systex | 6d653cd4d0cfd4d61c0391da6182152807499593341b9e0d22db35d23781e93d

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260817-2ssccsaq2z
SHA256 6d653cd4d0cfd4d61c0391da6182152807499593341b9e0d22db35d23781e93d
MD5 0e2f695716f39c721c785aa0dff3893d
SHA1 32736cd052e90f849b9ba3c36427a0477f73253e
SHA512 b634cf426b1bbce066e9302ca1fbb98e5feb5e76f1b60f4a218989a858815277ea6165cb1b6913d0c19e415d3b3cc0f2e13a17907a07e7e702799314d41d5bb5
SSDEEP 3072:JuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T101847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3104	wtomgbytrljdbwto.exe
4452	wtomgbytrljdbwto.sys
2504	CreateProcess.exe
5856	ywlgeyvqoj.exe
4540	CreateProcess.exe
2360	CreateProcess.exe
5524	i_ywlgeyvqoj.exe
5040	dbvtqligay.sys
5768	CreateProcess.exe
2904	ywqnigaysq.exe
4204	CreateProcess.exe
5384	CreateProcess.exe
1124	i_ywqnigaysq.exe
5144	nigaysqkid.sys
3420	CreateProcess.exe
2992	nifdxvpnif.exe
5028	CreateProcess.exe
4616	CreateProcess.exe
3000	i_nifdxvpnif.exe
6084	dxvsnkfdav.sys
4756	CreateProcess.exe
3236	zxspkhfdxv.exe
5432	CreateProcess.exe
888	CreateProcess.exe
5040	i_zxspkhfdxv.exe
4244	nhfaxsqkic.sys
2432	CreateProcess.exe
3180	ausmkecxup.exe
4188	CreateProcess.exe
5860	CreateProcess.exe
256	i_ausmkecxup.exe
4568	pmkeczusmj.sys
1396	CreateProcess.exe
4468	pjhfcausmk.exe
3304	CreateProcess.exe
2664	CreateProcess.exe
1792	i_pjhfcausmk.exe
1460	xrpjhbzurm.sys
6112	CreateProcess.exe
4368	wurmjeczur.exe
4220	CreateProcess.exe
2736	CreateProcess.exe
1988	i_wurmjeczur.exe
2404	ywqojgbztr.sys
3284	CreateProcess.exe
2020	wrojgeywro.exe
4936	CreateProcess.exe
5016	CreateProcess.exe
3652	i_wrojgeywro.exe
3500	eywtrojgey.sys
5440	CreateProcess.exe
1124	rljgbytrlj.exe
3296	CreateProcess.exe
3136	CreateProcess.exe
984	i_rljgbytrlj.exe
4336	gbytrlidbv.sys
1296	CreateProcess.exe
4092	ytqljdywqo.exe
1780	CreateProcess.exe
4988	CreateProcess.exe
2404	i_ytqljdywqo.exe
5008	tnlidbvtnl.sys
5040	CreateProcess.exe
1876	qkigaysqki.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_498166283\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_1194905542\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_498166283\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_774374202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_774374202\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_1194905542\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_1194905542\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_1194905542\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2860_1295456121\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgbytrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhfcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbztrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywlgeyvqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywlgeyvqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbztrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhfcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbvtoig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3520	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4468	ipconfig.exe
1988	ipconfig.exe
1740	ipconfig.exe
5296	ipconfig.exe
3652	ipconfig.exe
1808	ipconfig.exe
2992	ipconfig.exe
3256	ipconfig.exe
2288	ipconfig.exe
2620	ipconfig.exe
4288	ipconfig.exe
4860	ipconfig.exe
1504	ipconfig.exe
3772	ipconfig.exe
2772	ipconfig.exe
1680	ipconfig.exe
1756	ipconfig.exe
4652	ipconfig.exe
1856	ipconfig.exe
4956	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314806709364357"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{DAA857F4-1DB9-4245-A19E-6EEBA3132F9A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe
3104	wtomgbytrljdbwto.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5524	i_ywlgeyvqoj.exe
Token: SeDebugPrivilege	1124	i_ywqnigaysq.exe
Token: SeDebugPrivilege	3000	i_nifdxvpnif.exe
Token: SeDebugPrivilege	5040	i_zxspkhfdxv.exe
Token: SeDebugPrivilege	256	i_ausmkecxup.exe
Token: SeDebugPrivilege	1792	i_pjhfcausmk.exe
Token: SeDebugPrivilege	1988	i_wurmjeczur.exe
Token: SeDebugPrivilege	3652	i_wrojgeywro.exe
Token: SeDebugPrivilege	984	i_rljgbytrlj.exe
Token: SeDebugPrivilege	2404	i_ytqljdywqo.exe
Token: SeDebugPrivilege	2384	i_qkigaysqki.exe
Token: SeDebugPrivilege	2508	i_hfaxsqkica.exe
Token: SeDebugPrivilege	5524	i_fcxvpmkecx.exe
Token: SeDebugPrivilege	1560	i_rpjhfzxrpk.exe
Token: SeDebugPrivilege	1672	i_mkeczxrpjh.exe
Token: SeDebugPrivilege	6032	i_mgeywrojhb.exe
Token: SeDebugPrivilege	620	i_ljgbztrljg.exe
Token: SeDebugPrivilege	1984	i_olgdbvtoig.exe
Token: SeDebugPrivilege	3928	i_ysqlidbvtn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3104	2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 2936 wrote to memory of 5844	2936	2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5844 wrote to memory of 2860	5844	iexplore.exe	91
PID 2860 wrote to memory of 3844	2860	msedge.exe	92
PID 2860 wrote to memory of 3244	2860	msedge.exe	93
PID 2860 wrote to memory of 3520	2860	msedge.exe	94
PID 2860 wrote to memory of 3244	2860	msedge.exe	93
PID 2860 wrote to memory of 3244	2860	msedge.exe	93
PID 2860 wrote to memory of 4620	2860	msedge.exe	95
PID 2860 wrote to memory of 4620	2860	msedge.exe	95
PID 2860 wrote to memory of 2848	2860	msedge.exe	96
PID 2860 wrote to memory of 2848	2860	msedge.exe	96
PID 2860 wrote to memory of 4728	2860	msedge.exe	97
PID 2860 wrote to memory of 2848	2860	msedge.exe	96
PID 2860 wrote to memory of 4728	2860	msedge.exe	97
PID 2860 wrote to memory of 4728	2860	msedge.exe	97
