systex | ef3521517228e70061f5807706a03631dbcc880f97e2e3eb575004e7f9603d3e

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260708-xdpkpsfs2k
SHA256 ef3521517228e70061f5807706a03631dbcc880f97e2e3eb575004e7f9603d3e
MD5 0999c3336e52b90751eb07cb530f06b4
SHA1 23e425d37f6c2f221984e462c4cd810cee4915d0
SHA512 8cd47ebb6adb9806d6263b56488725c6ce20785d40393e3548dd8619945758ce5ea29ecf53bf546c120fd7a0f6613e693fc94cf05f7710455f0caf5fe1c1fdc4
SSDEEP 3072:cmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:cmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2584	uomgezwrojhbzurm.exe
4776	CreateProcess.exe
4884	uomgezwrojhbzurm.sys
616	uomgezwuom.exe
5900	CreateProcess.exe
4264	CreateProcess.exe
3220	i_uomgezwuom.exe
1312	tomjezwroj.sys
4744	CreateProcess.exe
4148	jeuomgeyto.exe
6028	CreateProcess.exe
2724	CreateProcess.exe
1528	i_jeuomgeyto.exe
1704	trljdbytqo.sys
3412	CreateProcess.exe
5268	olgeytrljd.exe
928	CreateProcess.exe
4352	CreateProcess.exe
2700	i_olgeytrljd.exe
4296	vtolgdywqo.sys
5640	CreateProcess.exe
3328	lfdvtnljga.exe
1352	CreateProcess.exe
2644	CreateProcess.exe
4600	i_lfdvtnljga.exe
5492	nifdxvqnig.sys
3264	CreateProcess.exe
2364	aysqkidavt.exe
4980	CreateProcess.exe
5712	CreateProcess.exe
4512	i_aysqkidavt.exe
2868	nlfdxvpnlf.sys
6076	CreateProcess.exe
5868	xvpnhfdxvq.exe
1184	CreateProcess.exe
2432	CreateProcess.exe
3060	i_xvpnhfdxvq.exe
3428	nkfcxvpnhf.sys
5552	CreateProcess.exe
1488	fdxvpfcxup.exe
4844	CreateProcess.exe
2180	CreateProcess.exe
4380	i_fdxvpfcxup.exe
5612	kecwupmhfz.sys
6100	CreateProcess.exe
2764	wusmkhcaus.exe
1480	CreateProcess.exe
992	CreateProcess.exe
3068	i_wusmkhcaus.exe
3144	kecwurmkec.sys
2112	CreateProcess.exe
5608	bztrpjhbzt.exe
3236	CreateProcess.exe
5952	CreateProcess.exe
2836	i_bztrpjhbzt.exe
708	jhbztrljeb.sys
4944	CreateProcess.exe
5320	ywrojhbztr.exe
3548	CreateProcess.exe
5084	CreateProcess.exe
5828	i_ywrojhbztr.exe
1668	trljdbwtom.sys
1436	CreateProcess.exe
2016	dywqoigayt.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_891833404\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1585682293\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1542551746\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1542551746\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1585682293\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1585682293\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1585682293\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_220274734\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_891833404\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeuomgeyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdvtnljga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xukecwurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeuomgeyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqolgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xukecwurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomkecwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdvtnljga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrojhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomkecwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqolgdbv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1216	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3396	ipconfig.exe
5844	ipconfig.exe
1984	ipconfig.exe
3220	ipconfig.exe
4612	ipconfig.exe
1884	ipconfig.exe
2016	ipconfig.exe
3640	ipconfig.exe
5000	ipconfig.exe
5044	ipconfig.exe
4616	ipconfig.exe
2920	ipconfig.exe
2076	ipconfig.exe
1736	ipconfig.exe
3164	ipconfig.exe
940	ipconfig.exe
1808	ipconfig.exe
5016	ipconfig.exe
5416	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280098783224401"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{38B55AC4-9C88-4A15-888A-3AF5A210ACA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe
2584	uomgezwrojhbzurm.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	i_uomgezwuom.exe
Token: SeDebugPrivilege	1528	i_jeuomgeyto.exe
Token: SeDebugPrivilege	2700	i_olgeytrljd.exe
Token: SeDebugPrivilege	4600	i_lfdvtnljga.exe
Token: SeDebugPrivilege	4512	i_aysqkidavt.exe
Token: SeDebugPrivilege	3060	i_xvpnhfdxvq.exe
Token: SeDebugPrivilege	4380	i_fdxvpfcxup.exe
