipconfig.exe
5340	ipconfig.exe
2880	ipconfig.exe
4904	ipconfig.exe
4468	ipconfig.exe
2408	ipconfig.exe
4728	ipconfig.exe
3648	ipconfig.exe
5676	ipconfig.exe
5020	ipconfig.exe
4896	ipconfig.exe
1064	ipconfig.exe
2076	ipconfig.exe
2844	ipconfig.exe
5764	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279568319218259"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{19F89CCB-7A5D-46BF-BBA1-13BE196F0DF3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe
1684	fdxvpnlicausnkif.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5968	i_nkifaysqkx.exe
Token: SeDebugPrivilege	1268	i_fzxupnicxu.exe
Token: SeDebugPrivilege	2044	i_pjhecztrpm.exe
Token: SeDebugPrivilege	3112	i_ojgbytrojg.exe
Token: SeDebugPrivilege	2600	i_ytroigebzt.exe
Token: SeDebugPrivilege	1624	i_ljdbvqoigd.exe
Token: SeDebugPrivilege	4560	i_nigaysqlif.exe
Token: SeDebugPrivilege	3416	i_qkicausnki.exe
Token: SeDebugPrivilege	2140	i_vpnhfaxspk.exe
Token: SeDebugPrivilege	3176	i_pmkecaxrpm.exe
Token: SeDebugPrivilege	6104	i_urpmgezwrp.exe
Token: SeDebugPrivilege	3444	i_hbzwrpjhbz.exe
Token: SeDebugPrivilege	5352	i_gbytrojgbz.exe
Token: SeDebugPrivilege	2396	i_tolgdbvtql.exe
Token: SeDebugPrivilege	4180	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	3880	i_ysqfdxvpni.exe
Token: SeDebugPrivilege	6104	i_ayspkhfdav.exe
Token: SeDebugPrivilege	4040	i_xupnhfzxup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1684	2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 2404 wrote to memory of 5064	2404	2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 5064 wrote to memory of 5172	5064	iexplore.exe	90
PID 5172 wrote to memory of 1296	5172	msedge.exe	91
PID 5172 wrote to memory of 5728	5172	msedge.exe	92
PID 5172 wrote to memory of 936	5172	msedge.exe	93
PID 5172 wrote to memory of 5728	5172	msedge.exe	92
PID 5172 wrote to memory of 5728	5172	msedge.exe	92
PID 5172 wrote to memory of 3844	5172	msedge.exe	94
PID 5172 wrote to memory of 3844	5172	msedge.exe	94
PID 5172 wrote to memory of 4264	5172	msedge.exe	96
PID 5172 wrote to memory of 4264	5172	msedge.exe	96
PID 5172 wrote to memory of 3884	5172	msedge.exe	97
PID 5172 wrote to memory of 4264	5172	msedge.exe	96
PID 5172 wrote to memory of 3884	5172	msedge.exe	97
PID 5172 wrote to memory of 3884	5172	msedge.exe	97
PID 5172 wrote to memory of 1464	5172	msedge.exe	98
PID 5172 wrote to memory of 5576	5172	msedge.exe	99
PID 5172 wrote to memory of 1464	5172	msedge.exe	98
PID 5172 wrote to memory of 1464	5172	msedge.exe	98
PID 5172 wrote to memory of 5576	5172	msedge.exe	99
PID 5172 wrote to memory of 5576	5172	msedge.exe	99
PID 5172 wrote to memory of 4996	5172	msedge.exe	100
PID 5172 wrote to memory of 4996	5172	msedge.exe	100
PID 5172 wrote to memory of 4996	5172	msedge.exe	100
PID 5172 wrote to memory of 4548	5172	msedge.exe	101
PID 5172 wrote to memory of 4548	5172	msedge.exe	101
PID 5172 wrote to memory of 3368	5172	msedge.exe	103
PID 5172 wrote to memory of 3368	5172	msedge.exe	103
PID 5172 wrote to memory of 3368	5172	msedge.exe	103
PID 5172 wrote to memory of 2340	5172	msedge.exe	107
PID 1684 wrote to memory of 2004	1684	fdxvpnlicausnkif.exe	108
PID 5172 wrote to memory of 4140	5172	msedge.exe	111
PID 5172 wrote to memory of 6020	5172	msedge.exe	110
PID 5172 wrote to memory of 4140	5172	msedge.exe	111
PID 5172 wrote to memory of 6020	5172	msedge.exe	110
PID 2668 wrote to memory of 2728	2668	nkifaysqkx.exe	113
PID 5172 wrote to memory of 5628	5172	msedge.exe	116
PID 5172 wrote to memory of 5628	5172	msedge.exe	116
PID 5172 wrote to memory of 2328	5172	msedge.exe	119
PID 5172 wrote to memory of 2328	5172	msedge.exe	119
PID 1684 wrote to memory of 4972	1684	fdxvpnlicausnkif.exe	120
PID 5172 wrote to memory of 3904	5172	msedge.exe	122
PID 5172 wrote to memory of 3904	5172	msedge.exe	122
PID 5172 wrote to memory of 3904	5172	msedge.exe	122
PID 1684 wrote to memory of 3616	1684	fdxvpnlicausnkif.exe	125
PID 2460 wrote to memory of 4928	2460	fzxupnicxu.exe	127
PID 1684 wrote to memory of 460	1684	fdxvpnlicausnkif.exe	130
PID 1684 wrote to memory of 5944	1684	fdxvpnlicausnkif.exe	134
PID 4600 wrote to memory of 2564	4600	upmhezxrpj.exe	136
PID 1684 wrote to memory of 2772	1684	fdxvpnlicausnkif.exe	139
PID 1684 wrote to memory of 4460	1684	fdxvpnlicausnkif.exe	141
PID 2480 wrote to memory of 5376	2480	pjhecztrpm.exe	143
PID 1684 wrote to memory of 4120	1684	fdxvpnlicausnkif.exe	147
PID 5172 wrote to memory of 5948	5172	msedge.exe	149
PID 5172 wrote to memory of 432	5172	msedge.exe	150
PID 5172 wrote to memory of 2448	5172	msedge.exe	151
PID 1684 wrote to memory of 4484	1684	fdxvpnlicausnkif.exe	154
PID 4944 wrote to memory of 4248	4944	ojgbytrojg.exe	156
PID 1684 wrote to memory of 2120	1684	fdxvpnlicausnkif.exe	159
PID 1684 wrote to memory of 5608	1684	fdxvpnlicausnkif.exe	163
PID 2056 wrote to memory of 3032	2056	ytroigebzt.exe	165
PID 1684 wrote to memory of 2836	1684	fdxvpnlicausnkif.exe	168
PID 1684 wrote to memory of 2440	1684	fdxvpnlicausnkif.exe	172

