systex | 0d37e1c320b887248283f85f1680f5cbedbabf7e2915a466c7ffbbeba0eb69b9

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260629-dlrv9aby7s
SHA256 0d37e1c320b887248283f85f1680f5cbedbabf7e2915a466c7ffbbeba0eb69b9
MD5 c5d6ec74972ec5dd473daa33f94ba51f
SHA1 6e15f912e00f97a2581dbfaec512739e06146820
SHA512 ae1ae6f06810377bba676c71f0d9e63aa4e091684f756530e9aa6339b23e51ea65928c6d3a6bc36ac2f53be44e20a89369f516b8eb47a189012c120aeaa7d4ca
SSDEEP 3072:Guxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2208	zxrpkhcausmkecxu.exe
1288	zxrpkhcausmkecxu.sys
4508	CreateProcess.exe
3164	fzxrpkhcam.exe
4436	CreateProcess.exe
2224	CreateProcess.exe
1528	i_fzxrpkhcam.exe
2816	jhbzurpjhc.sys
3204	CreateProcess.exe
1676	czurmkecwu.exe
2440	CreateProcess.exe
1752	CreateProcess.exe
3500	i_czurmkecwu.exe
4900	trljhbztom.sys
5536	CreateProcess.exe
2896	urmgecwrpj.exe
3628	CreateProcess.exe
1584	CreateProcess.exe
1352	i_urmgecwrpj.exe
2640	ojgebwtolj.sys
2520	CreateProcess.exe
3188	ojgebwtolj.exe
3200	CreateProcess.exe
1120	CreateProcess.exe
860	i_ojgebwtolj.exe
1580	qoigbytrlj.sys
6072	CreateProcess.exe
1376	bvtolgdyvq.exe
2416	CreateProcess.exe
3160	CreateProcess.exe
4824	i_bvtolgdyvq.exe
5576	avtqolgdyv.sys
2164	CreateProcess.exe
5456	yvtnligdyv.exe
5996	CreateProcess.exe
2852	CreateProcess.exe
4356	i_yvtnligdyv.exe
6064	lfdavtnlfd.sys
5620	CreateProcess.exe
2812	davtnlfdxv.exe
1220	CreateProcess.exe
2588	CreateProcess.exe
4468	i_davtnlfdxv.exe
1324	xvsnkfdxvp.sys
3376	CreateProcess.exe
2820	vpkhfausnk.exe
1260	CreateProcess.exe
2448	CreateProcess.exe
5908	i_vpkhfausnk.exe
4228	xvpnkfcxus.sys
4288	CreateProcess.exe
3976	fcwupmhfzx.exe
1052	CreateProcess.exe
824	CreateProcess.exe
5844	i_fcwupmhfzx.exe
716	mkecxupnhf.sys
4836	CreateProcess.exe
5240	jhcwupmhez.exe
4752	CreateProcess.exe
2616	CreateProcess.exe
5900	i_jhcwupmhez.exe
3980	kecwuomgec.sys
2464	CreateProcess.exe
4248	ecwuomgezw.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_305468067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_551994156\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_116600152\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1528110843\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1528110843\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1528110843\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_551994156\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_116600152\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1640_1528110843\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpkhfausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxrpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhfzxrmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcausmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpkhfausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhcwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgebwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnligdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgebwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhfzxrmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrojebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmgecwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmgecwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhcwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidaysqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrojebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidaysqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxrpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnligdyv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1620	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2880	ipconfig.exe
596	ipconfig.exe
5820	ipconfig.exe
2344	ipconfig.exe
6000	ipconfig.exe
5196	ipconfig.exe
1104	ipconfig.exe
3592	ipconfig.exe
5408	ipconfig.exe
6076	ipconfig.exe
2696	ipconfig.exe
1308	ipconfig.exe
2328	ipconfig.exe
3068	ipconfig.exe
1508	ipconfig.exe
2788	ipconfig.exe
4980	ipconfig.exe
5304	ipconfig.exe
5872	ipconfig.exe
5448	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271759839081698"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{3C2D191C-3D17-40BB-AA41-B0B0EE242336}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe
2208	zxrpkhcausmkecxu.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	i_fzxrpkhcam.exe
Token: SeDebugPrivilege	3500	i_czurmkecwu.exe
Token: SeDebugPrivilege	1352	i_urmgecwrpj.exe
Token: SeDebugPrivilege	860	i_ojgebwtolj.exe
Token: SeDebugPrivilege	4824	i_bvtolgdyvq.exe
Token: SeDebugPrivilege	4356	i_yvtnligdyv.exe
Token: SeDebugPrivilege	4468	i_davtnlfdxv.exe
Token: SeDebugPrivilege	5908	i_vpkhfausnk.exe
Token: SeDebugPrivilege	5844	i_fcwupmhfzx.exe
Token: SeDebugPrivilege	5900	i_jhcwupmhez.exe
Token: SeDebugPrivilege	5196	i_ecwuomgezw.exe
Token: SeDebugPrivilege	4332	i_dbytrojebw.exe
Token: SeDebugPrivilege	1292	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	3184	i_lgdywqolge.exe
Token: SeDebugPrivilege	2604	i_lidaysqnif.exe
Token: SeDebugPrivilege	3208	i_kifaysnkfd.exe
Token: SeDebugPrivilege	1564	i_hfaxrpnhfc.exe
Token: SeDebugPrivilege	4448	i_usmkecausn.exe
Token: SeDebugPrivilege	4980	i_omhfzxrmke.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2208	1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1852 wrote to memory of 5088	1852	2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5088 wrote to memory of 1640	5088	iexplore.exe	91
PID 1640 wrote to memory of 4608	1640	msedge.exe	92
PID 1640 wrote to memory of 5048	1640	msedge.exe	93
PID 1640 wrote to memory of 1620	1640	msedge.exe	94
PID 1640 wrote to memory of 5048	1640	msedge.exe	93
PID 1640 wrote to memory of 5048	1640	msedge.exe	93
PID 1640 wrote to memory of 3824	1640	msedge.exe	95
PID 1640 wrote to memory of 3824	1640	msedge.exe	95