Token: SeDebugPrivilege	3068	i_wusmkhcaus.exe
Token: SeDebugPrivilege	2836	i_bztrpjhbzt.exe
Token: SeDebugPrivilege	5828	i_ywrojhbztr.exe
Token: SeDebugPrivilege	2864	i_dywqoigayt.exe
Token: SeDebugPrivilege	5912	i_dywqolgdbv.exe
Token: SeDebugPrivilege	3768	i_tqlidbvtnl.exe
Token: SeDebugPrivilege	4056	i_kicausnkfc.exe
Token: SeDebugPrivilege	2352	i_smkfcxupnh.exe
Token: SeDebugPrivilege	5920	i_xukecwurpm.exe
Token: SeDebugPrivilege	3788	i_uomkecwrpm.exe
Token: SeDebugPrivilege	4576	i_rojhbztrlj.exe
Token: SeDebugPrivilege	3544	i_oljdbywtol.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2584	3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 3492 wrote to memory of 2660	3492	2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2660 wrote to memory of 1348	2660	iexplore.exe	90
PID 1348 wrote to memory of 5136	1348	msedge.exe	91
PID 1348 wrote to memory of 4052	1348	msedge.exe	93
PID 1348 wrote to memory of 1216	1348	msedge.exe	92
PID 1348 wrote to memory of 4052	1348	msedge.exe	93
PID 1348 wrote to memory of 4052	1348	msedge.exe	93
PID 1348 wrote to memory of 2888	1348	msedge.exe	94
PID 1348 wrote to memory of 2888	1348	msedge.exe	94
PID 1348 wrote to memory of 2184	1348	msedge.exe	97
PID 1348 wrote to memory of 4604	1348	msedge.exe	96
PID 1348 wrote to memory of 2184	1348	msedge.exe	97
PID 1348 wrote to memory of 2184	1348	msedge.exe	97
PID 1348 wrote to memory of 4604	1348	msedge.exe	96
PID 1348 wrote to memory of 4604	1348	msedge.exe	96
PID 1348 wrote to memory of 6096	1348	msedge.exe	98
PID 1348 wrote to memory of 6096	1348	msedge.exe	98
PID 1348 wrote to memory of 6096	1348	msedge.exe	98
PID 1348 wrote to memory of 5932	1348	msedge.exe	99
PID 1348 wrote to memory of 5932	1348	msedge.exe	99
PID 1348 wrote to memory of 5932	1348	msedge.exe	99
PID 1348 wrote to memory of 4256	1348	msedge.exe	101
PID 1348 wrote to memory of 4256	1348	msedge.exe	101
PID 2584 wrote to memory of 4776	2584	uomgezwrojhbzurm.exe	103
PID 616 wrote to memory of 5900	616	uomgezwuom.exe	107
PID 1348 wrote to memory of 1192	1348	msedge.exe	110
PID 1348 wrote to memory of 2532	1348	msedge.exe	111
PID 1348 wrote to memory of 1192	1348	msedge.exe	110
PID 1348 wrote to memory of 2532	1348	msedge.exe	111
PID 1348 wrote to memory of 2964	1348	msedge.exe	113
PID 1348 wrote to memory of 2332	1348	msedge.exe	114
PID 1348 wrote to memory of 2332	1348	msedge.exe	114
PID 1348 wrote to memory of 5076	1348	msedge.exe	117
PID 1348 wrote to memory of 5076	1348	msedge.exe	117
PID 2584 wrote to memory of 4264	2584	uomgezwrojhbzurm.exe	118
PID 2584 wrote to memory of 4744	2584	uomgezwrojhbzurm.exe	122
PID 4148 wrote to memory of 6028	4148	jeuomgeyto.exe	124
PID 2584 wrote to memory of 2724	2584	uomgezwrojhbzurm.exe	127
PID 2584 wrote to memory of 3412	2584	uomgezwrojhbzurm.exe	131
PID 5268 wrote to memory of 928	5268	olgeytrljd.exe	133
PID 2584 wrote to memory of 4352	2584	uomgezwrojhbzurm.exe	136
PID 1348 wrote to memory of 3820	1348	msedge.exe	140
PID 1348 wrote to memory of 3820	1348	msedge.exe	140
PID 1348 wrote to memory of 3820	1348	msedge.exe	140
PID 1348 wrote to memory of 3764	1348	msedge.exe	142
PID 1348 wrote to memory of 3764	1348	msedge.exe	142
PID 1348 wrote to memory of 3764	1348	msedge.exe	142
PID 2584 wrote to memory of 5640	2584	uomgezwrojhbzurm.exe	143
PID 3328 wrote to memory of 1352	3328	lfdvtnljga.exe	145
PID 2584 wrote to memory of 2644	2584	uomgezwrojhbzurm.exe	148
PID 1348 wrote to memory of 3508	1348	msedge.exe	150
PID 1348 wrote to memory of 3220	1348	msedge.exe	151
PID 1348 wrote to memory of 712	1348	msedge.exe	152
PID 2584 wrote to memory of 3264	2584	uomgezwrojhbzurm.exe	155
PID 2364 wrote to memory of 4980	2364	aysqkidavt.exe	157
PID 2584 wrote to memory of 5712	2584	uomgezwrojhbzurm.exe	160
PID 2584 wrote to memory of 6076	2584	uomgezwrojhbzurm.exe	164
PID 5868 wrote to memory of 1184	5868	xvpnhfdxvq.exe	166
PID 2584 wrote to memory of 2432	2584	uomgezwrojhbzurm.exe	169
PID 2584 wrote to memory of 5552	2584	uomgezwrojhbzurm.exe	173
PID 1488 wrote to memory of 4844	1488	fdxvpfcxup.exe	175
PID 2584 wrote to memory of 2180	2584	uomgezwrojhbzurm.exe	178
PID 1348 wrote to memory of 1760	1348	msedge.exe	180