PID 2860 wrote to memory of 5396	2860	msedge.exe	99
PID 2860 wrote to memory of 5472	2860	msedge.exe	100
PID 2860 wrote to memory of 5396	2860	msedge.exe	99
PID 2860 wrote to memory of 5396	2860	msedge.exe	99
PID 2860 wrote to memory of 5472	2860	msedge.exe	100
PID 2860 wrote to memory of 5472	2860	msedge.exe	100
PID 2860 wrote to memory of 1740	2860	msedge.exe	101
PID 2860 wrote to memory of 1740	2860	msedge.exe	101
PID 2860 wrote to memory of 1740	2860	msedge.exe	101
PID 2860 wrote to memory of 4296	2860	msedge.exe	104
PID 2860 wrote to memory of 4296	2860	msedge.exe	104
PID 2860 wrote to memory of 4296	2860	msedge.exe	104
PID 2860 wrote to memory of 1392	2860	msedge.exe	107
PID 2860 wrote to memory of 1748	2860	msedge.exe	106
PID 2860 wrote to memory of 1392	2860	msedge.exe	107
PID 2860 wrote to memory of 1748	2860	msedge.exe	106
PID 2860 wrote to memory of 5520	2860	msedge.exe	109
PID 3104 wrote to memory of 2504	3104	wtomgbytrljdbwto.exe	111
PID 2860 wrote to memory of 4568	2860	msedge.exe	114
PID 2860 wrote to memory of 4568	2860	msedge.exe	114
PID 5856 wrote to memory of 4540	5856	ywlgeyvqoj.exe	116
PID 2860 wrote to memory of 984	2860	msedge.exe	119
PID 2860 wrote to memory of 984	2860	msedge.exe	119
PID 2860 wrote to memory of 1472	2860	msedge.exe	120
PID 2860 wrote to memory of 1472	2860	msedge.exe	120
PID 3104 wrote to memory of 2360	3104	wtomgbytrljdbwto.exe	121
PID 2860 wrote to memory of 804	2860	msedge.exe	123
PID 2860 wrote to memory of 804	2860	msedge.exe	123
PID 2860 wrote to memory of 804	2860	msedge.exe	123
PID 3104 wrote to memory of 5768	3104	wtomgbytrljdbwto.exe	126
PID 2904 wrote to memory of 4204	2904	ywqnigaysq.exe	128
PID 3104 wrote to memory of 5384	3104	wtomgbytrljdbwto.exe	131
PID 3104 wrote to memory of 3420	3104	wtomgbytrljdbwto.exe	135
PID 2992 wrote to memory of 5028	2992	nifdxvpnif.exe	137
PID 3104 wrote to memory of 4616	3104	wtomgbytrljdbwto.exe	140
PID 3104 wrote to memory of 4756	3104	wtomgbytrljdbwto.exe	145
PID 3236 wrote to memory of 5432	3236	zxspkhfdxv.exe	147
PID 3104 wrote to memory of 888	3104	wtomgbytrljdbwto.exe	150
PID 2860 wrote to memory of 3652	2860	msedge.exe	152
PID 2860 wrote to memory of 4812	2860	msedge.exe	153
PID 2860 wrote to memory of 3516	2860	msedge.exe	154
PID 3104 wrote to memory of 2432	3104	wtomgbytrljdbwto.exe	157
PID 3180 wrote to memory of 4188	3180	ausmkecxup.exe	159
PID 3104 wrote to memory of 5860	3104	wtomgbytrljdbwto.exe	162
PID 3104 wrote to memory of 1396	3104	wtomgbytrljdbwto.exe	166
PID 4468 wrote to memory of 3304	4468	pjhfcausmk.exe	168
PID 3104 wrote to memory of 2664	3104	wtomgbytrljdbwto.exe	171
PID 3104 wrote to memory of 6112	3104	wtomgbytrljdbwto.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_0e2f695716f39c721c785aa0dff3893d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Temp\wtomgbytrljdbwto.exe
  C:\Temp\wtomgbytrljdbwto.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywlgeyvqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\Temp\ywlgeyvqoj.exe
      C:\Temp\ywlgeyvqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywlgeyvqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2360
  - - C:\Temp\i_ywlgeyvqoj.exe
      C:\Temp\i_ywlgeyvqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5768
  - - C:\Temp\ywqnigaysq.exe
      C:\Temp\ywqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\i_ywqnigaysq.exe
      C:\Temp\i_ywqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\nifdxvpnif.exe
      C:\Temp\nifdxvpnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4616
  - - C:\Temp\i_nifdxvpnif.exe
      C:\Temp\i_nifdxvpnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspkhfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4756
  - - C:\Temp\zxspkhfdxv.exe
      C:\Temp\zxspkhfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspkhfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:888
  - - C:\Temp\i_zxspkhfdxv.exe
      C:\Temp\i_zxspkhfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\ausmkecxup.exe
      C:\Temp\ausmkecxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5860
  - - C:\Temp\i_ausmkecxup.exe
      C:\Temp\i_ausmkecxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhfcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Temp\pjhfcausmk.exe
      C:\Temp\pjhfcausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhfcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\i_pjhfcausmk.exe
      C:\Temp\i_pjhfcausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjeczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\wurmjeczur.exe
      C:\Temp\wurmjeczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjeczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2736
  - - C:\Temp\i_wurmjeczur.exe
      C:\Temp\i_wurmjeczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3284
  - - C:\Temp\wrojgeywro.exe
      C:\Temp\wrojgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5016
  - - C:\Temp\i_wrojgeywro.exe
      C:\Temp\i_wrojgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljgbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5440
  - - C:\Temp\rljgbytrlj.exe
      C:\Temp\rljgbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljgbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3136
  - - C:\Temp\i_rljgbytrlj.exe
      C:\Temp\i_rljgbytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Temp\ytqljdywqo.exe
      C:\Temp\ytqljdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4988
  - - C:\Temp\i_ytqljdywqo.exe
      C:\Temp\i_ytqljdywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5040