PID 1640 wrote to memory of 5844	1640	msedge.exe	96
PID 1640 wrote to memory of 3576	1640	msedge.exe	97
PID 1640 wrote to memory of 5844	1640	msedge.exe	96
PID 1640 wrote to memory of 5844	1640	msedge.exe	96
PID 1640 wrote to memory of 3576	1640	msedge.exe	97
PID 1640 wrote to memory of 3576	1640	msedge.exe	97
PID 1640 wrote to memory of 2244	1640	msedge.exe	98
PID 1640 wrote to memory of 2244	1640	msedge.exe	98
PID 1640 wrote to memory of 2244	1640	msedge.exe	98
PID 1640 wrote to memory of 1972	1640	msedge.exe	99
PID 1640 wrote to memory of 1972	1640	msedge.exe	99
PID 1640 wrote to memory of 1972	1640	msedge.exe	99
PID 1640 wrote to memory of 2224	1640	msedge.exe	119
PID 1640 wrote to memory of 2224	1640	msedge.exe	119
PID 1640 wrote to memory of 2840	1640	msedge.exe	105
PID 1640 wrote to memory of 2840	1640	msedge.exe	105
PID 1640 wrote to memory of 4976	1640	msedge.exe	106
PID 1640 wrote to memory of 4976	1640	msedge.exe	106
PID 2208 wrote to memory of 4508	2208	zxrpkhcausmkecxu.exe	107
PID 1640 wrote to memory of 1884	1640	msedge.exe	110
PID 3164 wrote to memory of 4436	3164	fzxrpkhcam.exe	112
PID 1640 wrote to memory of 2748	1640	msedge.exe	117
PID 1640 wrote to memory of 2748	1640	msedge.exe	117
PID 1640 wrote to memory of 1220	1640	msedge.exe	118
PID 1640 wrote to memory of 1220	1640	msedge.exe	118
PID 2208 wrote to memory of 2224	2208	zxrpkhcausmkecxu.exe	119
PID 2208 wrote to memory of 3204	2208	zxrpkhcausmkecxu.exe	123
PID 1676 wrote to memory of 2440	1676	czurmkecwu.exe	125
PID 2208 wrote to memory of 1752	2208	zxrpkhcausmkecxu.exe	128
PID 2208 wrote to memory of 5536	2208	zxrpkhcausmkecxu.exe	132
PID 2896 wrote to memory of 3628	2896	urmgecwrpj.exe	134
PID 2208 wrote to memory of 1584	2208	zxrpkhcausmkecxu.exe	137
PID 2208 wrote to memory of 2520	2208	zxrpkhcausmkecxu.exe	142
PID 3188 wrote to memory of 3200	3188	ojgebwtolj.exe	144
PID 2208 wrote to memory of 1120	2208	zxrpkhcausmkecxu.exe	147
PID 1640 wrote to memory of 1388	1640	msedge.exe	149
PID 1640 wrote to memory of 5900	1640	msedge.exe	150
PID 1640 wrote to memory of 4880	1640	msedge.exe	151
PID 2208 wrote to memory of 6072	2208	zxrpkhcausmkecxu.exe	154
PID 1376 wrote to memory of 2416	1376	bvtolgdyvq.exe	156
PID 2208 wrote to memory of 3160	2208	zxrpkhcausmkecxu.exe	159
PID 2208 wrote to memory of 2164	2208	zxrpkhcausmkecxu.exe	163
PID 5456 wrote to memory of 5996	5456	yvtnligdyv.exe	165
PID 2208 wrote to memory of 2852	2208	zxrpkhcausmkecxu.exe	168
PID 2208 wrote to memory of 5620	2208	zxrpkhcausmkecxu.exe	172
PID 2812 wrote to memory of 1220	2812	davtnlfdxv.exe	174
PID 2208 wrote to memory of 2588	2208	zxrpkhcausmkecxu.exe	177
PID 2208 wrote to memory of 3376	2208	zxrpkhcausmkecxu.exe	181
PID 2820 wrote to memory of 1260	2820	vpkhfausnk.exe	183
PID 2208 wrote to memory of 2448	2208	zxrpkhcausmkecxu.exe	186
PID 1640 wrote to memory of 3596	1640	msedge.exe	188
PID 1640 wrote to memory of 3596	1640	msedge.exe	188
PID 2208 wrote to memory of 4288	2208	zxrpkhcausmkecxu.exe	194
PID 3976 wrote to memory of 1052	3976	fcwupmhfzx.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_c5d6ec74972ec5dd473daa33f94ba51f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Temp\zxrpkhcausmkecxu.exe
  C:\Temp\zxrpkhcausmkecxu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhcam.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4508
  - - C:\Temp\fzxrpkhcam.exe
      C:\Temp\fzxrpkhcam.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcam.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2224
  - - C:\Temp\i_fzxrpkhcam.exe
      C:\Temp\i_fzxrpkhcam.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\czurmkecwu.exe
      C:\Temp\czurmkecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Temp\i_czurmkecwu.exe
      C:\Temp\i_czurmkecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmgecwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5536
  - - C:\Temp\urmgecwrpj.exe
      C:\Temp\urmgecwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmgecwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1584
  - - C:\Temp\i_urmgecwrpj.exe
      C:\Temp\i_urmgecwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgebwtolj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2520
  - - C:\Temp\ojgebwtolj.exe
      C:\Temp\ojgebwtolj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgebwtolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Temp\i_ojgebwtolj.exe
      C:\Temp\i_ojgebwtolj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtolgdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6072
  - - C:\Temp\bvtolgdyvq.exe
      C:\Temp\bvtolgdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtolgdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3160
  - - C:\Temp\i_bvtolgdyvq.exe
      C:\Temp\i_bvtolgdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnligdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2164
  - - C:\Temp\yvtnligdyv.exe
      C:\Temp\yvtnligdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnligdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2852
  - - C:\Temp\i_yvtnligdyv.exe
      C:\Temp\i_yvtnligdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5620
  - - C:\Temp\davtnlfdxv.exe
      C:\Temp\davtnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2588
  - - C:\Temp\i_davtnlfdxv.exe
      C:\Temp\i_davtnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpkhfausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3376
  - - C:\Temp\vpkhfausnk.exe
      C:\Temp\vpkhfausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpkhfausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2448
  - - C:\Temp\i_vpkhfausnk.exe
      C:\Temp\i_vpkhfausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcwupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\fcwupmhfzx.exe