C:\Users\Admin\AppData\Local\Temp\2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_0999c3336e52b90751eb07cb530f06b4_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Temp\uomgezwrojhbzurm.exe
  C:\Temp\uomgezwrojhbzurm.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\Temp\uomgezwuom.exe
      C:\Temp\uomgezwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\i_uomgezwuom.exe
      C:\Temp\i_uomgezwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jeuomgeyto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4744
  - - C:\Temp\jeuomgeyto.exe
      C:\Temp\jeuomgeyto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jeuomgeyto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2724
  - - C:\Temp\i_jeuomgeyto.exe
      C:\Temp\i_jeuomgeyto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\olgeytrljd.exe
      C:\Temp\olgeytrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4352
  - - C:\Temp\i_olgeytrljd.exe
      C:\Temp\i_olgeytrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdvtnljga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\lfdvtnljga.exe
      C:\Temp\lfdvtnljga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdvtnljga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\i_lfdvtnljga.exe
      C:\Temp\i_lfdvtnljga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3264
  - - C:\Temp\aysqkidavt.exe
      C:\Temp\aysqkidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5712
  - - C:\Temp\i_aysqkidavt.exe
      C:\Temp\i_aysqkidavt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Temp\xvpnhfdxvq.exe
      C:\Temp\xvpnhfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\i_xvpnhfdxvq.exe
      C:\Temp\i_xvpnhfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5552
  - - C:\Temp\fdxvpfcxup.exe
      C:\Temp\fdxvpfcxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Temp\i_fdxvpfcxup.exe
      C:\Temp\i_fdxvpfcxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wusmkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\wusmkhcaus.exe
      C:\Temp\wusmkhcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wusmkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:992
  - - C:\Temp\i_wusmkhcaus.exe
      C:\Temp\i_wusmkhcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2112
  - - C:\Temp\bztrpjhbzt.exe
      C:\Temp\bztrpjhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\i_bztrpjhbzt.exe
      C:\Temp\i_bztrpjhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\ywrojhbztr.exe
      C:\Temp\ywrojhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Temp\i_ywrojhbztr.exe
      C:\Temp\i_ywrojhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1436
  - - C:\Temp\dywqoigayt.exe
      C:\Temp\dywqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    PID:2656
  - - C:\Temp\i_dywqoigayt.exe
      C:\Temp\i_dywqoigayt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqolgdbv.exe ups_run
    3⤵
    PID:1420
  - - C:\Temp\dywqolgdbv.exe
      C:\Temp\dywqolgdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqolgdbv.exe ups_ins
    3⤵
    PID:6020
  - - C:\Temp\i_dywqolgdbv.exe
      C:\Temp\i_dywqolgdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidbvtnl.exe ups_run
    3⤵
    PID:1808
  - - C:\Temp\tqlidbvtnl.exe
      C:\Temp\tqlidbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidbvtnl.exe ups_ins
    3⤵
    PID:3392
  - - C:\Temp\i_tqlidbvtnl.exe
      C:\Temp\i_tqlidbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run
    3⤵
    PID:2864
  - - C:\Temp\kicausnkfc.exe
      C:\Temp\kicausnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    PID:4372
  - - C:\Temp\i_kicausnkfc.exe
      C:\Temp\i_kicausnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcxupnh.exe ups_run
    3⤵
    PID:4184
  - - C:\Temp\smkfcxupnh.exe
      C:\Temp\smkfcxupnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcxupnh.exe ups_ins
    3⤵
    PID:5060
  - - C:\Temp\i_smkfcxupnh.exe
      C:\Temp\i_smkfcxupnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xukecwurpm.exe ups_run
    3⤵
    PID:4912
  - - C:\Temp\xukecwurpm.exe
      C:\Temp\xukecwurpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xukecwurpm.exe ups_ins
    3⤵
    PID:2528
  - - C:\Temp\i_xukecwurpm.exe
      C:\Temp\i_xukecwurpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomkecwrpm.exe ups_run
    3⤵
    PID:4584
  - - C:\Temp\uomkecwrpm.exe
      C:\Temp\uomkecwrpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomkecwrpm.exe ups_ins
    3⤵
    PID:972
  - - C:\Temp\i_uomkecwrpm.exe
      C:\Temp\i_uomkecwrpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    PID:3724
  - - C:\Temp\rojhbztrlj.exe
      C:\Temp\rojhbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    PID:2968
  - - C:\Temp\i_rojhbztrlj.exe
      C:\Temp\i_rojhbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbywtol.exe ups_run
    3⤵
    PID:2128
  - - C:\Temp\oljdbywtol.exe
      C:\Temp\oljdbywtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbywtol.exe ups_ins
    3⤵
    PID:5480
  - - C:\Temp\i_oljdbywtol.exe
      C:\Temp\i_oljdbywtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8257ac188,0x7ff8257ac194,0x7ff8257ac1a0
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2477047007874247832,15759271803499990071,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:11
      4⤵
      System Time Discovery
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,10704308990395281776,4532701816547697404,262144 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:2
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,3949498564329586673,4562551537273441579,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,12515934280217838664,17060175615801558589,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,790496082921012819,5635994133237407891,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,5400167998484571834,6570975458753019648,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,1061999776735619978,16007035781304831923,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,4228473584497987998,15799431810921728328,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,7787573882072592585,616763578590137276,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,9274348643994266590,6190553617809031594,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,10183495419637343823,8003082547298025018,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,10183495419637343823,8003082547298025018,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16043690158229477064,17244970749951057750,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,17760362219036525184,17221370106044507592,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4904,i,6370131668012621127,13387293333164284346,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3692,i,15628039006485343351,199954123145298984,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,6081650121062967074,18125576651206290758,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12641016948922100156,13366875161121466367,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,18231660292316892070,4659567257509277191,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6396,i,4334416522307472272,18154556642007824289,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,419642777451983187,9817693647589806670,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17582116351065177892,6915344177103162520,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3692,i,8717561666903600110,12340361917061852551,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,17578654850578946630,1219239762000184582,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6816,i,16845228868685913486,9378227931812097456,2097152 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,18136231149956915783,13372663498123460312,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:14
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,6791577790019796143,14860116774716831776,262144 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:10
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,14390056118459704906,9017360427852543682,524288 --field-trial-handle=2764,i,14927861997989599073,9504699720959076301,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1960

