systex | 9d68deca2290f54035e945f8270003a1f6da6797ec4b8d2c7ea938bde9a42a3e

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260718-ekepzaay6x
SHA256 9d68deca2290f54035e945f8270003a1f6da6797ec4b8d2c7ea938bde9a42a3e
MD5 4ba1aa9dc1d45532c3ff6387139edf18
SHA1 0edefab6dfc1157ffa35a6239b044b5489fa77f7
SHA512 3a23f0d8aa93bd63338b4b0ba78fd6d3af270e04a875228ff8f281664d21e19654d5c9cd9f71d183e9546f28260971a2dae2bb028fb4bffa484db5f270a838a2
SSDEEP 3072:dViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1148	mhezxrpjhezwupmk.exe
2552	mhezxrpjhezwupmk.sys
5964	CreateProcess.exe
3384	urmkhcxrhb.exe
1868	CreateProcess.exe
2092	CreateProcess.exe
2384	i_urmkhcxrhb.exe
5416	eywrojhbzt.sys
5484	CreateProcess.exe
4612	zwrpjhbztr.exe
4388	CreateProcess.exe
2588	CreateProcess.exe
1436	i_zwrpjhbztr.exe
6044	mgeywqojgb.sys
4176	CreateProcess.exe
5920	geywqojgbv.exe
5264	CreateProcess.exe
4760	CreateProcess.exe
4876	i_geywqojgbv.exe
4744	ywqolgdbyt.sys
1696	CreateProcess.exe
2968	tnlgdywqol.exe
5176	CreateProcess.exe
3052	CreateProcess.exe
4508	i_tnlgdywqol.exe
804	sqoigaywqo.sys
5688	CreateProcess.exe
4244	olgayvqoid.exe
3612	CreateProcess.exe
3056	CreateProcess.exe
3068	i_olgayvqoid.exe
4052	yvqnigdyvq.sys
4548	CreateProcess.exe
3564	qnlfdavsnl.exe
4716	CreateProcess.exe
3528	CreateProcess.exe
1848	i_qnlfdavsnl.exe
5168	nkfcxvpnhf.sys
4552	CreateProcess.exe
2940	pnhfaxspki.exe
4648	CreateProcess.exe
3220	CreateProcess.exe
6036	i_pnhfaxspki.exe
1996	spkicaxupm.sys
3320	CreateProcess.exe
1896	mkecausmke.exe
1648	CreateProcess.exe
5892	CreateProcess.exe
1236	i_mkecausmke.exe
1276	zxupmkecxu.sys
2244	CreateProcess.exe
1628	rmkecwupnh.exe
5812	CreateProcess.exe
3048	CreateProcess.exe
3200	i_rmkecwupnh.exe
6056	mjhbzurpjh.sys
4872	CreateProcess.exe
4808	jhecwromhe.exe
3732	CreateProcess.exe
1044	CreateProcess.exe
3908	i_jhecwromhe.exe
2408	gebwtrojhb.sys
2804	CreateProcess.exe
1528	bywuojheyw.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1329430193\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_691883271\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_691883271\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_91965044\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_91965044\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1414599941\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1414599941\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1414599941\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1414599941\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywuojheyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebzwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwromhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywuojheyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhezwupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgayvqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkhcxrhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwromhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxrpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkhcxrhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxrpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgayvqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebzwrm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3284	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4868	ipconfig.exe
1852	ipconfig.exe
4904	ipconfig.exe
5268	ipconfig.exe
4792	ipconfig.exe
2804	ipconfig.exe
4952	ipconfig.exe
1564	ipconfig.exe
4332	ipconfig.exe
5828	ipconfig.exe
2220	ipconfig.exe
4784	ipconfig.exe
3772	ipconfig.exe
2756	ipconfig.exe
4200	ipconfig.exe
1564	ipconfig.exe
6008	ipconfig.exe
5588	ipconfig.exe
5532	ipconfig.exe
4724	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288207918185249"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{342D3438-810A-4B11-AE17-CF2906EF24B5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe
1148	mhezxrpjhezwupmk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	i_urmkhcxrhb.exe
Token: SeDebugPrivilege	1436	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	4876	i_geywqojgbv.exe
Token: SeDebugPrivilege	4508	i_tnlgdywqol.exe
Token: SeDebugPrivilege	3068	i_olgayvqoid.exe
Token: SeDebugPrivilege	1848	i_qnlfdavsnl.exe
Token: SeDebugPrivilege	6036	i_pnhfaxspki.exe
Token: SeDebugPrivilege	1236	i_mkecausmke.exe
Token: SeDebugPrivilege	3200	i_rmkecwupnh.exe
Token: SeDebugPrivilege	3908	i_jhecwromhe.exe
Token: SeDebugPrivilege	3620	i_bywuojheyw.exe
Token: SeDebugPrivilege	4420	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	4904	i_igdywqoigb.exe
Token: SeDebugPrivilege	2764	i_davsqkidav.exe
Token: SeDebugPrivilege	3584	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	5104	i_kecxupnhfz.exe
Token: SeDebugPrivilege	5680	i_khfzxrpnhf.exe
Token: SeDebugPrivilege	4496	i_hbzurmhecw.exe
Token: SeDebugPrivilege	4856	i_romgebzwrm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1148	1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1312 wrote to memory of 4432	1312	2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4432 wrote to memory of 4732	4432	iexplore.exe	91
PID 4732 wrote to memory of 5860	4732	msedge.exe	92
PID 4732 wrote to memory of 5820	4732	msedge.exe	94
PID 4732 wrote to memory of 3284	4732	msedge.exe	95
PID 4732 wrote to memory of 5820	4732	msedge.exe	94
PID 4732 wrote to memory of 5820	4732	msedge.exe	94
PID 4732 wrote to memory of 4824	4732	msedge.exe	96
PID 4732 wrote to memory of 4824	4732	msedge.exe	96
PID 4732 wrote to memory of 4824	4732	msedge.exe	96
PID 4732 wrote to memory of 5324	4732	msedge.exe	97
PID 4732 wrote to memory of 5324	4732	msedge.exe	97