C:\Users\Admin\AppData\Local\Temp\2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_ff4ffab1a44aafc9c61b010c5232f21a_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Temp\fdxvpnlicausnkif.exe
  C:\Temp\fdxvpnlicausnkif.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkifaysqkx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2004
  - - C:\Temp\nkifaysqkx.exe
      C:\Temp\nkifaysqkx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkifaysqkx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Temp\i_nkifaysqkx.exe
      C:\Temp\i_nkifaysqkx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxupnicxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\fzxupnicxu.exe
      C:\Temp\fzxupnicxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxupnicxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:460
  - - C:\Temp\i_fzxupnicxu.exe
      C:\Temp\i_fzxupnicxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5944
  - - C:\Temp\upmhezxrpj.exe
      C:\Temp\upmhezxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2772
  - - C:\Temp\i_upmhezxrpj.exe
      C:\Temp\i_upmhezxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhecztrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\pjhecztrpm.exe
      C:\Temp\pjhecztrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhecztrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4120
  - - C:\Temp\i_pjhecztrpm.exe
      C:\Temp\i_pjhecztrpm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbytrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\ojgbytrojg.exe
      C:\Temp\ojgbytrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbytrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\i_ojgbytrojg.exe
      C:\Temp\i_ojgbytrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytroigebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5608
  - - C:\Temp\ytroigebzt.exe
      C:\Temp\ytroigebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytroigebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\i_ytroigebzt.exe
      C:\Temp\i_ytroigebzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2440
  - - C:\Temp\ljdbvqoigd.exe
      C:\Temp\ljdbvqoigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5320
  - - C:\Temp\i_ljdbvqoigd.exe
      C:\Temp\i_ljdbvqoigd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqlif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Temp\nigaysqlif.exe
      C:\Temp\nigaysqlif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqlif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3824
  - - C:\Temp\i_nigaysqlif.exe
      C:\Temp\i_nigaysqlif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5100
  - - C:\Temp\qkicausnki.exe
      C:\Temp\qkicausnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5780
  - - C:\Temp\i_qkicausnki.exe
      C:\Temp\i_qkicausnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1160
  - - C:\Temp\vpnhfaxspk.exe
      C:\Temp\vpnhfaxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4056
  - - C:\Temp\i_vpnhfaxspk.exe
      C:\Temp\i_vpnhfaxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecaxrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:560
  - - C:\Temp\pmkecaxrpm.exe
      C:\Temp\pmkecaxrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecaxrpm.exe ups_ins
    3⤵
    PID:2152
  - - C:\Temp\i_pmkecaxrpm.exe
      C:\Temp\i_pmkecaxrpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpmgezwrp.exe ups_run
    3⤵
    PID:2864
  - - C:\Temp\urpmgezwrp.exe
      C:\Temp\urpmgezwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpmgezwrp.exe ups_ins
    3⤵
    PID:5812
  - - C:\Temp\i_urpmgezwrp.exe
      C:\Temp\i_urpmgezwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwrpjhbz.exe ups_run
    3⤵
    PID:1260
  - - C:\Temp\hbzwrpjhbz.exe
      C:\Temp\hbzwrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwrpjhbz.exe ups_ins
    3⤵
    PID:3424
  - - C:\Temp\i_hbzwrpjhbz.exe
      C:\Temp\i_hbzwrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrojgbz.exe ups_run
    3⤵
    PID:2268
  - - C:\Temp\gbytrojgbz.exe
      C:\Temp\gbytrojgbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrojgbz.exe ups_ins
    3⤵
    PID:2876
  - - C:\Temp\i_gbytrojgbz.exe
      C:\Temp\i_gbytrojgbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgdbvtql.exe ups_run