C:\Temp\uomgezwrojhbzurm.sys
C:\Temp\uomgezwrojhbzurm.sys
1⤵
- Executes dropped EXE
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3112

C:\Temp\tomjezwroj.sys
C:\Temp\tomjezwroj.sys
1⤵
- Executes dropped EXE
PID:1312

C:\Temp\trljdbytqo.sys
C:\Temp\trljdbytqo.sys
1⤵
- Executes dropped EXE
PID:1704

C:\Temp\vtolgdywqo.sys
C:\Temp\vtolgdywqo.sys
1⤵
- Executes dropped EXE
PID:4296

C:\Temp\nifdxvqnig.sys
C:\Temp\nifdxvqnig.sys
1⤵
- Executes dropped EXE
PID:5492

C:\Temp\nlfdxvpnlf.sys
C:\Temp\nlfdxvpnlf.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\kecwupmhfz.sys
C:\Temp\kecwupmhfz.sys
1⤵
- Executes dropped EXE
PID:5612

C:\Temp\kecwurmkec.sys
C:\Temp\kecwurmkec.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:708

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:1668

C:\Temp\qljdbvtolg.sys
C:\Temp\qljdbvtolg.sys
1⤵
PID:1888

C:\Temp\nlfdyvqnig.sys
C:\Temp\nlfdyvqnig.sys
1⤵
PID:4380

C:\Temp\kicausqkif.sys
C:\Temp\kicausqkif.sys
1⤵
PID:3520

C:\Temp\icsnkhcaus.sys
C:\Temp\icsnkhcaus.sys
1⤵
PID:2188

C:\Temp\xupnhfcxus.sys
C:\Temp\xupnhfcxus.sys
1⤵
PID:4520

C:\Temp\rpmhecwurm.sys
C:\Temp\rpmhecwurm.sys
1⤵
PID:1368

C:\Temp\trmjebwuom.sys
C:\Temp\trmjebwuom.sys
1⤵
PID:3288

C:\Temp\wrojgbyomg.sys
C:\Temp\wrojgbyomg.sys
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkidavt.exe

Path C:\Temp\aysqkidavt.exe
Size 384KB
SHA256 a91136606da2f3137d8f1f75c8b2a8154237cb454fa49a9d74dd89a8893c0a47
MD5 26980f73531741aea83850ffe4a2c1df
SHA1 029a0fbe97f24842010c93d8273efcf79c8e9b59
SHA512 701e928a70ba8431b506b584e85b7d46cefe828f0e8cbfff6fe8e7735fe220fdf5611681ebb0420f4d941386b4550dd7e07a85597b216481bc7f596ceab5ee9e
SSDEEP 3072:JmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:JmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11F847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkidavt.exe

Path C:\Temp\i_aysqkidavt.exe
Size 384KB
SHA256 bb1ad41f1b7ee377cfcc773b9d683d95ab4261eb2433ee1134561bf7b1c42562
MD5 fcb6d5174e444c51f06d4887441429f1
SHA1 1ccd69bfc010b98e26c8e741514f884f7613fbb5
SHA512 35cc37c464e58d12cc6cac2af83f1031c4b6b4843a0706b45d33986318471f7994b4fd1eb2174662634b2bc7b9ee6df05a5297e0257e30b6f42e7379a1ed7d1f
SSDEEP 3072:ymtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ymtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jeuomgeyto.exe

Path C:\Temp\i_jeuomgeyto.exe
Size 384KB
SHA256 3fe35ddaf6fc3285aa96d9435c94aae0b21bf808b5b3a190ad86d9dcf101b0db
MD5 a73f41ded8d603948d479d88c8924b24
SHA1 e8f7369b014ff47a7da4a2a58f72ee184827326c
SHA512 bca1e42cfd5d7a9120e75b3571507b136cd4affa1744b6d0933c42b46ca109e4e54f6f8b9607afb7847a7a708816c85f66ee887fd5c75b7a8ca60819c64f8261
SSDEEP 3072:MmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:MmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdvtnljga.exe