  - - C:\Temp\qkigaysqki.exe
      C:\Temp\qkigaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigaysqki.exe ups_ins
    3⤵
    PID:2036
  - - C:\Temp\i_qkigaysqki.exe
      C:\Temp\i_qkigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run
    3⤵
    PID:5144
  - - C:\Temp\hfaxsqkica.exe
      C:\Temp\hfaxsqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins
    3⤵
    PID:5712
  - - C:\Temp\i_hfaxsqkica.exe
      C:\Temp\i_hfaxsqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvpmkecx.exe ups_run
    3⤵
    PID:1988
  - - C:\Temp\fcxvpmkecx.exe
      C:\Temp\fcxvpmkecx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvpmkecx.exe ups_ins
    3⤵
    PID:3504
  - - C:\Temp\i_fcxvpmkecx.exe
      C:\Temp\i_fcxvpmkecx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhfzxrpk.exe ups_run
    3⤵
    PID:544
  - - C:\Temp\rpjhfzxrpk.exe
      C:\Temp\rpjhfzxrpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhfzxrpk.exe ups_ins
    3⤵
    PID:4832
  - - C:\Temp\i_rpjhfzxrpk.exe
      C:\Temp\i_rpjhfzxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczxrpjh.exe ups_run
    3⤵
    PID:2716
  - - C:\Temp\mkeczxrpjh.exe
      C:\Temp\mkeczxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:52
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczxrpjh.exe ups_ins
    3⤵
    PID:4684
  - - C:\Temp\i_mkeczxrpjh.exe
      C:\Temp\i_mkeczxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    PID:4356
  - - C:\Temp\mgeywrojhb.exe
      C:\Temp\mgeywrojhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    PID:4724
  - - C:\Temp\i_mgeywrojhb.exe
      C:\Temp\i_mgeywrojhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbztrljg.exe ups_run
    3⤵
    PID:5152
  - - C:\Temp\ljgbztrljg.exe
      C:\Temp\ljgbztrljg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbztrljg.exe ups_ins
    3⤵
    PID:2668
  - - C:\Temp\i_ljgbztrljg.exe
      C:\Temp\i_ljgbztrljg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdbvtoig.exe ups_run
    3⤵
    PID:4896
  - - C:\Temp\olgdbvtoig.exe
      C:\Temp\olgdbvtoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdbvtoig.exe ups_ins
    3⤵
    PID:4480
  - - C:\Temp\i_olgdbvtoig.exe
      C:\Temp\i_olgdbvtoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidbvtn.exe ups_run
    3⤵
    PID:2100
  - - C:\Temp\ysqlidbvtn.exe
      C:\Temp\ysqlidbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidbvtn.exe ups_ins
    3⤵
    PID:1548
  - - C:\Temp\i_ysqlidbvtn.exe
      C:\Temp\i_ysqlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlfdaysq.exe ups_run
    3⤵
    PID:2988
  - - C:\Temp\vsnlfdaysq.exe
      C:\Temp\vsnlfdaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8e487c188,0x7ff8e487c194,0x7ff8e487c1a0
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,406876001197883376,4645847252498669001,262144 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8881657211507689508,11456378736785186058,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:11
      4⤵
      System Time Discovery
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,2639525465101969741,12756194463134310120,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,7527655080165780249,1412601211028743835,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,3001311607377746892,7821068484036533417,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,14430567456494432565,892324763295124020,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,13444703560485426315,13286659987558585312,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3688,i,13218081211004251014,8891683202871997820,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3808,i,10240584469913620817,5700069344100988389,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,8512114231909201192,16528644487177729712,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,3718015990547000399,13850680979019478268,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,17491671856766460851,3329635661893467362,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,17491671856766460851,3329635661893467362,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,16430949668834057825,5974700863741769624,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14095296829770081161,4846859127560071105,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,16774692736173631093,14677853397225288370,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6576,i,2318904511125113448,757214217802716312,2097152 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,14428960156609178507,3309379141368101700,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,12721765116826914870,7038742926546792949,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,13034582388397085094,16534907388830826719,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,6178709778580993535,2983585873357790725,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17086443664532668517,3197423068938146369,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,17620643344826509250,16837638559270961412,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4920496645506977917,12862853289027455048,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2028,i,2894067991035744168,4015386450705122004,262144 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:10
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14607791265074107747,948697856007252560,524288 --field-trial-handle=2288,i,2881385313050017439,15828103777600769947,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3692