      C:\Temp\fcwupmhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcwupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:824
  - - C:\Temp\i_fcwupmhfzx.exe
      C:\Temp\i_fcwupmhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhcwupmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\jhcwupmhez.exe
      C:\Temp\jhcwupmhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhcwupmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2616
  - - C:\Temp\i_jhcwupmhez.exe
      C:\Temp\i_jhcwupmhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2464
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    PID:2860
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytrojebw.exe ups_run
    3⤵
    PID:4104
  - - C:\Temp\dbytrojebw.exe
      C:\Temp\dbytrojebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytrojebw.exe ups_ins
    3⤵
    PID:1152
  - - C:\Temp\i_dbytrojebw.exe
      C:\Temp\i_dbytrojebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    PID:4212
  - - C:\Temp\dbvtnlgdyw.exe
      C:\Temp\dbvtnlgdyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    PID:2840
  - - C:\Temp\i_dbvtnlgdyw.exe
      C:\Temp\i_dbvtnlgdyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqolge.exe ups_run
    3⤵
    PID:5356
  - - C:\Temp\lgdywqolge.exe
      C:\Temp\lgdywqolge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqolge.exe ups_ins
    3⤵
    PID:5864
  - - C:\Temp\i_lgdywqolge.exe
      C:\Temp\i_lgdywqolge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidaysqnif.exe ups_run
    3⤵
    PID:4968
  - - C:\Temp\lidaysqnif.exe
      C:\Temp\lidaysqnif.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidaysqnif.exe ups_ins
    3⤵
    PID:5344
  - - C:\Temp\i_lidaysqnif.exe
      C:\Temp\i_lidaysqnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaysnkfd.exe ups_run
    3⤵
    PID:1972
  - - C:\Temp\kifaysnkfd.exe
      C:\Temp\kifaysnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaysnkfd.exe ups_ins
    3⤵
    PID:4636
  - - C:\Temp\i_kifaysnkfd.exe
      C:\Temp\i_kifaysnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxrpnhfc.exe ups_run
    3⤵
    PID:860
  - - C:\Temp\hfaxrpnhfc.exe
      C:\Temp\hfaxrpnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxrpnhfc.exe ups_ins
    3⤵
    PID:964
  - - C:\Temp\i_hfaxrpnhfc.exe
      C:\Temp\i_hfaxrpnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecausn.exe ups_run
    3⤵
    PID:4316
  - - C:\Temp\usmkecausn.exe
      C:\Temp\usmkecausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecausn.exe ups_ins
    3⤵
    PID:3620
  - - C:\Temp\i_usmkecausn.exe
      C:\Temp\i_usmkecausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhfzxrmke.exe ups_run
    3⤵
    PID:712
  - - C:\Temp\omhfzxrmke.exe
      C:\Temp\omhfzxrmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhfzxrmke.exe ups_ins
    3⤵
    PID:5572
  - - C:\Temp\i_omhfzxrmke.exe
      C:\Temp\i_omhfzxrmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztromgey.exe ups_run
    3⤵
    PID:2304
  - - C:\Temp\ebztromgey.exe
      C:\Temp\ebztromgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffed044c188,0x7ffed044c194,0x7ffed044c1a0
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6978197079940968957,49328560866453834,262144 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,191634634363507215,9777904318519092838,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:11
      4⤵
      System Time Discovery
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4082258659989307994,16425439969637579662,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16870346942015977416,16775345763662558037,2097152 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,11786245339913824464,14273042397726528824,2097152 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,11549022933498339676,12915003190739351056,2097152 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,17571467123940166715,17865281465025006290,2097152 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,6495370668464416326,9513892237194795589,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,2521264059406723123,15753055304835227852,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,17258297836545423768,5120683541689476015,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16495018080596170255,17131237173084122728,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16495018080596170255,17131237173084122728,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,2146994496973193487,6729506926035981556,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,2301817552007514705,7509180590665889372,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,4681900120675368029,4658136953357844728,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16337899127907138294,3458655240064989799,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,841264138899946721,16819783651474743530,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,12528725249988490339,6525895128895328518,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,16789617928772434726,16765527056112916962,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,14660236815921062908,12722142309264550258,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3216702234790652191,2179365052000803806,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3124,i,1854978337687496702,17619285896084738301,262144 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:10
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1200,i,17768618379822883135,16806837279233088308,524288 --field-trial-handle=2324,i,2939908125782767193,12574771739246217702,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:14
      4⤵
      PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