PID 4732 wrote to memory of 1536	4732	msedge.exe	98
PID 4732 wrote to memory of 1536	4732	msedge.exe	98
PID 4732 wrote to memory of 1536	4732	msedge.exe	98
PID 4732 wrote to memory of 108	4732	msedge.exe	100
PID 4732 wrote to memory of 3328	4732	msedge.exe	99
PID 4732 wrote to memory of 108	4732	msedge.exe	100
PID 4732 wrote to memory of 108	4732	msedge.exe	100
PID 4732 wrote to memory of 3328	4732	msedge.exe	99
PID 4732 wrote to memory of 3328	4732	msedge.exe	99
PID 4732 wrote to memory of 1528	4732	msedge.exe	102
PID 4732 wrote to memory of 1528	4732	msedge.exe	102
PID 4732 wrote to memory of 1260	4732	msedge.exe	104
PID 4732 wrote to memory of 4848	4732	msedge.exe	105
PID 4732 wrote to memory of 1260	4732	msedge.exe	104
PID 4732 wrote to memory of 4848	4732	msedge.exe	105
PID 1148 wrote to memory of 5964	1148	mhezxrpjhezwupmk.exe	107
PID 4732 wrote to memory of 3068	4732	msedge.exe	111
PID 3384 wrote to memory of 1868	3384	urmkhcxrhb.exe	112
PID 4732 wrote to memory of 4896	4732	msedge.exe	117
PID 4732 wrote to memory of 4896	4732	msedge.exe	117
PID 4732 wrote to memory of 1492	4732	msedge.exe	118
PID 4732 wrote to memory of 1492	4732	msedge.exe	118
PID 1148 wrote to memory of 2092	1148	mhezxrpjhezwupmk.exe	119
PID 1148 wrote to memory of 5484	1148	mhezxrpjhezwupmk.exe	123
PID 4612 wrote to memory of 4388	4612	zwrpjhbztr.exe	125
PID 1148 wrote to memory of 2588	1148	mhezxrpjhezwupmk.exe	128
PID 1148 wrote to memory of 4176	1148	mhezxrpjhezwupmk.exe	132
PID 5920 wrote to memory of 5264	5920	geywqojgbv.exe	134
PID 1148 wrote to memory of 4760	1148	mhezxrpjhezwupmk.exe	137
PID 1148 wrote to memory of 1696	1148	mhezxrpjhezwupmk.exe	142
PID 2968 wrote to memory of 5176	2968	tnlgdywqol.exe	144
PID 1148 wrote to memory of 3052	1148	mhezxrpjhezwupmk.exe	147
PID 4732 wrote to memory of 1648	4732	msedge.exe	149
PID 4732 wrote to memory of 2744	4732	msedge.exe	150
PID 4732 wrote to memory of 2408	4732	msedge.exe	151
PID 1148 wrote to memory of 5688	1148	mhezxrpjhezwupmk.exe	154
PID 4244 wrote to memory of 3612	4244	olgayvqoid.exe	156
PID 1148 wrote to memory of 3056	1148	mhezxrpjhezwupmk.exe	159
PID 1148 wrote to memory of 4548	1148	mhezxrpjhezwupmk.exe	163
PID 3564 wrote to memory of 4716	3564	qnlfdavsnl.exe	165
PID 1148 wrote to memory of 3528	1148	mhezxrpjhezwupmk.exe	168
PID 1148 wrote to memory of 4552	1148	mhezxrpjhezwupmk.exe	172
PID 2940 wrote to memory of 4648	2940	pnhfaxspki.exe	174
PID 1148 wrote to memory of 3220	1148	mhezxrpjhezwupmk.exe	177
PID 1148 wrote to memory of 3320	1148	mhezxrpjhezwupmk.exe	181
PID 1896 wrote to memory of 1648	1896	mkecausmke.exe	183
PID 1148 wrote to memory of 5892	1148	mhezxrpjhezwupmk.exe	186
PID 4732 wrote to memory of 4028	4732	msedge.exe	188
PID 4732 wrote to memory of 4028	4732	msedge.exe	188
PID 1148 wrote to memory of 2244	1148	mhezxrpjhezwupmk.exe	192
PID 1628 wrote to memory of 5812	1628	rmkecwupnh.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4ba1aa9dc1d45532c3ff6387139edf18_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Temp\mhezxrpjhezwupmk.exe
  C:\Temp\mhezxrpjhezwupmk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkhcxrhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5964
  - - C:\Temp\urmkhcxrhb.exe
      C:\Temp\urmkhcxrhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkhcxrhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2092
  - - C:\Temp\i_urmkhcxrhb.exe
      C:\Temp\i_urmkhcxrhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5484
  - - C:\Temp\zwrpjhbztr.exe
      C:\Temp\zwrpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2588
  - - C:\Temp\i_zwrpjhbztr.exe
      C:\Temp\i_zwrpjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\geywqojgbv.exe
      C:\Temp\geywqojgbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4760
  - - C:\Temp\i_geywqojgbv.exe
      C:\Temp\i_geywqojgbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlgdywqol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1696
  - - C:\Temp\tnlgdywqol.exe
      C:\Temp\tnlgdywqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\i_tnlgdywqol.exe
      C:\Temp\i_tnlgdywqol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgayvqoid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5688
  - - C:\Temp\olgayvqoid.exe
      C:\Temp\olgayvqoid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgayvqoid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3056
  - - C:\Temp\i_olgayvqoid.exe
      C:\Temp\i_olgayvqoid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\qnlfdavsnl.exe
      C:\Temp\qnlfdavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Temp\i_qnlfdavsnl.exe
      C:\Temp\i_qnlfdavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4552
  - - C:\Temp\pnhfaxspki.exe
      C:\Temp\pnhfaxspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3220
  - - C:\Temp\i_pnhfaxspki.exe
      C:\Temp\i_pnhfaxspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3320
  - - C:\Temp\mkecausmke.exe
      C:\Temp\mkecausmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5892
  - - C:\Temp\i_mkecausmke.exe
      C:\Temp\i_mkecausmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2244
  - - C:\Temp\rmkecwupnh.exe
      C:\Temp\rmkecwupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3048
  - - C:\Temp\i_rmkecwupnh.exe
      C:\Temp\i_rmkecwupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhecwromhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Temp\jhecwromhe.exe
      C:\Temp\jhecwromhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhecwromhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1044