C:\Temp\wtomgbytrljdbwto.sys
C:\Temp\wtomgbytrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5384

C:\Temp\dbvtqligay.sys
C:\Temp\dbvtqligay.sys
1⤵
- Executes dropped EXE
PID:5040

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
- Executes dropped EXE
PID:5144

C:\Temp\dxvsnkfdav.sys
C:\Temp\dxvsnkfdav.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
- Executes dropped EXE
PID:4244

C:\Temp\pmkeczusmj.sys
C:\Temp\pmkeczusmj.sys
1⤵
- Executes dropped EXE
PID:4568

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
- Executes dropped EXE
PID:1460

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
- Executes dropped EXE
PID:2404

C:\Temp\eywtrojgey.sys
C:\Temp\eywtrojgey.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\gbytrlidbv.sys
C:\Temp\gbytrlidbv.sys
1⤵
- Executes dropped EXE
PID:4336

C:\Temp\tnlidbvtnl.sys
C:\Temp\tnlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\icaxsqkica.sys
C:\Temp\icaxsqkica.sys
1⤵
PID:5852

C:\Temp\nkicaxvsnk.sys
C:\Temp\nkicaxvsnk.sys
1⤵
PID:4656

C:\Temp\rpkhczuspk.sys
C:\Temp\rpkhczuspk.sys
1⤵
PID:2668

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
PID:2420

C:\Temp\rojhezwroj.sys
C:\Temp\rojhezwroj.sys
1⤵
PID:892

C:\Temp\uomjebwuom.sys
C:\Temp\uomjebwuom.sys
1⤵
PID:3692

C:\Temp\qoigbywtol.sys
C:\Temp\qoigbywtol.sys
1⤵
PID:4448

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
PID:1788

C:\Temp\dsnlfdxvpn.sys
C:\Temp\dsnlfdxvpn.sys
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkecxup.exe

Path C:\Temp\ausmkecxup.exe
Size 365KB
SHA256 6c46f81e66be684e41cef019ce9cc4f8ebe7c69beb984792c70f2eda94c57985
MD5 c2cf17cb53ac14f2b795066b17a11108
SHA1 7866d1f34e1084631ef4e9a8a0deadd89bf8a8b2
SHA512 22bdf47ecdb9fa72d0603ff024eabcaad4bd3e9f8686315dcae06100eb2d8fca00104b3ea15b818961693e75e3a2be92ec6c8feb87ef0e8865571e3169ef3eae
SSDEEP 3072:duxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtqligay.sys

Path C:\Temp\dbvtqligay.sys
Size 293KB
SHA256 31c164553d7c6c085b052e0c5137d5cabdbfd5092cfa30474551a80b44fa5729
MD5 695edabf8469cffdccf58769e713c0c3
SHA1 6d814f40421589cf6b74499c5216b99c9bbc81e9
SHA512 62e122a152737b10ebe4b29363440766d30a82e3ff1f829bc9c99b81bb609c80a3cd879fc9273ccca183b17ffe5ca566363742cab7c8a1c61c61467c948a317f
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T15C545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvsnkfdav.sys

Path C:\Temp\dxvsnkfdav.sys
Size 293KB
SHA256 5ba1243a0174246875153e67c03ed3b540affebe5b0634441e19e6877033a47a
MD5 e1e3039c154031c37e215c4c1d7bb311
SHA1 70d97e3cae4ede45c465364873680eabe11f1276
SHA512 71e160ed04c03f7a28c8d8e98978477a908c5de9471e90e0fd1e60d7ad0b414b3e5c141395cadd89872ac57136eb305b8ffee7151c67fa0707be17a7c94e6647
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T18C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkecxup.exe