C:\Temp\zxrpkhcausmkecxu.sys
C:\Temp\zxrpkhcausmkecxu.sys
1⤵
- Executes dropped EXE
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2164

C:\Temp\jhbzurpjhc.sys
C:\Temp\jhbzurpjhc.sys
1⤵
- Executes dropped EXE
PID:2816

C:\Temp\trljhbztom.sys
C:\Temp\trljhbztom.sys
1⤵
- Executes dropped EXE
PID:4900

C:\Temp\ojgebwtolj.sys
C:\Temp\ojgebwtolj.sys
1⤵
- Executes dropped EXE
PID:2640

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:1580

C:\Temp\avtqolgdyv.sys
C:\Temp\avtqolgdyv.sys
1⤵
- Executes dropped EXE
PID:5576

C:\Temp\lfdavtnlfd.sys
C:\Temp\lfdavtnlfd.sys
1⤵
- Executes dropped EXE
PID:6064

C:\Temp\xvsnkfdxvp.sys
C:\Temp\xvsnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:1324

C:\Temp\xvpnkfcxus.sys
C:\Temp\xvpnkfcxus.sys
1⤵
- Executes dropped EXE
PID:4228

C:\Temp\mkecxupnhf.sys
C:\Temp\mkecxupnhf.sys
1⤵
- Executes dropped EXE
PID:716

C:\Temp\kecwuomgec.sys
C:\Temp\kecwuomgec.sys
1⤵
- Executes dropped EXE
PID:3980

C:\Temp\geywrojgez.sys
C:\Temp\geywrojgez.sys
1⤵
PID:5876

C:\Temp\omjebwtolg.sys
C:\Temp\omjebwtolg.sys
1⤵
PID:468

C:\Temp\ljdaytqlig.sys
C:\Temp\ljdaytqlig.sys
1⤵
PID:1792

C:\Temp\ytnlfdxvqn.sys
C:\Temp\ytnlfdxvqn.sys
1⤵
PID:2392

C:\Temp\nkfdxvsnlf.sys
C:\Temp\nkfdxvsnlf.sys
1⤵
PID:1328

C:\Temp\spnicausqk.sys
C:\Temp\spnicausqk.sys
1⤵
PID:3356

C:\Temp\pmhecaxrpk.sys
C:\Temp\pmhecaxrpk.sys
1⤵
PID:1864

C:\Temp\xrmkeczurm.sys
C:\Temp\xrmkeczurm.sys
1⤵
PID:3872

C:\Temp\geywromjhb.sys
C:\Temp\geywromjhb.sys
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avtqolgdyv.sys

Path C:\Temp\avtqolgdyv.sys
Size 293KB
SHA256 5aa1adfb33b66c69ed66d39020fb9b522c1cec6f9eb6be368420b37f4f4298c0
MD5 67aa496d194fca282425533a110dbd1c
SHA1 af3bfa7a3639b1b8b7b13cc768f0f4ded3013be3
SHA512 4deeff5bdae1cfa41ebbf6065c2580137123262876dfbbb36c4f9acc561a09b4c6b7cdf8b9dc2e50ff1f0d6697c288ca9d568ca72f5b3cea5c83793304b53fca
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T18B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgdyvq.exe