    3⤵
    PID:4140
  - - C:\Temp\tolgdbvtql.exe
      C:\Temp\tolgdbvtql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgdbvtql.exe ups_ins
    3⤵
    PID:5304
  - - C:\Temp\i_tolgdbvtql.exe
      C:\Temp\i_tolgdbvtql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    PID:5480
  - - C:\Temp\vtnlfdyvqo.exe
      C:\Temp\vtnlfdyvqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    PID:3444
  - - C:\Temp\i_vtnlfdyvqo.exe
      C:\Temp\i_vtnlfdyvqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqfdxvpni.exe ups_run
    3⤵
    PID:240
  - - C:\Temp\ysqfdxvpni.exe
      C:\Temp\ysqfdxvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqfdxvpni.exe ups_ins
    3⤵
    PID:2868
  - - C:\Temp\i_ysqfdxvpni.exe
      C:\Temp\i_ysqfdxvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayspkhfdav.exe ups_run
    3⤵
    PID:5496
  - - C:\Temp\ayspkhfdav.exe
      C:\Temp\ayspkhfdav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayspkhfdav.exe ups_ins
    3⤵
    PID:5440
  - - C:\Temp\i_ayspkhfdav.exe
      C:\Temp\i_ayspkhfdav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxup.exe ups_run
    3⤵
    PID:944
  - - C:\Temp\xupnhfzxup.exe
      C:\Temp\xupnhfzxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxup.exe ups_ins
    3⤵
    PID:5864
  - - C:\Temp\i_xupnhfzxup.exe
      C:\Temp\i_xupnhfzxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    PID:1640
  - - C:\Temp\zxrpjhczus.exe
      C:\Temp\zxrpjhczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd74e1c188,0x7ffd74e1c194,0x7ffd74e1c1a0
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,3561183374757746810,12158293909186948559,262144 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,2290148681768870559,12658961343362213113,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,778414444521133711,3668567772892062489,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3022120254672359987,9489861173402943437,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,5210834664062545979,16394062271978256395,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,17766949029616451332,3139342599584696072,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,18254498352631619045,17470919952011292785,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5412,i,16742663054086570589,15293212214498538115,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,12790888031908016235,2153729362934218726,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3676,i,9948925705084526924,12269562402810884801,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,8799010961440136576,5489235436393071736,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,8799010961440136576,5489235436393071736,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,4882965760179577596,5964457035059166061,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4888709477240588734,10314163622074357803,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,15638686541100186423,664576902649243862,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,5833856044845856951,9759527749649441360,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6428,i,2245129924923834675,9534762056555268996,2097152 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3298555733674529281,12224281156370577984,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14988537463402783292,12670311273139725844,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,13780702209301682167,15564689655473093578,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12708393872531727937,13792879631231395308,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,17722159030730513795,9276072483233824368,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,15960488778465474485,7269711483805343413,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5801395418002822504,5123812547308189039,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4848,i,18368004521200491035,15450052067800719093,262144 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:10
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,7141394890881791124,17648937077213966039,524288 --field-trial-handle=2304,i,3647490995419220006,4303513068627513778,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
      4⤵
      PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1420