Path C:\Temp\i_lfdvtnljga.exe
Size 384KB
SHA256 ea130a5978daf612ce0bea1b1a44bc15f74fb5b6d824ffa71a73b89c91979acb
MD5 042b6c8d806e3e38dea442e422d68433
SHA1 cf19552f8ba0f7c2add7885866d12b618f46ef23
SHA512 1611c2f118162320d2c1b62817e8fb970ffe7c62e53243d96e57a6599160f0cbb347e5a6dc50245f8426e368a32eff70fd4d31520d22700f8db97fb41be78341
SSDEEP 3072:umtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:umtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeytrljd.exe

Path C:\Temp\i_olgeytrljd.exe
Size 384KB
SHA256 51aebbd4b5eeba3700be3d898c69bfc2bb988a69cf9b856e92e7f7b7e1212a93
MD5 2466b8e573a20d85b58b2f785501d190
SHA1 b856ebb9139eb1b77ffae899d817324f5a57984d
SHA512 e0a3d11b825f813e1b19d333efb3158e1bf5cceeb6a0a8e35b008a0fd519ff7a701fc210620d30a99ef40508e7d1aca7525bffad4ee78f1fcc3e33940499b8e0
SSDEEP 3072:imtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:imtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgezwuom.exe

Path C:\Temp\i_uomgezwuom.exe
Size 384KB
SHA256 e9e86b1f2d63e0da88a79a018e2acbce54ed77a2c47f36b22e38804c3b3ffb7d
MD5 25a40061c9b2c798ddda1cdc113272fb
SHA1 acc8cad0998adcecd63070d77e17edf8f99137fa
SHA512 dc767beb322dee28ae6e58a7b50caf69a902b88382ada9f959d43a4660afdfd68921e3cc9517960b54ac2abf5773cee34bb2d0d5c8ceb77db1f97c7a07ae5ad6
SSDEEP 3072:SmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:SmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeuomgeyto.exe

Path C:\Temp\jeuomgeyto.exe
Size 384KB
SHA256 fedd91a1a10b8e4280bcaa6e765c3c5612cbef8d301ff177c7b104acf3075427
MD5 d208e4c1f333aad325346e4a4dc28d18
SHA1 b1ae02fbd215b8da18be1a9ddc62fd0aeefae175
SHA512 406ce6f55bdbb19f0139a5ee6f326ad4935cac93ed17d8b521edd52afd02f487e2cad5778c341bb9d5e9074f49b999cbd55e4ea3377b156b2f2ee256bcfaed02
SSDEEP 3072:qmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:qmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdvtnljga.exe

Path C:\Temp\lfdvtnljga.exe
Size 384KB
SHA256 d37239496012f77cd48e57fe7eb7add894568e1027af01ef186fbf3ed3f70f0e
MD5 5bec282ca00cdc731d31308ef1a77bc1
SHA1 90c3ab713b714f8142897c3561ab18a1321e1b0a
SHA512 2e954f1c35f5e565b2be7dbc070fd227172861fb2246d114215c36397aede8650a09ab43cfad42a6d56a0c05bff5bcc2b2d8921b4a36d0a085922cae67b3c9ff
SSDEEP 3072:M0mtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pT:PmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvqnig.sys

Path C:\Temp\nifdxvqnig.sys
Size 293KB
SHA256 0cd788cad34f21fe4f96db8ad278862866bcac2c232668ad99680e98eb57300b
MD5 ba8c36ec91ca31eac95f18ca2c6aefa3
SHA1 1f11ff77dee507db5ba5f7064a1ab2d3f03076b8
SHA512 bb60b3acad3c5d8deb75451d83ca084e3337920abed2f10da14d39d013655aca6c0b7ab4cb5131c98773131b84f50615a2a88f1f80c85c29018ac8e6eea14218
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvpnlf.sys

Path C:\Temp\nlfdxvpnlf.sys
Size 293KB
SHA256 fbc594d99706b64ef073ac4feae2ccfd4332d35a5d6d220e422ad9f2636ce12e
MD5 3d548dbf63cf0d13e5f9c6e965989663
SHA1 63e12c09a750518db47abb25a411240a6ff34de0
SHA512 85737e2acc82c82c1783f528c8a32dc9d11e4ae6084d8b1ee691d141d4c7e279c0e4abcbba993bb8f2762e790bc932f1baff90bf88cfeb4fed9654918b63be7e
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeytrljd.exe

Path C:\Temp\olgeytrljd.exe
Size 384KB
SHA256 c3f54d07f42b52cb8dd6ba35ef72a200ef501c19b51ea935e8bdfccdec5a5454
MD5 07e016c749cd4c4094e6c156f5b73397
SHA1 de4e06a1f962d655d1a963c778a1b92fe0a8e211
SHA512 5fd11e20fdfa81b979ed84f575bfce736fb4d70c7184209a10540a0b29ee57b743679e4480bce28fc0f9f76e3cd5abf5a1349b6f02a763a7007d7648bc92df3a
SSDEEP 3072:XmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:XmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomjezwroj.sys