Path C:\Temp\bvtolgdyvq.exe
Size 389KB
SHA256 1c84e7b7696cbcfe7856f916a5212acc145d4c7d4d172654584e93926917f91f
MD5 53432099c314f9238d6d08e010ee8d4a
SHA1 af11e3403ed2f0daa8c490f71613b96ae74f9fea
SHA512 f88a5eba19ea26bd91f1e87d3ed8edc8f2de0a20cd53eb184a25cdc9999b6216f33f2295b6b8bea8c0ed2627a6eaaf378f71d086f89ea488ade5d634f79d7b34
SSDEEP 3072:6uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.exe

Path C:\Temp\czurmkecwu.exe
Size 389KB
SHA256 e2a6383db3f38194ca810ba0ef50f9c4885defd9bff872c81750ef8fdcfed885
MD5 1021df9362d1d17124dcd795be290e79
SHA1 d0c988e9c91ab6b4c295d2099e0e166ad1732ba5
SHA512 d00df09250394a1bbfa390d87b46f3fd7c392c670aecd2417d6286ccec02093b788ace6a8ac630846add5fc7db590a906af11c2f25ccebc4ead4139635cb15f1
SSDEEP 3072:Ouxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcam.exe

Path C:\Temp\fzxrpkhcam.exe
Size 389KB
SHA256 917b161bb64f5daddbd67c0e908ceb1445f05f7eacf6cf6117a10e6d511bb610
MD5 2f9574717678f1096a50795112adb31c
SHA1 6a7813f12ac8c14809ae8ae74dbdf6a466af6793
SHA512 4179de85da04c41c7b4225abc583d23e3cb5fe89dfaa330fce4875c464efaa6a702f8741898c7637d8c1efc29fc558fca963242d329b9404454197a82471468f
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtolgdyvq.exe

Path C:\Temp\i_bvtolgdyvq.exe
Size 389KB
SHA256 33b32c05c7c1bd0258ee1a4f02aaab8c0a1ac10133a914901683a8841ccf6afd
MD5 e83eed2bd2fc7dc69d387e0d06cb010b
SHA1 b4a7b34c6e72e8d434880181da1d8e13561bf623
SHA512 ca10552969ef2d63afd58e08989ddef7ab3188d6f78785171c5a539e885df4785135e4a1a784b9be0bfb9e030902ddb034897a3b112d16ff7f1d77aff8c9d90b
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmkecwu.exe

Path C:\Temp\i_czurmkecwu.exe
Size 389KB
SHA256 d4085df90c9b80c7134b1cdf214355ee74f353d63e5d3cc656ee201ac5c48e19
MD5 f821beab500869fcae7edd86e41470bb
SHA1 81ca1317209b4ffaa57a41a0bd02192b9d8b632f
SHA512 0d75104b543913c7b7b02f3e2d12fedd8a43373a786e324ce8bab2300dfc199540c557ad5927b28b488ccb9ac2939c6c39f87f425e3418b701169ebf5433723d
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhcam.exe

Path C:\Temp\i_fzxrpkhcam.exe
Size 389KB
SHA256 99c5be478208eb55463b3801ef0b13b64c3944faa2952b246a3996174e568ac4
MD5 47a7bb52e7b69626f127e3d279ecf03a
SHA1 eb0df7939a7a10ff4925511bb41e4d9ef351d9da
SHA512 008e2ea1e4704d685f0d96c1de86ea900f120ecac961f48ab0c5ffa5131f8fa89d2f1eab86278baf9a6b61dc84a346b76dd1a5aae270abf68e8796470aca4aa6
SSDEEP 3072:Vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgebwtolj.exe

Path C:\Temp\i_ojgebwtolj.exe
Size 389KB
SHA256 48de03cd7f5330f21d0a3b098900cc098b7f59f56385dcce515718d48b8f889d
MD5 f5d86d1d676ae666b957e9b96e9af1a3
SHA1 8ab087037266f6862c29389e120feab7f449b795
SHA512 027cb8e0490162317682b77d1d54e1fbe7e49996fca5ba1aa11f4a6fc59ef133e9f011e3390a57c1edd42a7d83db325455c8a5b69c4436177909015168471e17
SSDEEP 3072:muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmgecwrpj.exe

Path C:\Temp\i_urmgecwrpj.exe
Size 389KB
SHA256 8696428a744284797148ebf4858fda68ee0b8ede857ca10f2ee8b1b916afad96
MD5 54a7b76d888f47329dc12aed70ff31ee
SHA1 d8fb046e161f7955e1dca04c2324943e7090c0a8
SHA512 1cd2649261be44a0c583e185fc108507cc6ccac39794ff8bc1b840deeac37f5ac98f77c36f1b97aaf7f3edbcbe3efcab76b77d826bc825e3d09124bb094db3cb
SSDEEP 3072:Zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurpjhc.sys

Path C:\Temp\jhbzurpjhc.sys
Size 293KB
SHA256 cc99cca62b57b1d14d56c3c5339eb222f724fc9abb4072449092857222d6a67a
MD5 d95a7fcb14d5eea9f4203c5ddf265296
SHA1 57fa2e0ebd2d8d9684188ecc24e194e523e8f38f
SHA512 451a50742c86ab21bb2e86234fd39e79851d29a779ed452cb54536766c1be4674d3ecc89def6a24ceb5fed049c59f5c7ed497a82820f6813c1944942c7c89fd6
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgebwtolj.exe