  - - C:\Temp\i_jhecwromhe.exe
      C:\Temp\i_jhecwromhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywuojheyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2804
  - - C:\Temp\bywuojheyw.exe
      C:\Temp\bywuojheyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywuojheyw.exe ups_ins
    3⤵
    PID:3164
  - - C:\Temp\i_bywuojheyw.exe
      C:\Temp\i_bywuojheyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    PID:3260
  - - C:\Temp\dbvtnlgdyw.exe
      C:\Temp\dbvtnlgdyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    PID:5004
  - - C:\Temp\i_dbvtnlgdyw.exe
      C:\Temp\i_dbvtnlgdyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdywqoigb.exe ups_run
    3⤵
    PID:2068
  - - C:\Temp\igdywqoigb.exe
      C:\Temp\igdywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdywqoigb.exe ups_ins
    3⤵
    PID:3908
  - - C:\Temp\i_igdywqoigb.exe
      C:\Temp\i_igdywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsqkidav.exe ups_run
    3⤵
    PID:4604
  - - C:\Temp\davsqkidav.exe
      C:\Temp\davsqkidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsqkidav.exe ups_ins
    3⤵
    PID:5828
  - - C:\Temp\i_davsqkidav.exe
      C:\Temp\i_davsqkidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    PID:3888
  - - C:\Temp\snkfdxvpnh.exe
      C:\Temp\snkfdxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    PID:1932
  - - C:\Temp\i_snkfdxvpnh.exe
      C:\Temp\i_snkfdxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxupnhfz.exe ups_run
    3⤵
    PID:4952
  - - C:\Temp\kecxupnhfz.exe
      C:\Temp\kecxupnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfz.exe ups_ins
    3⤵
    PID:2824
  - - C:\Temp\i_kecxupnhfz.exe
      C:\Temp\i_kecxupnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxrpnhf.exe ups_run
    3⤵
    PID:2296
  - - C:\Temp\khfzxrpnhf.exe
      C:\Temp\khfzxrpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxrpnhf.exe ups_ins
    3⤵
    PID:3104
  - - C:\Temp\i_khfzxrpnhf.exe
      C:\Temp\i_khfzxrpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmhecw.exe ups_run
    3⤵
    PID:1300
  - - C:\Temp\hbzurmhecw.exe
      C:\Temp\hbzurmhecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmhecw.exe ups_ins
    3⤵
    PID:4420
  - - C:\Temp\i_hbzurmhecw.exe
      C:\Temp\i_hbzurmhecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebzwrm.exe ups_run
    3⤵
    PID:5060
  - - C:\Temp\romgebzwrm.exe
      C:\Temp\romgebzwrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebzwrm.exe ups_ins
    3⤵
    PID:1880
  - - C:\Temp\i_romgebzwrm.exe
      C:\Temp\i_romgebzwrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoige.exe ups_run
    3⤵
    PID:1936
  - - C:\Temp\lgeywqoige.exe
      C:\Temp\lgeywqoige.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4904
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff89711c188,0x7ff89711c194,0x7ff89711c1a0
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,5450754601535958711,15076838132395980069,262144 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,44274940713370467,555796915134037894,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
      4⤵
      System Time Discovery
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3300,i,9006009853435830232,11653212646803812828,2097152 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,534820029478246730,4128542799468097379,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:13
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3320,i,13917908155829245598,4104428801519390799,2097152 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1110186361179971696,17272502005812365247,2097152 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16471816077044830669,8167772034577157349,2097152 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
      4⤵
      PID:108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,11036684962424709830,5221028257142423051,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11837097684581606031,18414702123284529128,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,4790546941941661740,11444111351103406872,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6599889751350451486,1328407348211028657,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6599889751350451486,1328407348211028657,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,7862800511480954889,17578999029721004631,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,523886979246544936,9057427347148654649,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,4475692260491892187,18220784512365872776,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,5376833309856631573,13582493183985960229,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,1178877109710946610,696903934094806358,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,5610379570201526826,12439337976890475389,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,789545887643117530,6596792118807359013,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,11901233709250428253,2220611219379529065,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6064,i,9591150016917539971,17873264666539239428,262144 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:10
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,997377483164893466,16766792028021401944,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,2790084292180517447,8673348631504846597,524288 --field-trial-handle=2688,i,7125725100593736048,17688957220335784331,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14
      4⤵
      PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3584