Path C:\Temp\tomjezwroj.sys
Size 293KB
SHA256 bc364a864ec4454e2d0a8bf24b3723caee260159cdfca27ec60ad5738b280629
MD5 a818ff3459aee8a37479e7c575f135c5
SHA1 6261d462db51ac447894aefa21084472a240baa0
SHA512 f287010abcefb262c6dd9eb64a0d8ec2dd66aea8338c3fb07d701a9f7ce3d5d8f1a7eabb2469bcb52fae8f6648fe9845e8ccf59f3c42b73158726637e3dd9b91
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Edw:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbytqo.sys

Path C:\Temp\trljdbytqo.sys
Size 293KB
SHA256 2bab398abae3ef871109aa676f45e48e79250e69d2a653f1702ec0fe20645650
MD5 2dfdc798c1e4b7a564643f3c2b506c5d
SHA1 a2c016960cfbbb0dea812c0068925f3f0f1456df
SHA512 9a93495866e237d7f88d4bbdb9cc828a5c2d9ad04aec599bef925e79a4c2329f942f9a93a317ea3c6487afe1fc32885d0c7d8b9738b11d910ad389b247a2bb21
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrojhbzurm.exe

Path C:\Temp\uomgezwrojhbzurm.exe
Size 384KB
SHA256 92cda6a1e01b4213022fa3bbde691fb06c0a2f300a0f1c99a50f69f55ef3c49b
MD5 8bd6421400dc2a4b08dff3469967e1e1
SHA1 3cc4ea3de463920da0a8f139de2fbf06d3b607ee
SHA512 2fe6a0b760e0bfaeb580fda114502245c1ffdf7ff6014ecac897ae33cfa658cd9ce25b42bfa95291f13a9d1f8e83737827c202d79ee9fa159f7ad9902cff0cc3
SSDEEP 3072:smtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:smtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrojhbzurm.sys

Path C:\Temp\uomgezwrojhbzurm.sys
Size 293KB
SHA256 e865f9e5a9425456f3e21071e5ecbe452d0223d7ce1ce2fa9fe200d6a3333139
MD5 6eb9c2423fbfe23da61f729bbb26b53e
SHA1 d30bc9c1acf6a410a613b09c08f5d73c0c3a774f
SHA512 b5b27a648a3e5073aacad4fea3924bdd0f688b60c935107ede6a9f6ae49ae36ef7275f2f4c3068b665e49cc00815c571bc986e77c28bbf8c0ac0fd8186fbe0d4
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwuom.exe

Path C:\Temp\uomgezwuom.exe
Size 384KB
SHA256 c548f8a27f8f1b5caa0937a9916f2636ea1d96124b57562502937d09cef834c2
MD5 2b228ea3a94406ca1bf17b28d1ec6a43
SHA1 9855d43baa1810d7a12b1b53bfbab54d47ae3866
SHA512 a6af18ef6bb02bf3d61bc8c97dfa4c7d19b5c2d62f3aed63870e0eb9e007c9ba0a28c4c02bf54943891fb50a242c4fb2e03c03a4e5adb89694123b86501e47fa
SSDEEP 3072:kmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:kmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T16E847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgdywqo.sys

Path C:\Temp\vtolgdywqo.sys
Size 293KB
SHA256 6d0f93edeed2693fd2750cff659b03e31262403e1b8fb41f3196ee2420fd8365
MD5 3823de66283802ad73dd0b37efc21415
SHA1 2f249c6d54517a4da4e2ea6f97c3970128a3d510
SHA512 b4045c055412d4753ec4019a4dd19b7bce0be1e620e47936c81eb82092ff93c43cf1fd76eae1361eed23cdbb99e6142e2d321ae498ecbecc8134b6d957a3cd2a
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfdxvq.exe