Path C:\Temp\ojgebwtolj.exe
Size 389KB
SHA256 365d017eccdc3f5c1e38c7e1021616cf093740d5fd5308d545aaafcc0b9731dc
MD5 eaedcdf5fa46ea444d6e058cac73fe47
SHA1 29060a731c9f1497b8aa6efc9c2d0fd17d32e8ce
SHA512 a70ad6264f4bd0c254ad1a64c2b7c78e49c6a1c604ba69d2cc04ceaff80d44a2bdcf8012b0032e0f0438dbe6c7546a4d01682715689f9a1fb53245aed211e573
SSDEEP 3072:ouxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ouxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgebwtolj.sys

Path C:\Temp\ojgebwtolj.sys
Size 293KB
SHA256 905d8991d08bcde412c25a4416e41a76cb4078a2bb34e829705d593fbabf1822
MD5 a196d33a78a1906c28f233eea87e6c1b
SHA1 630d7c0c3cca556172ddd9addfeaa8ad6c111973
SHA512 d11790615c128b5b0ddc3071b16ce78c0ef6145ea33649a2f4f55296733654013365967a4692636376d41570eaa861a706e5c610df9fbd937da2dd5533d05d96
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytrlj.sys

Path C:\Temp\qoigbytrlj.sys
Size 293KB
SHA256 e2685c87082187ce730a74f07f6adfafee8ba3504e2a8b30ff81369e00790e1d
MD5 804507eef2830a5d56c9975966c1451c
SHA1 2f8d66a9000a95867f2d58f6a7cb548aab6095b2
SHA512 3bbf9c8ba00126aa70b2877141f0c88dd6f742b73544781a4229bd2da66ffb0591de6079dc1830f69f1163975ed9de8cbb9cc2cdbf9dc442ac983452f735e202
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T10C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljhbztom.sys

Path C:\Temp\trljhbztom.sys
Size 293KB
SHA256 c09840a70fbaeb67e4c3d1ce557c703515505a3030cfac7c15007e406d11d34f
MD5 3fcc93a7a4ce9b58eb177210ccfffe46
SHA1 0e18c58d555329a0a0f52a45ede27092c83c4aba
SHA512 a592ecc5510bff6fa0b29123f5cc934facdb7c0054db4e65214b092d463c452d037dd0910f61af66f0925eaf7a5c34ac09dffaf017c3083a67384d40615f59e1
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T148545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmgecwrpj.exe

Path C:\Temp\urmgecwrpj.exe
Size 389KB
SHA256 e2641eaa1be2cf6b5f7954ceb75410eabaa92b28bbfb7ecc2fe424eabdb12c68
MD5 8df42974f0480628a178a5c9d0eb873e
SHA1 2a523cf12959db17aa4e889d8a696b2bd52b2613
SHA512 a791d913115266fefb742457f031f78b1311857903bb8a4b2e4d6b9f33ac17eccf4e7fe2497902d8beb604556fd35fd76720d85ed25e58c9f528fc04c2a8d8b7
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnligdyv.exe

Path C:\Temp\yvtnligdyv.exe
Size 389KB
SHA256 15c5c76dc9afa8fabe3457deadfa045c639f289c69c31b0c74c2cab5974b8392
MD5 bfbc4265616a3d7053a7812103618f2e
SHA1 75d43b2a0d08432c0e238b3d0ad39fd7e5ef3b44
SHA512 5f3fd500a6391644b279f307efa1ec422517c6ee9709329fc67e40f436998ad4a1e4ec8cb079680b1fdbfeaf692a6b2df10a7758a3e7999b03c1021f6d7abe69
SSDEEP 3072:Ecuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBL0:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcausmkecxu.exe

Path C:\Temp\zxrpkhcausmkecxu.exe
Size 389KB
SHA256 fddb92050e1d204e8f4e013b09f2f9ef0a71b7af77d44eb5eb88857671c5959b
MD5 45529db0be6b242509a35240f8977fee
SHA1 51aff6676b10bdd5893175751f445a9d05e56819
SHA512 dd8bf40d15cb3730e2a68b33e64e7ed40fe55c7984c9cd27c150e611a7f5f3269550c46204da6ea51509efaae55a015aed1704aecad183981851fefeefd544b3
SSDEEP 3072:Iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T109847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcausmkecxu.sys