C:\Temp\mhezxrpjhezwupmk.sys
C:\Temp\mhezxrpjhezwupmk.sys
1⤵
- Executes dropped EXE
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4944

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:5416

C:\Temp\mgeywqojgb.sys
C:\Temp\mgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:6044

C:\Temp\ywqolgdbyt.sys
C:\Temp\ywqolgdbyt.sys
1⤵
- Executes dropped EXE
PID:4744

C:\Temp\sqoigaywqo.sys
C:\Temp\sqoigaywqo.sys
1⤵
- Executes dropped EXE
PID:804

C:\Temp\yvqnigdyvq.sys
C:\Temp\yvqnigdyvq.sys
1⤵
- Executes dropped EXE
PID:4052

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:5168

C:\Temp\spkicaxupm.sys
C:\Temp\spkicaxupm.sys
1⤵
- Executes dropped EXE
PID:1996

C:\Temp\zxupmkecxu.sys
C:\Temp\zxupmkecxu.sys
1⤵
- Executes dropped EXE
PID:1276

C:\Temp\mjhbzurpjh.sys
C:\Temp\mjhbzurpjh.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\gebwtrojhb.sys
C:\Temp\gebwtrojhb.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\jgbztoljdb.sys
C:\Temp\jgbztoljdb.sys
1⤵
PID:3476

C:\Temp\igdbvtqoig.sys
C:\Temp\igdbvtqoig.sys
1⤵
PID:2636

C:\Temp\idbvtnlfdx.sys
C:\Temp\idbvtnlfdx.sys
1⤵
PID:940

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
PID:5248

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:2224

C:\Temp\mkfcxupmkh.sys
C:\Temp\mkfcxupmkh.sys
1⤵
PID:5924

C:\Temp\kecwurmjhc.sys
C:\Temp\kecwurmjhc.sys
1⤵
PID:296

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
PID:1492

C:\Temp\wuomjhezwr.sys
C:\Temp\wuomjhezwr.sys
1⤵
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eywrojhbzt.sys