C:\Temp\fdxvpnlicausnkif.sys
C:\Temp\fdxvpnlicausnkif.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4668

C:\Temp\nhfaxspkhf.sys
C:\Temp\nhfaxspkhf.sys
1⤵
- Executes dropped EXE
PID:3496

C:\Temp\wupmkfzxrp.sys
C:\Temp\wupmkfzxrp.sys
1⤵
- Executes dropped EXE
PID:1844

C:\Temp\zwurmjebwu.sys
C:\Temp\zwurmjebwu.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\wqoigbywqo.sys
C:\Temp\wqoigbywqo.sys
1⤵
- Executes dropped EXE
PID:1700

C:\Temp\nljgayvtnl.sys
C:\Temp\nljgayvtnl.sys
1⤵
- Executes dropped EXE
PID:4036

C:\Temp\nifdxvqnif.sys
C:\Temp\nifdxvqnif.sys
1⤵
- Executes dropped EXE
PID:3028

C:\Temp\xvsnkidays.sys
C:\Temp\xvsnkidays.sys
1⤵
- Executes dropped EXE
PID:3880

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\upmhfzxupm.sys
C:\Temp\upmhfzxupm.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\cxupmjhfrp.sys
C:\Temp\cxupmjhfrp.sys
1⤵
PID:3500

C:\Temp\hbzwrpjhbz.sys
C:\Temp\hbzwrpjhbz.sys
1⤵
PID:1388

C:\Temp\geywtomjdb.sys
C:\Temp\geywtomjdb.sys
1⤵
PID:4668

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
PID:480

C:\Temp\bqkigdyvtn.sys
C:\Temp\bqkigdyvtn.sys
1⤵
PID:1268

C:\Temp\fdxvqnigay.sys
C:\Temp\fdxvqnigay.sys
1⤵
PID:5816

C:\Temp\avsqkicaxv.sys
C:\Temp\avsqkicaxv.sys
1⤵
PID:3416

C:\Temp\fzxupnhfcx.sys
C:\Temp\fzxupnhfcx.sys
1⤵
PID:5148

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fdxvpnlicausnkif.exe

Path C:\Temp\fdxvpnlicausnkif.exe
Size 384KB
SHA256 258dd988463e6f35884d4d09ed1270525760584e90082f5ba75dd73736bf4380
MD5 a712395f15b59dd90edbe0b247193161
SHA1 a280a284cbd9ac74478965a0a3aeb5c5b9da3358
SHA512 f751499885e41391cb6930cbd973611981ef2c8e7b3b66f6808992e0464b70105260b6d0f8c2b0fcf39d59189ca47fedbdf4f5ba33c5b9f749d8745ad935ed98
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnlicausnkif.sys

Path C:\Temp\fdxvpnlicausnkif.sys
Size 293KB
SHA256 97fbfdbd77dc78475069c28772937faa0f6ec61cbf753d68aa3e8c93a8757e07
MD5 c5dde2428def2d8c3c40333f72c5245d
SHA1 7ccd645b5a529e25106913bbd4e1ecfe0e5a5d8b
SHA512 d69e119ad2976d61c9813a40891dd5c3bb0a35f39ca31dde867d6bca710d19307e661295bab6babfcbbb7da36690c9c72f1eb3170c5b57773f7e5acdd8e0b21d
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxupnicxu.exe

Path C:\Temp\fzxupnicxu.exe
Size 384KB
SHA256 622acc76729b23940b31230d7f493fdf55d8a5944ff2b8f992517a4188ae77b2
MD5 74050e59020f8411114f008d11c36a07
SHA1 682cfab9d1aa8dead10b9c4dbd8cfacb12701ece
SHA512 6862983e6d570062de74fe01fae56c817f9bab916cf7856a520f1617162917f7c7dee8185e94448460f412e43bb3497dce9a33b209be94ca0790ee7f9d12c31b
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxupnicxu.exe