Path C:\Temp\zxrpkhcausmkecxu.sys
Size 293KB
SHA256 fac6fb9ee75e6ab9df7947476735b9f0365fbaa654dbfab189ea97a278df4f95
MD5 b300d501ac29bdb16922eb086de2aebf
SHA1 f257dbe15dfaff8e2e3f7ea51b8e6cf9b187108a
SHA512 d35c1c40dca7c9027852d7ee61090790334935f8d04baf9252f0ddb52af10d2ca61c362951b06fd3d878e1c33cb7d2af655544b414d558891ef028f2906476d7
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c5a436f141da280a4eabbffaa925419d2ae6cb5d09c31201808a0a6ba929a53d
MD5 13d8c6e0bd240e8a530c3dc26ea5d1a6
SHA1 45b1b136617c371df64ec3bd3ce0de01a61d203a
SHA512 e129a4803fde68ecfd12c629f21e9f86fb4c78bd3a56c35e1da42029de7f11cf69753b6ebf11af4bc27ee63b03f2810f2d30aeef64b68f39cc6f96a086de477b
TLSH
T18C711B5DCC6239B2DB2141B900D134B57BB42C429A07EE16185950FCFF8E78C63FA568
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595460.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595460.TMP
Size 3KB
SHA256 4ca23c90f1e13f505a789daad2f758771c7d1a5423401eca0e1c06eaea4c605d
MD5 c547a8c08baea6fdc6d55c02a19c35ba
SHA1 bb525464f2cda8609a9adddf41af4b57cbb891c7
SHA512 ec1354db90f97b9bf6a731a0990c1271694f676af5218a8d0f375a9d1e18a3235bcb4aa22212c9f300f16870501be2762a70ab6076e0d96f68623dca9960336a
TLSH
T11C711B5DCC6239B1DB2181B900E534B57BB42C429A07EE1A185950FCFF8E78C63FA568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1113a0dc4c61e711499b8a6eb36a76c035578599dcefe55aac454bcb76973526
MD5 81167051637d2a4a3779db890ca345b2
SHA1 8cee44ae94e8452cdda15f52bc058a9560e0c6d4
SHA512 a7484acabc123b57856326bbe17bf0f406a80f03e022fdd7808524e55e3a057dfeb2db95c01ba2f272762d22a956f34401d1e77092e5766a0df93d6b28b994da
TLSH
T16C41AFF3C3E8857D8A1155F4BB183E2BCE190915436C3D9AD9E49F1B93E2871E18194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 44d310a055eeaeade1cb0195daecde3c36d390528de0d1af5b464e397f1af6c8
MD5 bb12aed9068d77a0e2deefe5f57e37b2
SHA1 31fd4365917317ccd2957709fc29b8dc7b82cf24
SHA512 de25bfd248be216aecfd4777c37c6d63ceee790f7a03f715ca0f7379c38d165d07de8ec5bc0e5ace93495c3d083f8625e1e3ea2d2b37cf4b4941f0c4bf6a3b84
SSDEEP 192:sxRl/yM/jK1Ml8wcV/fwsrCGaYZ5GzoA8p9p/g6+WNCk9/YJKUGyR3IgtJ:sxRl5CV/fwsWGam57r/5//qRX3
TLSH
T11F62D915AA34597BCCDBD209FA557F53D6F85473A2901E48AAFC8A0C00E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d44b9b6052fc8ec57a334b76773d1045e93218acdc5ccf3ecd12c356863b0a86
MD5 fbcc3d8ea902edbad87d6ef2f2522cfc
SHA1 7fca29abbd34b03b8255259bbd9173d37d7c7c4b
SHA512 e8a2f014771a3d11f6de55f6d6d42507f7610c9b98643bfece5c917fc24aee53f4ad94c0835fe71ddaac77db28e7050ce46f4253ae24389c811c82d073342d24
SSDEEP 192:sxRO/yM/jK1Ml8UQtcV/fwsECEaYZ5GzoA8prp/g6+WNCk9/YJ8UGyR3IgD7J:sxRO5qSV/fwsrEam571/5//2RXR
TLSH
T12962D816A934597BCCDBD209FA517F53D6F85473A2940E48AAFC8A0C01E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5664708a81929f0c02b3ee557ed389bea26f41d191b69fe2fa32c118c64123ec
MD5 bbad1bbaa06a307d0cb071a19bc11ace
SHA1 90433bc73058ec6be12225c77a77259e09342ec6
SHA512 424e072f038671a047391dd13f179ff72dd0b6f4271750a6aa0525abcf9a4a09ebf87c87fec5b896cdd003e18e176c8a0a7911528a243b025b4f2b7b1562f328
SSDEEP 192:sxRO/yM/jK1Ml8wcV/fwsECGaYZ5GzoA8p9p/g6+WNCk9/YJKUGyR3IgD5J:sxRO5CV/fwsrGam57r/5//qRX3
TLSH
T11862D915AA34597BCCDBD209F6517F53D6F85472A2941E48AAFC8A0C00E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 869e934408216e21e43490705f9ac5ee2bc7f6fb7b98c453a9cfb8b329836b76
MD5 1a2e2d972550d7b92501e7d1759c5496
SHA1 f566123a0c20f72c2acaf81f51b3bd0f3c9dd674
SHA512 9b256c58c6c1792a666acb008cfa1c9216897bcce2a4c206f1d4723ec377b010739864f2a7c34f887d020d75365d57acc023e2f6952ba4a9ec7247bb0cfee0d6
SSDEEP 768:v1D8Pw7pLuL7e7WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/PHDZhQrol2ZF6:v1D8P8E7e7WgeEftqu1jakPHNh7Rd
TLSH
T1DBE2FC3B680CCB7E4F844A9CEC29BD9A6DE401CB96D8CD5447EA880C03C6AEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f15b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f15b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d32c6906cf346d991efbcbc535038037edb1a71eb52f9b4bfe61ad25464b53fa
MD5 967b3737f014a2296bb137a4aec79ef6