Path C:\Temp\i_ausmkecxup.exe
Size 365KB
SHA256 5d4ab2906474233719aaea3ad61a6cf2cbefb9fa0a6383cd06fe118958cefdfe
MD5 b562c9700138eed80536f2a1db349dad
SHA1 fc62486832bd6f5426a46e9c40fcbe857c2734c1
SHA512 360112005f1b5e8950f264fc9d8c980e127cd23382fd42d5870a2f87ab7881ef228a07675b6a9001970ffa7c4315024dc1e1585fbed56873726d9c1ba15b42e2
SSDEEP 3072:yuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifdxvpnif.exe

Path C:\Temp\i_nifdxvpnif.exe
Size 365KB
SHA256 982c989de0bb9736d087adb1362867994925d1b98ebfd0f6a3ab9a19429eef86
MD5 aa8189f0fcb64cba4c5d2ec89dd79f52
SHA1 95a7bf998ae59f584f67daa3127a3c9eed877ff9
SHA512 2b02a29c0de2e2467c8381e685d815e041c489b3a7931ce083073b8172a55352ee033edf4e94859b9ada44e89a2978918a7aaa0da913b08aa6782024b018da96
SSDEEP 3072:KuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywlgeyvqoj.exe

Path C:\Temp\i_ywlgeyvqoj.exe
Size 365KB
SHA256 e20f31a6953f3b1afbb927e66a03d500e076f3c72227be30e42efeb235b88a67
MD5 cf1987957aaf80c13b3ec5d4d619211e
SHA1 45756de63652f9af99d4d1a35a0ba105ea34c55c
SHA512 c331504d08f2c2ca65acc47df8c8c71d7772d2cb789459fc28d6a368bc4dfe76154032b64384c87c900c5a84411220aab51d0a858a8b5370d4832443c9bc949d
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqnigaysq.exe

Path C:\Temp\i_ywqnigaysq.exe
Size 365KB
SHA256 f67760947b24393af9dace107627a3baa2df7fe3502056e5aa860f5b1e73de80
MD5 b6f17b0a036e2bb048892be1283b04b7
SHA1 f9edb759c67a7a6cc630eef46abee3ec9d539e65
SHA512 70a90e2300c153b2132e3c0586b88b4ca7cebfd26521a20dc6e20f8019736a516f48e24970be7876ebb820f4673c9492c2683e57d09dfa4ca3d9757c3dfa2319
SSDEEP 3072:quxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T121847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxspkhfdxv.exe

Path C:\Temp\i_zxspkhfdxv.exe
Size 365KB
SHA256 479783052b811cf3d4024e443887e498d74bff03a195d7a17336c8a2c89d7def
MD5 b1272cb82278b9b5d75de00d6a6b6ede
SHA1 e105fedde6eed71953da63427c5d16ec6f2043a0
SHA512 8d4eb635fe92ae85beea23f73ff621f2778a291cbd3ba3682632d8420b5c9840a4659ca11cfcee53d3bb5b4fd09b5151daeab6c435b31225a3cd087bc49c01ec
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxsqkic.sys

Path C:\Temp\nhfaxsqkic.sys
Size 293KB
SHA256 ea175547fc66cb3e0b5e412b93cb8840f673ea8ba750186bd47c6933d67b0fcf
MD5 d0f8274f9565618d8f2715832a9f962c
SHA1 6f6cc7cf6b97f8bb1d0f6e15352abdeccc16fcae
SHA512 69b0f5fd51ac7a5332de0cfcb8c306d42c7c3e828f2c9a18c6937f4099187f1da234be35abf0ecc57cb200af9823357ed688d4903124d7f435bf054927e58344
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T154545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvpnif.exe

Path C:\Temp\nifdxvpnif.exe
Size 365KB
SHA256 5f17862b8bb6176714f762c861455b5f4520f1d8e43c200c18ae1947bc1d0d23
MD5 a1efb3d16595c4695273cde543e984f0
SHA1 8c181754824ff293f9371583b67bd2d8ea587822
SHA512 0080fb7b2ae69e2764c98e7761b665c3fbb56a39c20a4e5a0664174bfc51db68488656e29775d5c8c272be519f766ce19decb271e84da26dfd444592d7651c25
SSDEEP 3072:huxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkid.sys

Path C:\Temp\nigaysqkid.sys
Size 293KB
SHA256 6d4796f4a7811fb563a316787fed23b589e77cf8e3ec5e883ea501f07f217a95
MD5 c5a22c6000d647d3b867096e076e3c8b
SHA1 8aa96082cfcac6185f63b59de6313edaa6003931
SHA512 16670e103fcbcfb2b0ac6e060a0efbc0668a80b744ab6035de31fef5b09b71672a74d88335dd05a0a32abc82798b29c978483abe7752c4915de569f61b491bc8
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfcausmk.exe