Path C:\Temp\eywrojhbzt.sys
Size 293KB
SHA256 70160abea4ef61ae5b15f5c35094eb0e4f66b2e9f24148b64c0a92ae2a7ec919
MD5 5bc88d40c807a0023556ca10a405a384
SHA1 c18f7bd52fd27857e12e391b335272c39325477e
SHA512 d5d6a7d0ba1cce25ec6df42ca70f96ba3b771c571629ef9f20dd2e21af4e4e6046af2ab1eca27de14cbffd273db9cbe933a73602f0053a2da13f9f87172721bb
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbv.exe

Path C:\Temp\geywqojgbv.exe
Size 376KB
SHA256 2fb1792add5e9b7657a3b25abae620d42ef186d6ee768ffd8507fbb586f48998
MD5 246982d3ecaa890ce86c49d467867e6c
SHA1 e2a1689398a0b01cdf0eb44628a534d05a2a729b
SHA512 94f86e1adcaaa6d2cc48dbed4abb008813fb1c2f25e306cbba3746f208d49571e2f0131ab8074759c2ed660387eab8201b4c3792908f5346a7cdd1fe6ef07f25
SSDEEP 3072:DViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqojgbv.exe

Path C:\Temp\i_geywqojgbv.exe
Size 376KB
SHA256 65d119307620d05d95be832ce3b8e1a99d4cf79dc2ac9e714ddce56b20f1f0c5
MD5 b3e2a03bd2114d20d7a9de2a13dfc922
SHA1 1c1b1331b6f21629effd3e55d43dd3b56f732d51
SHA512 64085ce9f5c609d0db0dcac9768c29242e5a554a4ff584f1c767666fded6f1aca3278018d8b51806695c30e71d14e0a495748b72975f76aa4e1296b633ec92ec
SSDEEP 3072:AViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgayvqoid.exe

Path C:\Temp\i_olgayvqoid.exe
Size 376KB
SHA256 9e302717278a021a39411434e26093cf26fe7aca0b8c000d329ba6f5e19cfa31
MD5 5eaa290941e0d52bfa40772354bb1a83
SHA1 bb9e43544600ef56395b6c9920539c59b6ecab36
SHA512 69237cabec1ed219f02a29aebf22cfb386d2cf5fe0d679ebcb4d72c0ee18a0d321dbce2e71250944872c6492da3058895a469091185ba10f568c1ca0ac782bfd
SSDEEP 3072:XViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdywqol.exe

Path C:\Temp\i_tnlgdywqol.exe
Size 376KB
SHA256 8d54607f3181b9a81059287b5b2dd121b387fc08334b2d6bdf7d2a1bda462ef6
MD5 005051d45c0a53b0be9a462a6518d850
SHA1 1d0706894332362d52deeacbfcd86fe2de11ff4a
SHA512 7a8a893e968298cd30e8c4e54ec2cdd0012161a1302e275b51cbbde4401ca7389a5b40bbc0c2eb1f0f794a46bb64be11da55f40f49170d0d7d0c273ecc1bcbf1
SSDEEP 3072:qViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14C847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkhcxrhb.exe

Path C:\Temp\i_urmkhcxrhb.exe
Size 376KB
SHA256 d664141940690ff9a5effda43c297603f20bb09e723c05c2b98c38c812a9f8fc
MD5 03df95384c62ec725dd5cbbb03d2d4f7
SHA1 fbb97d9fe1070ef50bf4eff980244add58a650ce
SHA512 64a1fa0f9ebfea6624f8a759892faf11fd557d6d71563a0917c59cb93cf70b6693f45a725972a2d886f98791ff7f16b1499f3dbc898b347573d702b19af1046b
SSDEEP 3072:vViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DA847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjhbztr.exe

Path C:\Temp\i_zwrpjhbztr.exe
Size 376KB
SHA256 238c37a2ed6d27ebb097e5736c8cd89e32d35ee6f3b2f2e877e2849f8cff91da
MD5 925c18207c85cb3a29005292e8b2066f
SHA1 4cd09462a6b319c07bf5266116a65383ec6c315c
SHA512 06b20905a91b9f52f2a5c84699366d929db85e2652fb83fa44e4049dfc233e809b78ab75a662589a6fbeec61bd5d2e8492ff52d4b74b261586ae2f208bf7a468
SSDEEP 3072:zViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojgb.sys