Path C:\Temp\i_fzxupnicxu.exe
Size 384KB
SHA256 f4914ffe14c6ef5a2cface71301ff432ba214086f863fdb532e1c37792476391
MD5 ed44e273e2db8773139ac9e27a085b98
SHA1 eb460feb878e1a08feba6df6e102387245a19faf
SHA512 773c30ed3f8bddb2968e77cb7fe428cdf4491687959ec8ad4227490be671c5b292c488b6097c7433f67fdb45a179246c2bd5b7d2036248a89bb670b8611d79c4
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkifaysqkx.exe

Path C:\Temp\i_nkifaysqkx.exe
Size 384KB
SHA256 4b2a857329d24fd771c0c14a90423b3eb424466981196c0e00de36d5513dd16a
MD5 9b0a3f03daf0e3a26a1474b702cb7026
SHA1 6645e2c8dcef08cc728973076e0949d018fe6dff
SHA512 6fd070295b7193381b1cc4401c6635d1dadc4bc9db50f4a2e708f27dc878f291d1516cd8bd19e21402911b967bac77b7ed187d9bcacb54d803a28b940f2dda5c
SSDEEP 3072:C9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbytrojg.exe

Path C:\Temp\i_ojgbytrojg.exe
Size 384KB
SHA256 a9a7cf587bf80eea64e4ce8ecc0afe1b364152ee6f1909b6300262d62cbfea74
MD5 079bed17b45fce3c13565a75886e5c1f
SHA1 e7822d44fc003b6a46533a2137e356b4d7ddc98c
SHA512 08dfe29a7a70983fdff25f83ee362504a1196144794e73251f9540c4c4e72c9dd5e439e5738f32cd1268762fc920c707a7247cb8f8839722fe800d71c87c5d1e
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhecztrpm.exe

Path C:\Temp\i_pjhecztrpm.exe
Size 384KB
SHA256 62733eb05dc46d78b8c0b74f6153a6874fad4d8b345beee601c377b16e9ad2ac
MD5 1f323f5b1db3191a74a1411b480efffd
SHA1 682002b6e259b04e529ac77536e8b68dda964338
SHA512 ad9bbd957dfbf2535f962baa7f755a862a8db8dd96e4c40c8156125a116040344872724154d974490bc64ff630cb92e53df0382f65ac87550914b562e314f1b7
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhezxrpj.exe

Path C:\Temp\i_upmhezxrpj.exe
Size 384KB
SHA256 1ab27743cc68d38f92abd9c05a87d6905e79ea3cfd80fffde14d86735f933eeb
MD5 6a9b2212a13a16d9bf078d71ddf19c3e
SHA1 db03ef4af754270138e2f60a04979abfd6b021c7
SHA512 822dd4405e51ed95242293677f7d0c1bad4e9124f068185be4ddf542712b6b82d216e246e69760b89ecf184004d74f20e3f9a49a7b077ccc82e491d23cb6cb84
SSDEEP 3072:T9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:xctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkhf.sys

Path C:\Temp\nhfaxspkhf.sys
Size 293KB
SHA256 85cb0dad28411fba66134aed44cdc966bbd7d908b179708f38b31e7cab107549
MD5 bbd33979b38aab45e48b0ae4aa7a03ca
SHA1 67d872e63971f220c886e5abc967270cc5fcdc88
SHA512 b3a8774df9b827855ecc2f9473b9db7604c578529377203a4acf8c48a5583b1c4ee7c9313366165d550da9eddf611c5cd2c45c34c2bf6046cc6d2e0e5deaffbf
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T101545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkifaysqkx.exe

Path C:\Temp\nkifaysqkx.exe
Size 384KB
SHA256 1259891b03a069fd404686ea822273479553839465d656b90a171620f7b4c291
MD5 80d9b5d78011762c839e380ef3059b29
SHA1 4ab204aec94f4b7e6296bceadd95468e41c1f45e
SHA512 ebac590d3a95c8b2c65ac0a9c252ed2ba3bec859faf1dd0432749d66d790ac4e65017f2853bc32367c98888db2c887e5ec1201c3535d654ad8a67eb76eb1edea
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbytrojg.exe