Path C:\Temp\pjhfcausmk.exe
Size 365KB
SHA256 0bc277ee458483b0f6078f74bd73736e029209804e528e604cec2e8ae502434c
MD5 ccc6e243e1f8f68f8586ec337af5f682
SHA1 ba93b10607f15e00f65d950f5606e51007cbfaea
SHA512 b71d2b9d8f6b3e3fc516ed4a454ee0ec8567e2a8910105696b95f23bac85e45d52a6250f27489574a977fdc471672335739c4d40b36f3bbe47338a791c25a958
SSDEEP 3072:CuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkeczusmj.sys

Path C:\Temp\pmkeczusmj.sys
Size 293KB
SHA256 8c7d6cc8365b9fd72de1a52fe1330347fd4e207038031bfe998822faa1fc0447
MD5 7bf07774e13652d61da7d2ed91ab61fc
SHA1 99bf2c781d3842045bfeaa0f12113c31d7c5444c
SHA512 a644722f6c678a6291f20c05adb56185312fb5d6e27a7fafd5403d3573193f4fdc7e48feb82bab2399ceaea261f32023ff03d24efffb451102a07fb663ab8243
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgbytrljdbwto.exe

Path C:\Temp\wtomgbytrljdbwto.exe
Size 365KB
SHA256 3bc0bd72357fbb10c9fd7eb6f4b90d3e38fd19ac4de09fb3c4f268bb15160478
MD5 f96d27ace6f8d0097adf5fd27859fbb7
SHA1 c3d36c91c1449daa25b096c5e42baffdd9b33ac2
SHA512 520836a619e73c7863e030dbb3df8c0e3f4ea59e6aea37758576d74ccb806c5badf1d136f5f3a5b076eee5783e96f34e8102097aeee333bdeb42ddba751f2ef3
SSDEEP 3072:fuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgbytrljdbwto.sys

Path C:\Temp\wtomgbytrljdbwto.sys
Size 293KB
SHA256 78692b5d854504dffa0164bdd4da88f56c3708fafed5181b23febbb3049ac530
MD5 7e62e1cb6137c5eb064dbcd9bccd1926
SHA1 f05c587fbc8b0ddce5cfdaeb2127249ea164a5f2
SHA512 3c455052d584eaf3af6749d98e1ec8323e2aebd26d4caf05cd2d81b8052a3d2e26f9bdf2222d03ee9dc94ade69ccd101883e9fdadaf4174cca52875870929d45
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywlgeyvqoj.exe

Path C:\Temp\ywlgeyvqoj.exe
Size 365KB
SHA256 2398c68701b78d1ac7c50c8835b0801892fbc82c4b06c20c4cd34feefd301359
MD5 c9d1665ea51fedaf62fe888c0bafaf6c
SHA1 2a517a531a8224c5284c5e92c7f5880192aa83dc
SHA512 fd3655362b1b9ddc599f765d98c288bc751ab7439ab4d4d79660ec077093cb1efc01f442457a441fee3e94e07def06587e3164be077b2b68c12f0ccb1fd1e252
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqnigaysq.exe

Path C:\Temp\ywqnigaysq.exe
Size 365KB
SHA256 c6f9084541386c9c6099642a2c1a434058bc0a22ad900af73f84c37ff8466ce7
MD5 3b432c2ab554bef477715fbee1196417
SHA1 eb4f908df7cc671c0e41d25ea1eb7dac82d07059
SHA512 61fe233cb66f126371e46488db535b2d3bd0883322823b4b88c680cea4895f1b91eb2c81dee31ebf334746888ce03e5b35c1c5df6bab4e8050099287baa87c06
SSDEEP 3072:GuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxspkhfdxv.exe