Path C:\Temp\mgeywqojgb.sys
Size 293KB
SHA256 ccc668112291827ebdd81085d4ac39c1bf8619d2358a0d66c077809248ef6781
MD5 159b1b3d3b26e7d89133b47a5060c98e
SHA1 adb8656b9b5c77634011795702ac60712cf92932
SHA512 6439c20381eae38410e593f5f3220390fffb9e8c453f8a27b0250507843aea11b40c4e3200312d3f7603ca0863d0b34c962ee26cca7162bcb835c94556f9e4e0
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T181545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhezwupmk.exe

Path C:\Temp\mhezxrpjhezwupmk.exe
Size 376KB
SHA256 bf9eda5df4d9b9d0e3c5a9a623ae7ba66861bd99513d35d420f396e82e8c72a9
MD5 99c1ae89de558e4c4960ff99f681873b
SHA1 5ce7397aaa3c610bd7747d537698df0d61ad4c01
SHA512 ee1f75ff98ea98626e00e25b4cd011918fa0238b89e44592ebea649e39be8a3245f56d2c844ae02a3facc5cd002062b0ce102ddc3e0838ee3f1871cecfa9ac9f
SSDEEP 3072:dViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhezwupmk.sys

Path C:\Temp\mhezxrpjhezwupmk.sys
Size 293KB
SHA256 6e67350acf544e54768f60526f7177c49919adcbcc1388cae84587622a6c4628
MD5 aabe7dc53878e7d1134f7bb1066891ba
SHA1 b68090fa830984c8bda3b0ad029aa26b0b07e671
SHA512 e9030843c57d7020450b561dfb3ba486ac63ff96beaa11380cbd3458834343a3004bca58f6928969a225f062e54865e9d32cdec30c03d5add73b6de60d903889
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgayvqoid.exe

Path C:\Temp\olgayvqoid.exe
Size 376KB
SHA256 8b8ad14d7e8118cfcc18dce42788473c5aa43f7a819867c6a0e0d00c10077f1f
MD5 929611527f78bb82f25ea2170041ba3f
SHA1 ae914bb7133ea7ef0b4ef5c948705a75b224c3e4
SHA512 b7e35d142d4b890a2205478f2d3bc2d5676a2cbb22e27cb9f43fba07881c985e733303fe93db2210fcae236b6a80361609abe99b1ed977374ca80a463b1cfb31
SSDEEP 3072:yViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdavsnl.exe

Path C:\Temp\qnlfdavsnl.exe
Size 376KB
SHA256 a0303fa1558c5c97d1a00c433fb7f996890b6d42859d84230e646b951b5de896
MD5 33ceae11472d4bab50e82c9ef7b7c578
SHA1 9c7cb68d5b14db8705841f33791c4d954c60f98a
SHA512 e1f00da6c9cd155cecbd9d1f4d7e897cb0ff7f0d9d5f41ab7d647c236b5a2457562f6372ce1458da8fcf85b3bcacb73089d3e8e53156a4949c4fad9a297f9265
SSDEEP 3072:YViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqoigaywqo.sys

Path C:\Temp\sqoigaywqo.sys
Size 293KB
SHA256 47b6d0e057dd754c4f100081f27ed99936cfeb802b80633c0498c3db880dc52c
MD5 3cab70992e41bb9382d1dc6916b9ee33
SHA1 549bc8931f0452f02ff7e9a1dc1a0e7133dbf0c9
SHA512 ca2664f487e48f63fc8701d8080b0a3dc54a9757d7a3595c0bab194b500466ccf916b846af647d2baa2de21dcdbfda05fb581266b6093106fa5c4fcf3394998e
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqol.exe

Path C:\Temp\tnlgdywqol.exe
Size 376KB
SHA256 75837433a5a67a85e86b8cfc4089cfac32e377b2810f7f3f04d2617df37e526b
MD5 9153dc91579d07e34026c10f2e6ecd4d
SHA1 255bbafcacc41a8f026af4890a710843ae190651
SHA512 1c497ff46cd47ac1c2fffd29325ad831a691d2106ef9e23d229516685c1847aea46d9ddda6ac24b29aaf55b264b8444ea8bbf3e21a3ea0c282b08900c2896546
SSDEEP 3072:zViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkhcxrhb.exe

Path C:\Temp\urmkhcxrhb.exe
Size 376KB
SHA256 2849d0636e340ac08cf8cd134ae7f1effa156b0cb1e440c7fe1ef9bd2ca20132
MD5 23f1461832db5d2a6a727e616cfccd44
SHA1 d51f2685b3981ff882d131f3f2be8b3556d7e838
SHA512 3d618124c34435517b855e6229945012f1802c781ec24947f31af2e27fb807d9f97a40b694fe3bef25d836c9c21e6b961d53942b92e81a509e740f2699536de7
SSDEEP 3072:pViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigdyvq.sys