Path C:\Temp\xvpnhfdxvq.exe
Size 384KB
SHA256 49796a9820a386539c1e08166d3d80d68ddb78791bfb85fc15c8b79e3ce26923
MD5 f95a873ae1ae7094acc8ad341524ad87
SHA1 1e116e90e21aadbdd9db0da678c0675511a3c24a
SHA512 8a5a2fe795efe6cb466b8ffb1560b9c5b521df9d92e5c7c4376f33b87053687706b61115a778e9d94fffa076459d92e2db975a38451354d33f7906e60a59dcf7
SSDEEP 3072:tmtNp3aM74yBtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:tmtD/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847B00BAA4F0B6C995043800DFAF36A6BE74281726CBC7F754CE5D99523C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78c1710471edefb2e28304a5afcd8c3f99db31962af7357c04c67e46bfb6dc66
MD5 e613436fa956472c0bf6dee9463e7c7c
SHA1 2e79bd7513b4d3d84550b4a8dd1e679c98f9c9ea
SHA512 790e6ad1c6c3264008a5f16ca9abb964d76681b2179ac9ad6f813264bbb812e2d3b80bad973e35a00b3d15036a89547cd509c668fa05b1fabfa51ff505d3dc80
TLSH
T19D610D5613B5DFD3C718ACB393DB9C8E373BD87E021F2E5004C1A4B41A66B44F8092A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5983cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5983cc.TMP
Size 3KB
SHA256 b5c66ddad37ef3b41ae7f2d039bfe0d6737220cff078824546accf3931df173e
MD5 1418ccf21f5dc345cec2aa1318e973c3
SHA1 d2f8799678460ba6f39439d3d5c85e10b5f8fc9f
SHA512 ea3739a5c047770c9f64404c1014323c553e888c4a60904fe2c2995c738987728e563fe13dc745bf90c54b459f88841d82d4ce3c48be3b43e46a3c7429fbf7b4
TLSH
T1BE610E5613B5DFD3D718ACB393DB9C9E373BD8BE011F2E5004C1A4B41A66B04F8092A1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fced66c81212a535a0a3b8933bdbbd798b579a36f53e3701a84c91653bbd2ce
MD5 4cfb65de6d03028430aacb9ccbeab041
SHA1 232515107a68477a976190212d41071501dbda89
SHA512 752b13f6bb472a62b431cbe64498e33528e069152f7ada1e2cf27de742dcb936d566db33a797e422873d449d0aa0c5a9fafd615ebc94826c76b429de95e48bab
TLSH
T13F41BEF3C3E4866DC91156F0AB18BE2FCE1D0915432C3D5AC9E4AE5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8a59bbbb684642bc5385ba1ec68a760851fa3d9b74b5fc5e9616ba0c1981faa5
MD5 08fff3b5b1201b5d1b0646b27d6b7b1d
SHA1 d10974b99f454398e08212115088b16cc5f088b7
SHA512 ab48f9da48a12f7ce65ae606a3dc0ca2786b45c6beb746bb556f664eb18afd6fec921887d1ca49048e1ef83e1fdde1a6681d24c411639674fd9471a92c0ddebc
SSDEEP 192:sxRJRLyM/jK1Ml8wCK/fDs0TiKZqY2zoA8pi/g6+WNIYnOtvWGcIgtJ:sxRJ/8K/fDs0mcqYri/5IXv+3
TLSH
T17652DB156A349977CCDBD21DFA557F93D6F81563A2901E44AAFCCA0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 db0b0038859fd370bebc218b0e9b288ada39225dc736321b843bc860a851f832
MD5 270665255e660671bf6a75df25b64c9b
SHA1 26272e8e737e0dc67d924896caa2fa5c08284f81
SHA512 99e5395df88659761bcde2c059eab85be7786bbb8b00cedad115136ebaeb0a8e3474188f73839c2ffc7843a80b7843042d175b5f1bcdcdd1d8a13c66e4894a00
SSDEEP 192:sxRaRLyM/jK1Ml8UQgCK/fDsn1TZKZqs2zoA8prL/g6+WNCIX/YnMtvWGcIgDfJ:sxRaZq3K/fDsn1tcqsrH/5J/7v+l
TLSH
T1B462EA16A6349977CCDBD20DF6557B93D6F85573A2901E44AAFC8B0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab014fc0735cbf51319dc404a266ba8215f36b0a058d5bd5fcf1ca0cc5b21616
MD5 6ac00d9beaa5080c9c1c2c89308d360e
SHA1 55bafa1ad1a87cb33cc8e628ede18ae23b812bcf
SHA512 585dd98ebfd816029bae8e7eaec0afafef01a16601afdd80861276578393b972579c106f94e3e51902701221231fd83c1bbad8a33f444d5a34e6ce8c8e5a0c18
SSDEEP 192:sxRaRLyM/jK1Ml8wCK/fDsn1TZKZqs2zoA8prL/g6+WNCIX/YnMtvWGcIgDfJ:sxRaZ8K/fDsn1tcqsrH/5J/7v+l
TLSH
T11E62DA16A6349977CCDBD20DFA557B93D6F85573A2901E44AAFC8B0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 abe56755a250b273f06b8e19dec885b3b57e84114209861ce0475374f379894c
MD5 372bee4dd5d7b40274713e7d2b6d0bcb
SHA1 5efc26dedeb82ac408ae5ecb09247ec482d376f9
SHA512 8a67a213e232317b9fde4691ca28754f05bbd384b43162266487576d4b720ed35abb7d609d4ccd7e297ace2a6e00d990f65608fb03ad25d2b091356c594f29c1
SSDEEP 192:sxRaRLyM/jK1Ml8wCK/fDsn1TiKZqY2zoA8pi/g6+WNIYnOtvWGcIgD9J:sxRa/8K/fDsn1mcqYri/5IXv+L
TLSH
T1E452EB15AA345977CCDBD21DFA457F93D6F85563A2901E44AAFC8B0C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7035718b760438ae59cf122a80e13d12246d39c0c196607002b7fac3d8b8d4c5
MD5 3264a43221f3ac8f2e0880bd9bd87f61
SHA1 97a63e5fc908dbb3ba04e43d5a3e86de4f5f330f
SHA512 4757332755a4489c765e42fa70cec6143a46490e20f268401823764efdfc7ffe78503c61457018bfc158f8dec0238afdf2d58c509196844e14c030524512efbb