Path C:\Temp\zxspkhfdxv.exe
Size 365KB
SHA256 36b2fe83f274e64e0f0efd24e8a38e8bd44846b1f13681119a728211a73be6a3
MD5 31690ff9a4b389c25d037a9fdec05405
SHA1 23ffd1bde22d64fe760570d68e8815e13b25eadc
SHA512 dc8a22019eac4e71507333234ba521cb5fb726379b0bbd8d3876192e340b6d088897367321ef3d8dd24c1a35eaaafd008def0efc05c69cf050aed53b52ce2759
SSDEEP 3072:KuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7969e51e-3c1b-4bcc-baf7-cd97efab6b10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7969e51e-3c1b-4bcc-baf7-cd97efab6b10.tmp
Size 44KB
SHA256 831622e8b46ad0248cb0109a066a684c2b29e4140550ce9ef434fbf3eb4f46d3
MD5 7549c7d05792b1772fc5463c0962d258
SHA1 7c6bdcb574788c35a97922ee14984ad5b0c386d2
SHA512 8a40bbdbd003110e801e94d4def312929116a774e567542c79637d6482b1ff8e35ee080b813c0435ff848d587ac857d5174e04e4fc0b2cd89c0666a6b9408003
SSDEEP 768:iFZ3IzhR3JwgVmwMbnZgtxtueX6+qTko0u229a4vsTvTX9m6yMSD:o3Iv3d4qvVTVKa4Gxm6VSD
TLSH
T1531359F1A8D38977D89E9783633E2D469EBCC163B5885980BBC95D0CCC821BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 95c2a1eab1d48176d50b2ac9ed3c8909fc4050d0c635fa2f1499cecb254833b3
MD5 2a7ac49816fc5c45244bf8e45a5825d4
SHA1 305163ac8001443f447e731941bd3b14b891930d
SHA512 d6bfb17324855c8bb5146092ecb1325f3520a321f38f0c86d48ac0f68be6c8f2f9aa2b1d4a4a819ed96ba799c57a06a8a3811316e8ca5fb5533a19c977663b63
TLSH
T120615191732F0791DB27EEBA17D1E4C5B1F86816A20B6A00DC843DB0E086F163EE8467
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cab9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cab9.TMP
Size 3KB
SHA256 3711de0d8f1db1c634eaaa71ce5f0cbb6bdf6c5fa073a3e11bbd7ac70a037b4a
MD5 46f5bf831a781e5bfee4929eb781c22b
SHA1 82b8131c715ce5fe37b225016b4140f777ab8977
SHA512 fd472f7ba38455b3daf910dccf9556a71a61be55099cf1e6b7210451f78659c613ea9f1be4a40b499beeb246bec3134fef09a5911b7e83aa5bf8d2920fab6b8b
TLSH
T11F614291732F0791DB27EEBB17D1E4C5B1F86856A20B6A00CC843D74E086F167EE8467
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3d9d445c3a3517b54f7182c5112358b55c59827a92250e781c9a720de73cfec6
MD5 d0136fb7b47c398b913713b24d09a4a1
SHA1 d045d32bca6664362886bb652399ef02ee1a3024
SHA512 21314cc623d6d53923440806667e0297a1c871cc2cb3002310a5ac6590cfcba6d47ff16282f18c33e5d45aa2d2ace227d48294e0330ce3afa5f8c5f78462e8bc
TLSH
T13741C0F783F4856E891196F0AB14AE1FCF2D0511432C7D5AC9E4AE2793E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 94efd5e187099ca662268d552ac1d1a974509ae7d33c77802c1fb73be7dc42c1
MD5 cf3da07fa69ee08e0f2fac64616f2334
SHA1 a0990b8c16464d2e88f7a8baed092a9186c33f34
SHA512 f175254b74803bf521ec434fbf0064cec1c382d1cba977a3e900a124ba1afce93221b6e37ad3bc4279e91fc232d6fec18a7532cf309e1e67678d60f4417072a3
SSDEEP 192:sxRpRcCU/fMs9NZI/mzoA8p9e/g6+WNCI2/YES3x3nGRcIgVa1J:sxRp1U/fMs9jI/bI/5c/eLi
TLSH
T17F42C8156A28A93B4CC7E21DBB55BF63D3F95132A1D51E48BAFC8B1C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a1aff63c61be03dfcfc8ec0e327772e9a2839863fb085d1f253ba3dc56d869e6
MD5 7b6156eb5e47e3f8cf714bff481e56f0
SHA1 5bb2b83877e6b60bf206556acaf2b2625290e151
SHA512 9faeb6a5045a88bb8cbfe6b0ab89cc0f924e6582c5fa0add2b99536cc34767c9595e71a67f9cf281ee0c2d1b9f1319b833e3bebea408908ae079ada898b747da
SSDEEP 192:sxRuRcCU/fMsbNZI/mzoA8p9e/g6+WNCI2/YEK3t3nGRcIgD8a1J:sxRu1U/fMsbjI/bI/5c/MLB
TLSH
T1BD42C8156A28A93B5CC7E21DBB55BF63E3F95132A1951E48AAFC8B1C04E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb3458b95739ba228c88ec35575d8f90b885024e39223cf4e08c93a4fa0fbbf4
MD5 dde24d25977d12895da1c6e958c4d75a
SHA1 59f7d3666abca65b1a151f0a076ed05e2191d81b
SHA512 154c0f0cda90a89ad01f8a7b69a75823b3d6bcf65b8e89f20f30fe29c8abec8168e66886a0112d3ccfdf4580a3a7e6102e1c9232e47b60501713c57a8d0dcb05
SSDEEP 192:sxRuRcCU/fMsnNZI/mzoA8p9e/g6+WNCI2/YES3x3nGRcIgDGa1J:sxRu1U/fMsnjI/bI/5c/eLr
TLSH
T1BB42C8156A28A93B4CC7E21DBB55BF63D3F95132A1D52E58AAFC8B1C04E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8a29e727c0563fd852d3e85fbbf73ec7454d72af744ba3cc418838492cb85a1a
MD5 4af20caa21598b56f2b275430b8b0bb3
SHA1 e5a3f30909d1edd0ed0d2da90976355ef2f7c5a6
SHA512 fb40ac70bd4d3a964f93531adcb8c7629a24c3faba1351c2d4df1a98536445b5652998aec4e5f9f1e610f8ff41e17f4e4470dede7abd3f6ee0b042f2bccf4bfc