Path C:\Temp\yvqnigdyvq.sys
Size 293KB
SHA256 42a90826a1a754f6d2e274f1d287f1260723085b14a460e7f75029a44f825c88
MD5 47e9de5ca44fdf1f5abec79aefcc21c1
SHA1 8fa5fadf0bdd9a5c17ca3ff7b1bb4e2c7c35a8a6
SHA512 62e57951f2e30e6a31386241bc05f9f1740c278faa9f088a82630ab94eea44aca24472b5b1a11e1544a15f133bd8a8410683737ced3e19c8a70a4d1994ac8b43
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T133545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqolgdbyt.sys

Path C:\Temp\ywqolgdbyt.sys
Size 293KB
SHA256 951171c949b55d25d175ab0735bcbdab3249fc04c9db346d6c7928ab1fdc17e3
MD5 e86f040881c252836ea032da27dbe7cf
SHA1 672b2164caeaea0694ee57736fa116bf5565a5a9
SHA512 ac3ed25bfef6b2f0f7e149e6817fd54d7e7c8403742bddc810af6a6a0475469f6d93541e176c3e65d0d6a79bf5d5276b058d00d1e24d820cb2cde2f508399d85
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T18C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbztr.exe

Path C:\Temp\zwrpjhbztr.exe
Size 376KB
SHA256 33fbf6ac76107feb7b7417662a7dfa9a90836131bfe0aef100dddcd5e819f2e4
MD5 b73316ffd6acd82895d3d15b8a1d203a
SHA1 f813678b7aab63dcf0584a755ac9bd76164fa684
SHA512 f613f58883a116622852b379c4e5cb56b11b046b0bf42faf4b8cbcae20d4f964fd7b6e68dfeac083789db70e83212bca6d89a9c33c55942b7bfc14b587d3962e
SSDEEP 3072:uViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 452cbbec59f9df6cf71220eb2d979ad464dda9377dc6e87613085bd500e74125
MD5 2dcab1e34e63c3999c469c3d852d246d
SHA1 2ff25abefe5fc5aaa2d3c1aaddd9de7a53373019
SHA512 089392d2095b098558a20b210cbd77b86d308ab212bd658c84bf997f7bc90db14a9067ba19c37ed7bf3f7b8657dc4fdcc2061b10a8c66857bd96c01700168d39
TLSH
T15051957133263FF2DBFA497232E1625832FDC44902BB1E25B0906D345C6AF99E9D5063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596eed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596eed.TMP
Size 2KB
SHA256 0dcebc7567d741c4dab0add626a01d9750877d93a9aa40211601d571f8f4bf9c
MD5 a46d1808fb6a9507624129137c76a683
SHA1 dc9f9266153e8b0381572552d118b44305771d69
SHA512 2ec0d34643674ddec28a64eaa754c710976e05cbbbceb818905be2bd6672441501d658d25442764126a58891ed4e48e31b1d3ad19fa80d9cd9b696229afa587f
TLSH
T18551957133263EF2DBFA497132E1625836FDC44A01BB1E25B0906D345C6AF99EDD5063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 01c37f30a2e8ebd8112f140c2d7adaf6fc1114628d063380190b72c38b2f6d44
MD5 7c93413244d5e9ef1a5b7a1e4c337b50
SHA1 d22ed6fb552c93ca75a1643a5f3fe7c7e866af59
SHA512 0ea82f9ae532af178224fbb7e1bac8b79ec4de717b56ef133e973bedc27a16e3e7770d93e5a7309f5210f728ddd3b8baf8a23df2dd5dbc639c10893685bfec9f
TLSH
T1A1519EF3C7E8866D890156F0AB147E2BCE2D0954432C3D5AC9E4AF2BA3E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5357c0343296cb3d3943368022a86340c2c09b5209dc54071e315e5f514288a3
MD5 090ef5aa393d05531983cc6f98dfd398
SHA1 c9e2008057b1de54b6f9bfd7f9b40d43f49fa649
SHA512 383eebad235a9ae1b5ee4ac00e72122fbbbc1c1d2f8bd903b908ba07797621f6b9c18ca44c5c4d99473958ea99105b54ec39e05912b6f43ce07364f24b69b10a
SSDEEP 192:sxR7RzC3/frsILGGrZCZJtzoD8p9I/g6+WNCsL/YCuuOwG8IgtJ:sxR7g3/frsILrFCZru/51/As3
TLSH
T10232B7166E289D3B5CC7D21DBB65BF93D2F95032A1D01E48EBFC861C18EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 75739a0f469d1002641253db30e52b3bedfe5d8390415492e62bcc0cb1c5ab6d