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVG63XguFnroMc1i:Jl6hhQE7b2WgqcfHwu1jaN63QuF0McM
TLSH
T1CCE2EB3B680CCB7F4F804A9CEC29799A6DE801CB96D8CD5447FA894C03C66EB511A5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31010f4f-65a0-443b-be7b-183c859ffdd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\31010f4f-65a0-443b-be7b-183c859ffdd2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 96dd013ff7ba9778d98efb2d0bd112ce686e92b0508be5ed4acd67af995abda0
MD5 85cbef0f3d6a789784e60f8209dbf8c5
SHA1 727e0cf172f0e696a530d6cb67d4b01f90452bab
SHA512 9b9872491c497552b25d4bf8c3d0e7acedd3f7c5216dd2aca7d1562dddf068d43963baf90336745549fe6757885e252a812cd971a003120455eb3f4c5d9602fb
SSDEEP 768:Vrv+4UNbda3zKYreNSLf0X7DGFzoqPcNMCNZ3eVH1SkM:Vbsb43lpf03WkqPahEH1Y
TLSH
T12803BFB6ACA445374CE3C6C8B71B36076FF4126746840B94D8ED2F0E879F5AD130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8a4cb58c7e57c0813590e72349c52cfea109323b218cfcfd41cdd9cc5d384506
MD5 5737123bf9af7306b848c05ffff84fb6
SHA1 b7fa86b5a2f875a608959bf6b93725992edf289f
SHA512 c3951dd0ef78d5f84b850824c3d04251443615162b27971db5ff55c4f3aea921a598ed85fe6e9ecb980f3fe29c5996214d75a7e6f9d7570f771111cf56d62e73
SSDEEP 768:DF1j+94385wg9SDVfpfsmX7DGFzoqPcNMCNFaMjz:S9438l8fpfb3WkqPasA
TLSH
T14A038EB6DCA5C92B9CE3C7C5B716364ADFE002A389885DD4DAD95D4E01C72ED030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4b70b501e4eec7ddc8fea8293c6ed1b9d2d3c36d2bbee8cc865c6e238c31e96b
MD5 9897af77f9a70f2087b12c623430eebb
SHA1 20f83d69d347e38f1b6c4999c4e89d5c73498702
SHA512 2e17dd5e7a6163c975104017692f6856c6345fd708b8164ffec91a82bbe826088449e4571ec31906ef1b840e13962c21d1d58b04ccf7d8de94fd524c76f27bca
SSDEEP 768:+rv+4UNbdP38GdgYreNSLfpfs8X7DGFzoqPcNMCNFaMjy:+bsb538Gxpfpf73WkqPas9
TLSH
T1C413C0B1ACB889338CF7C184F61B3647BFB0116349850B54D9E96F4E468B1EE130BA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cb15e59f20da9f650598317c561972838f604ba912e3fba8fc6d1f4579301c02
MD5 b25acc77d4f680c46c540ced83ff27cd
SHA1 ae10110f15fb5ec8fc63974be91975b5897c335e
SHA512 50ed93d9c6b11ed396be1f938d227d5a9a1553ead6ea588a5d1dbb5c12f47487a29b1ea7debb3d6d40b096d7a853737b41bd3a001232902c95334cd99b573cf5
SSDEEP 768:7j+9V38HSgYreNSLfpfsHX7DGFzoqPcNMCNFaMjz:u9V38HspfpfK3WkqPasA
TLSH
T1E6F2B0B5ACA58C274CE6C1C8B71B379AEFE0127349851E54D9ED6F0F46C72AD030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3616002-e461-44ab-9182-634d2e6f94ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3616002-e461-44ab-9182-634d2e6f94ed.tmp
Size 35KB
SHA256 3fe51dbadf5153733a1a674eeca76cfe3d15be62f1a4cfc30543ae9552b0366a
MD5 59371edd186e55fb03d5872f1ed1269b
SHA1 bd85e224abeece3875073aebfaa840cc13af85b8
SHA512 5db393a6b59bfc341fe46a091fade13ef3154756c3c15f6a8a1f8eadf282b0b84bd03f607e90e518ae4466df0612acfa63321664dcd038b92619f5b0a4a3b9f4
SSDEEP 768:jj+9V38GSgYreNSLfpfsHX7DGFzoqPcNMCNFaMjz:m9V38GspfpfK3WkqPasA
TLSH
T1A5F2B0B5ACA58C274CE6C1C8B71B379ADFE0127349851E54D9ED6F0F46C72AD030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_629740430\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 fd8a45ee5b87218679ea06a9d17787bad66ce140a4a6ec13cfcee3b02f3da8a2
MD5 c9a1ae6b6770d482a2d6e8d9a87f676b
SHA1 748e8457614007473183b9bd510e13ea574a33d9
SHA512 74b546d064a958c7a8240ab0be1eae901ca4e69704e1bf92c5cc0310778934af887bfd6edf6fa5b1d10c99620d2030725a82bd16d577f1848aa095d9baf89e69
TLSH
T10B71239356B8D9F3C1DA5BF102836648F2FF2238072330650755554AAB30A7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1312-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1368-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1668-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1704-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1888-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1888-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2188-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3288-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3520-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4380-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4884-69-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5492-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5612-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download