Path C:\Temp\ojgbytrojg.exe
Size 384KB
SHA256 dd0b367626cd71b88f95d1a6df94c7e4506f5580595b8364cd4062c6a5b679b8
MD5 c4b75b5865190b8110b84a65e954e8fb
SHA1 64ee17394a697efd04f9d52ea7e28a40431148a5
SHA512 a6076a967e7c60f5ef857a6e2ca56f9bf8884ff765be83e73d22d10425188a0a314d899d5c1833522a25aa98c7e16ba8396abb34f7c9deb16a3ceafe95a7a5a4
SSDEEP 3072:C9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhecztrpm.exe

Path C:\Temp\pjhecztrpm.exe
Size 384KB
SHA256 9677edc8d6e234e30364da6beeee33ee924780d46df4d986e7b180dbeab0f1a4
MD5 e38a5b56426fa7fc5d4c828b0a20650a
SHA1 a1129f1bf12b43b8a1f53dcbf1d8f176b8e8a1a3
SHA512 1960a6402c446758248878fbb3c81152abb9f71bac1c131ec1d94fc88d7c4dfd9f11af117772ca1c35a9b37dbd8b504e6ca6271859149e70d16eccb136f44e6d
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A6847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezxrpj.exe

Path C:\Temp\upmhezxrpj.exe
Size 384KB
SHA256 a6b1261a4127d10656641d13572d183c06a2446f7bd4cf31005b36b28760ea6b
MD5 21a1a8052d9fd01f0a9c8a356cab2158
SHA1 f612703964bcb5830cfd9de34fd5acca80151e2b
SHA512 bb9bb89cf83d5bf09b541051c105a44f666c0e950a57997ececbbb5e3fe31b2c236494cae2feb9c735a2a4f89392ca4a49134be7ea0e08ac5ed5f067a748f38e
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbywqo.sys

Path C:\Temp\wqoigbywqo.sys
Size 293KB
SHA256 7b8d63341c3d00ce0c71ec3f9eac8d55bf35e5abf4ee953e350d59d77cd5bca6
MD5 a8d8ffe3ecf78fc19dfef20e0a02ece9
SHA1 53276d384b78d0882684acac87c2c7a81ebe0060
SHA512 4802aa327fa6e5593420b0c3197daf6b58423e9ef4e35f35266cfb7849de2a5741b5742c103171d7eed8a891935e4d067cddf0124799dedadafc437dc33c07ad
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmkfzxrp.sys

Path C:\Temp\wupmkfzxrp.sys
Size 293KB
SHA256 44c539657b6992edd98b4cd47b739476fd9840b6b728521df5d619d7c92b6e8f
MD5 5ae79270762cbf32a5eb2184dadbfdbb
SHA1 59c2f81a3e4b08537bc8c09457b39c59e63298a1
SHA512 e077be537fdda2959260e2441afc4720e6edfa2c36a868f659c086bb689a43891cd9f4711b6ab8c7027470cd926153df3fc3602ad4531491bed6352965bee0f2
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytroigebzt.exe

Path C:\Temp\ytroigebzt.exe
Size 384KB
SHA256 e4b1800040c101d2e52571a956be9316b81740470f0178f6e5ce062e318915b2
MD5 7f2ac3325cad7c1b96a38b54129c8525
SHA1 4010330c90f9002b80ebeda22ad56015d7663857
SHA512 27232fa6ea3ca6780f2b05063e8b58e3af76524a60aec476207de38363e1b1a10ff65f287aae98e813c2322efa034ad85cbb1f6d35346f4b77322b5c6b23d5a4
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwurmjebwu.sys