SSDEEP 768:40Dk6DJQD8XF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOI:40Dk6DJQD8XTE7N0DbWgQ6DjfIQDFu1j
TLSH
T1B4D2EB7B640CCB7F4F804ADDAD197A8E6D6802CB96D8C98047FE991C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b745cfb8-45c1-48e9-baba-750266bcb472.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b745cfb8-45c1-48e9-baba-750266bcb472.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f093daf-8d95-4cb9-aaac-32e9a3fccf05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5f093daf-8d95-4cb9-aaac-32e9a3fccf05.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0850bd23663214ebffd88981c456a4e13298414ba1278e7530e77767cf1bbd4b
MD5 e8002a32470a7d55fe478bd92269bdb0
SHA1 a925e961502499670d53053ae94da3daa9f614eb
SHA512 9f56228d80b4b63034d24b9331544e283480b418ce6cc8b7d31aa868514806c412146ecc04fdb00c4bef8a15b4a33e62724331fe5ef04427be54e51e672f249b
SSDEEP 768:s3Izhg3YmkMkDTd+ZgtxtueX6+qTko0u229a4vsTvTX9m6yMSD:s3Ii3Yq2vVTVKa4Gxm6VSD
TLSH
T1F2F2B071F8614D73CD56E680721B3687AFA41273D9C82B54EDDEAB1D04872AC2B0FD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b1fefe46623c5ef15688332894aa026504c79b3c7dcb309676e460f165273154
MD5 2e85a0fa08d594e6189ebb482c394024
SHA1 cc1b95ab250a7cf34bc2db978e0def92577b918c
SHA512 96c6625dbdc7c9ede09717cb5d500878a381cc901e91bfb438514e2600b6935aee79f7cabd27c7aeb4cc4f7cef42855d6e695dda3bd1abff9d77584442a8b665
SSDEEP 768:prv+4UNbdG31xXqDTd+ZgtYeX6+qTko0u229a4vsDleVH1SdW:pbsbU330vVTVKa4UEH1h
TLSH
T1EA03CF32E8648D778DE79784714B75472FB95163CBC80B80D8EE6B0D069B5AC230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 554897798e4cfd6f9456bb96110d393a76b78858a4d32ba322c2ee5c31f286f7
MD5 e1d898623a0f1eaca652f07ac684ce7d
SHA1 208cfacedb2f2f6e34b0d5c38c696f5e4d0b56e5
SHA512 7a430bf8620258f266a3bddff03212d2161d8b745a3b7ba7379feba82b0c31a1fcea68bb3d03c370defd11cc13958aefd606d9ac28ef9f825bb7c5bfac6a9f6f
SSDEEP 768:Y3Izhg3fmkMkDTd+ZgtxtueX6+qTko0u229a4vsTvTX9m6yMSD:Y3Ii3fq2vVTVKa4Gxm6VSD
TLSH
T1D8F2C071F8614D63C856E68072173687AFA41273D9C82F14EDDEAB1D04872AD2B0FD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9e2efc3cc8ab0549b2a59a2862f18f90c2af49d09717b9e877757dd172e32ac0
MD5 20ff6d75816844872c6ea7f21e40a607
SHA1 3eba78e84a38152c63063ae1874604c2b7434b45
SHA512 6285244d74c885736ca0b44f5312fb5e20be1317c576deac0b1ebdd6c5c23c0fffda67d8431e3fa418d5cd15f2785b6873e717d2c64b790f718362690df9ff9a
SSDEEP 768:Urv+4UNbdG3n7MqDTd+ZgtxtneX6+qTko0u229a4vsSveVH1SdW:UbsbU3wNvVTVKa4hEH1h
TLSH
T1C403BF32E8698D3389E7D784714B76472FB822738AC40B84D9DEAB4D05475AC270FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 95aa637c6452edd806d18fa160dee91d2d04c90b1d60bde03da7efa13bbaad88
MD5 b1593d48ca73c1c60b718d3bed51927f
SHA1 28c107aeb3cba8f0c1e00df46778133bfd37c51e
SHA512 b80a0c45b70279c4f2591ec33c5fe52c92b009c695269792593dd8469098c4058861a67c749225b9d68dd5f18c13d3374028220c415e8bd4d493e01619be44fd
SSDEEP 768:7rv+4UNbdI3amrMkDTd+Zgtxt4eX6+qTko0u229a4vsTvPC:7bsbG3aVKvVTVKa4GK
TLSH
T1DF03BE31F8299D738DA7D684B24B36876FB421738AC50B54D9DEAB0D01471AC2B0FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2860_366498822\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b7913b733464a0f9ae4140d5d5fe77a811ee8a0fc3f8e9b8169b74adf82a1d3e
MD5 b3f088620a60c01937016a4b82006140
SHA1 e4b31fcc8d68903f90b7c55711726770969a78de
SHA512 88459e640da97db59d5c98d7deee896e881b36cf2664f352dccc11b3a3e3983d30b692c51aa4e1cc09dd44df9f2d3390df1f0aeea6d8f53151d1a0c456c4620a
TLSH
T1B071E38357A9D5F3C1DE5BF112835644F6FB227C4B6370240BA5598AEB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/892-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1460-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1788-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2404-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2668-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4336-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4448-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4656-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5040-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5144-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5164-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download