SHA1 d3d5547775324837d35fd9aff91d7daea5b8d7e2
SHA512 31d876c9b06a0494ab61a4d187e2a8bed7dbf6b5f0d714a82f97865de80824155e513bddde4130f001a5d6650c35959c1e9b64fa184b2ea7e57752512dd054f0
SSDEEP 768:oJjaeqD4MlshiLdMmi3F55GUtDVCgZSVCKPFECrBhpjcNjzn12bfJAzTj:oJqcjhIdMh3nD8gs0KPF1HRcJByJAr
TLSH
T12D13C075ACA46D738CB7E245B107B286BEB402E786C91E5CD9D89B0D45D73CE220BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 25d9be3f6399bee73c1744120a3fd830dbd5d17b86a4eadcd97da52ac24a382d
MD5 5ca9bb9e6c7fd656ccfc09294fda73fc
SHA1 95f485dff26948e8c71b10edc06086f4d18a1416
SHA512 8289ab337e960f0ee8f44e9d17d853d622cb78fdc6e5df90a0da4bf8d73a40b3f32c323571d15b2766043eed771792736b318a1aec88ef6c97ed9645e9d82bae
SSDEEP 768:bjaeqD4MlshiLdMmu39f5GUuVCgZSVCKPFECrBhpjcxi4+ApX32TB:bqcjhIdMB3S8gs0KPF1HRcQ4+KXk
TLSH
T1E903CF7AA8A45E738C77D645B207B1466EB842D7D2C92F8CD8DD6A0D41D73DE130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6af9566b86310a041ccc56b872de5e94bc7464703ff9ceec4cb9400a1fe1c7c8
MD5 3e323c35e9576c42e800a814e0b907df
SHA1 f2a3027798fcf75814e7a93e54f5f688a5945260
SHA512 958f027ea8150e1d346a5cf1843d9d71fb98bb48dce4686ce2360dc802dafc7e08aeb2215d45460132aaf1c78f83a9b8aa03c56edd01902ee3f708c02436748c
SSDEEP 768:JIj+9w3v55GUtDVCgZSVCKPFECrBhpjcNjzn12bfJAF:JX9w3ZD8gs0KPF1HRcJByJAF
TLSH
T1A3F2BF31A8A49E634CE7D298B1077285BEF852A792C90E4CD9DC9B0D49C739D270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c4b097202528f03ef88fc67b6a846d264dfade8dd38f87bb82ed735cb068f833
MD5 5ad9e587271a5f845b5c7a01fbe7dec9
SHA1 2ec8f71daf61d158c543f9034ae4763d3d7122b3
SHA512 f68b37caa4caecb430e74ef18e9a68614eeba325838340f2fa8836c24ba410e53395aa1b8464a8e6d6ae07afc3726e0613e18b0463cd6d016a0b145b9f2a4065
SSDEEP 768:oIj+9w3u55GUtDVCgZSVCKPFECrBhpjcNjzn12bfJAF:oX9w3AD8gs0KPF1HRcJByJAF
TLSH
T121F2BF35ACA49E634CE7D298B1077285BEF852A392C90E4CD9DC9B0D49C739D271BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa38a524-2365-4145-945f-5259aa416ef4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa38a524-2365-4145-945f-5259aa416ef4.tmp
Size 43KB
SHA256 229883de0d3c75a324524315af35dffbbcbbea1907936239989ad2841326334f
MD5 af1554c7631ff8f23e8ae6675cfe4251
SHA1 544bb31aae03de0741979cb55a4a121efaae414f
SHA512 b79ed5ccdbebe0f5a41047531fc70a1a6e58c0376b997df7aa32449a717e603473820d655cf2bb803c2dbedae3ef1263f78e7433ddf51999a648efcb8cdcf996
SSDEEP 768:xEF1j+9n3bwgC5kUt7VCgZSVCKPFECrBhpjcNjzn12bfJAF:xJ9n3M78gs0KPF1HRcJByJAF
TLSH
T107133AF598D38A36D8AE8787A33D6E459DBCC16371891988B7C85E4DCC832BFD206C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1640_899178394\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 606afdedb94dc30db6927dadb92b2994d54c106018ca84de40b6235d2523f18a
MD5 e1833de74162b1ebc3804938355a2893
SHA1 381e71a7e3849d8a6209490b3f1da3d1beb4b881
SHA512 88c5d775ff98a1b28004897932bbbcda4c226908ce7854948e6c6410fc666b393e07ff91645196c81443693bee796026990745c238c18448f014ec9397ce6cd3
TLSH
T16771008357A9C9B3C19A5FF002835248F1BB2278077330618B565546AA30A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/716-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1288-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1324-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1328-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1580-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1792-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1864-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2392-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2640-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2816-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3356-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3872-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3980-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-503-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5576-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5876-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6064-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download