Path C:\Temp\zwurmjebwu.sys
Size 293KB
SHA256 4fac5b968b2ffced31ee3bbaa997c0a76f2443ba2379f8a62859a8fe798673f0
MD5 351e8cb4512fc1d57395d9b63edadbb5
SHA1 f0fc8e06b35aa96a18cb99a7597c147cca8d7a93
SHA512 f06105a99018b7f329ec8c77e7401fd0479181d98b6c487d444f8f4fac7870171827c05ea54cd4496f400f98deee58e347483af6b2647985934c5f1070d20b6b
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T11B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 05d2672f82d73a328291d5d209814160687db5465a6d27b8f0effa5f90f96ba3
MD5 3e25d3d9208df042dd2d8336fd788061
SHA1 8cc8ef4131f62ee31094484d42375ce7fd88365a
SHA512 4c61fcac45a94daf7ee5f831b1e371349f60056e82c8e73326f9b4853682cd67511927131d45199374e529b7f1fbd163b4146c8b36b9883fe6d85261d2fef686
TLSH
T1915140883BBE69D2DF20D27250FD44593EB0C47A42E74E085B9CD835A67B78C7053076
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592baa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592baa.TMP
Size 3KB
SHA256 65f0a7b98e86604c2cc768900a2f9aa2f97f6653656ccac614d74d532ed4f879
MD5 e83d228a7eaed355a7fcba5c9559e323
SHA1 adba0c9f72ac17322ba812d741b3b5a35e7b32ac
SHA512 45f845cf31d91df468b1b67b64799dc150d4b50e7771514d05bd9c9b6af8015bfb5d84302119fc3863159af7efa20f73f80f7f1773cd37be460ae74d0b2b1df1
TLSH
T140513F883BBE69D2DF20D27290FD44993EB0C47A42E74E085B9CD835A67B78C7193176
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 66be456abd01f6877b1d0a03cbb6a0c77e8fcc8298b18f140c67f234fb0f334d
MD5 0eb2b79559cd243ae7096f167160bdc2
SHA1 18d71434808d6daf44b6f85e03aef350903a6758
SHA512 14225f31dff9f13694b38a3500474d5c9bd5c89299b3e8056062574f1803de18b0ca8efbe6b9af28f62376b0d63d03f87d486cffcef1cd47df1fc8bce33117e5
TLSH
T14B51CDF7C3E8866D891185F4BA147E2BCE2D0A14432C3D5A89E4EF1B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c9aeee8a585dccbff25b739e57de0e27a87e506d12f9be6a0422eb748ae230fd
MD5 292e4fb8950c501de266f8a9b558f0a3
SHA1 991e3a247b3c1b8161866362834117689436ac5e
SHA512 b53725b0db62e94065a6adbc5a3d854ca8e427376010fdf872de1ccaef9ef92d6c204915df6071b36783cd5af28827bd0ee0ed211235a1bbaacbb3527beb46f4
SSDEEP 192:sxR0ROyM/jK1Ml8wC6/fnsGDapioMyzoA8p9Be/g6+WNCB0FZ/YPBWdllGxOEIg3:sxR0486/fnsGeUn/Te/5G8Z/CMwOo3
TLSH
T14A62D9166A34997B8CDBD20DFA557B53D6F81573E2901E44AAFCCA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e846159dca3cbeb53dd19f67feaff6c70b5d52142a6136175b1fd3771c32eaeb
MD5 fef8023920a8672cb8c029f611e1e756
SHA1 e9cf2d60e096009065a30ae674e19e5a71edce91
SHA512 8ddac9ba27c5f0074eee1d30562455448e0b481440100cf3bd5fce39cabe724721ba9e7d241b1e13025f80eed3ea4e1c945951fe8676f4c75679d8665c89efbf
SSDEEP 192:sxRLROyM/jK1Ml8wC6/fns3DapioMyzoA8p9Be/g6+WNCB0FZ/YPBWdllGxOEIgb:sxRL486/fns3eUn/Te/5G8Z/CMwOob
TLSH
T13262D916AA34997B8CDBD20DFA557B53D6F81573E2901E44AAFCCA0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e287662afb0b06f08d648999a19e4b851cef6a559fe4aa6883317dba12c5a2ed
MD5 6ba7ed527432613da9a98e0725dc89fd
SHA1 c23ceb36cb0306b576d52a3c77a44eff6ee6098e
SHA512 31fa607f4aef8a22fb00ac848dff796c5ab351b9d29d41db81156f119b599632f7035520328953f8662d052a66be81408edc93d61ef28c2a00289020a272dbde
SSDEEP 192:sxRLROyM/jK1Ml8UQ4C6/fns3D1+ZfE2zoA8prBe/g6+WNCB0FZ/YPB9dllGxOE1:sxRL4q/6/fns3x4fwle/5G8Z/C3wOo1
TLSH
T15362D816AA24997B8CDBD20EFA517F53D2F85577D2901E44AAFCCA0C01E76DD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c318c26f05fd2991790c7b5d14cb1d58cda0c664efcc9421f0ce3f87be13d2a4
MD5 d278575f1438e6c74923329799a902df
SHA1 e94433f1d845fdb417ea3999228ace1099e0b099
SHA512 292fed994e0fb33ae24f676fa338dc570d9e0f79d9e1840744424bdfa1928f8dfc12286c48712565678985b40acd6b97cdac9a44a8a881c1ab9bf02d1c2f0a73
SSDEEP 768:5+McBM7pLuL7MpWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNLfj/e2roVXJy:5+McBwE7MpWgFZfslu1jaKLfTeNVXJy
TLSH
T128E2EC3B680CCB7F4F804A9DEC29799A6DD801CF9698C95447FA880C03C66EB561B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c7ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c7ab.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 41cbf971b91bf7a1164746063d2d11b2cd9047cf5dd6df0e15c2c12025ffe9c5
MD5 dd2ab2b512dfc35d6af290c80fef7b16
SHA1 c5ff032fc297a9251278b5995e61947098f28f14
SHA512 944e89bf6a79858f808fd2894b1c76e5930b153c138e9e0c37c87d576f9366b7d89fbf14ad20cce0d507867fb19f44a0f16ce7454bb9c8935cc86182412e8f54
SSDEEP 768:O+F1j+9U3+wginWz9if5RDL5WFbxsz56f0+ynobVMj1Z:O79U3JVfTDL5WkQ5R4Z
TLSH
T14E1328F698D38976DDAE8787A77E2E469DBCC1A3B5840984B7D85D0CCC861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e23efd111d977852c04ed1308078cbce87cf4ab45e166564acf69392d03a70cd
MD5 8cc6cd45f71abe6e8af238864ab180ed
SHA1 4f2c2efac5090137b2d5b71e99dc0327e3354cb4
SHA512 2f41b530301366620acbbb0b7edc775366ef387b7e694ceebbc85c052e22b395f82702ab34206a2a8212399cc19e43b466f67d3ad88850f25ab96798f3788e1b
SSDEEP 768:Dirv+4UNbdl3nv9AJGkMf5Rw5WFbxsz56f0+ynobqUixK:Dibsbr3v9fTw5WkQ5GUX
TLSH
T17D03C036E86898778EE3D685B28B76477FB81163D6C10F94C5ED3B0C469B49D2307863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5dc05bc78fd25fd361361bb5277f98eba641a67a390f75b60f70c025d28c27e5
MD5 0ce4e204b5befebca11d2f43bf98793a
SHA1 1e6ed56d857eea7531bf45527ea3ed6380ddf2bb
SHA512 657d0b15e474debf3a18c2bc8f53fd884d84e5d2c4122875abbfb162965bf6cf1942b5696ccbce17c3fe5cb30c4928a92f57bef74b97bc3e5719926dfa5ee773
SSDEEP 768:WYrv+4UNbdW3unWucJGkMf5RDh5WFbxsz56f0+ynobVMj1p:WYbsbI3+PfTDh5WkQ5R4p
TLSH
T1F313BF31B82998A35EF3D189F5573687BEB415A3C9C00E94D9E96B0C45CB5DD230BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3811bba49b14ebdb6613c07a05b24d21e2f66f367d1d4e5ceb6124141a8c3bc1
MD5 f9a1cc583d72008a83cd37d29b9247db
SHA1 36ebd597bb0acb1aab428cd203d40902ddc1271b
SHA512 95b5a721ca612fa959b318d189279ba6c91723f8f1e58d49d78d0d1b31a508f8b0c59b43dbb626a22ffe20b7b491e2ada7f46906ebd1c0fe9143ae855c3bd2fa
SSDEEP 768:Whj+903unWvcJGkMf5RDb5WFbxsz56f0+ynobVMj1Z:W8903+8fTDb5WkQ5R4Z
TLSH
T1BDF2BE35BC665CA35EE2C68AF657378AEEB415B3C5C00E88D9ED6F0C05C769D1317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

c164fd6d-0802-4c28-a042-a779039075c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c164fd6d-0802-4c28-a042-a779039075c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5172_456784963\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 cf82c7240a1496cc682438875fab96c632b48fb7b1beb51536161a1e83b655a9
MD5 26d37c48072cf509d203d0e6a25129e3
SHA1 7f90f2e451072c0c43638d1920a04abbe1070416
SHA512 c6383a245b5f024c33cb3b8020b9d512bafc83b30f9ad89239e1a1e93fd6751800b4a6b729c1ef76003b81ff4f9b5f6534b2227d032c027cb95efd03df87df86
TLSH
T15971E78357A9C9B3C2DB5BF502835644F5FB223C4B7370240B5655C6AB70A7A54B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/480-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1388-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1700-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1844-239-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2460-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3028-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3496-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4036-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4180-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4668-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5148-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5148-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6016-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download