MD5 488e8c291e0eb961f83eed55ffb6075b
SHA1 9da8d8faa70f507cdbe2b653d7d1f989fab8af36
SHA512 5092596677914f7497022dcd0c61b305eb363e3b4f4a80752d867c5b5d3ebbc4c7bb9f7ecf320fc9fe4fe7dced753062dfd3a3584a8e5c72ed9d1fb5234ab457
SSDEEP 192:sxRARzC3/frsfLGGrZCZJtzoD8p9I/g6+WNCsL/YCuuOwG8IgDCaJ:sxRAg3/frsfLrFCZru/51/AsmW
TLSH
T10E42C7166E289D3B5CC7D21DBB65BF93D2F95032A1D01E48EBFC861C18EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8fc335ecb480362ac536ae45724f7e679860e65349a914e714035815a013895d
MD5 542b4d09c97d8d76b2d2857c05497d39
SHA1 007e0afe1ca81c05583195fd71777781113740e7
SHA512 0ae2deea0815b3337e0addd358e5babe60c9fbe14eb1ffd471353802a51e2a66925b930ef229a5495d984581266343ba4af32a9e695cbcc24425db1d6aab99dc
SSDEEP 192:sxRARzC3/frsfLGrrZCZJtzoD8p9I/g6+WNCsL/YCBuOwG8IgDC8J:sxRAg3/frsfLuFCZru/51/Jsmg
TLSH
T1A942B7166E289D7B5CC7D21DBB657F93E2F95032A1911E48ABFC8A0C18EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 91df6cfc520958b65d33c40107932b735f73b40ed1d63b911044cccc10ec7bbe
MD5 fb4ae29dcc714b286002e3b3863155ae
SHA1 d58fc161acabfd24516733d99be1c4ebd1381168
SHA512 391498b2c09f82c4c6b89173a43d7f374ab0359cca24ce34712837c4e9e67acc818456481d28fd8f1b75e371a633f57cfa7b0edfd2b291a096abf0f3c1ec8125
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEh0QqcUroZ/M:jC+vf7E7JQWgQ+f4+u1jaHh0Vc/q
TLSH
T1EFD2EA7B640DCB7F4F804ADDAC197E9A6DA802CB9698CD5047FE841C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0b7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0b7b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 92f6014a1174c2bc44ae876c9a28943a276d2b919a2b3b4a77334b5886f2d28c
MD5 3ea2fd693d869a88077b5731fb9d6924
SHA1 a60478d5fbb00d9836c2880a564c4368991ec8f1
SHA512 156d9f75c32bab3dadd0871028f74e329481582f885882e001894c8fa29fd5c5cf5cacbf48ba6a6be867f0e07b7c05b3abbcf4d8d359c3a6a6a974f5b915ba81
SSDEEP 768:7rv+4UNbdz3c/yLUFCtQVap8+p3bd66j+4BRv86aLIWCTK:7bsbF36/E8+p3Z6n4you
TLSH
T1D503AE72E869CD339CF6C644B2863A837FF411A395C00E98E9D96B4D05962AE170FC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7a19f1e6a738949a551eb0b3921fa7b21e8d9f7e38ac745ccf43bccb1bb13c22
MD5 01e1b8cdd279786c836b945e2c3d729c
SHA1 0f39fe9b82a34e148ac0fef7d8d3e1291111a8a1
SHA512 5d933e0d50918db8183b99f60126fd498149270fb03c78471bb477efc66149b2e95f5146f4fefa079299b55af0a040dcb744d0a14124e4fc5753b689f21846d2
SSDEEP 768:Ej+9h3e/2UFCtQVJp8+p3bd66j+4BRv86aLIWCb9M+:T9h34P38+p3Z6n4yob++
TLSH
T100F2AF72E86ACD338CE5C65472963793BFF411B396C00D98D9D9AF0D09872AD170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89ec41019e653fcc7bc85bf8938e3cb428086a46d7caa08b4ffcd5d246e10f79
MD5 dcd195d753cf14d38a76d3baa7351f69
SHA1 9b07bcaf169be49e54303e12694f2cc127e63372
SHA512 0768f16ccf1185f5687749b8b32f5dedc95821a60e72e74c9c7a7768a78f55afcc0b51fda29a7dc9eedf449a4b4cb259a451d377a3e24d9c9d180413830e8891
SSDEEP 768:Qj+9h39/2UFCtQVJp8+p3bd66j+4BRv86aLIWCb9M+:v9h35P38+p3Z6n4yob++
TLSH
T13FF2AF72E86ACD338CE5C65472963B93BFF411B395C00D98D9D9AF0D09872AD570B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 db05a420a610a924343c554580d52aeb4b99e6cbf0ae1422942f5258e7b736d0
MD5 629e612d40d23045857ebfadfc908c9f
SHA1 b01da8619933a173f61781af2de3b906c58f8062
SHA512 b5925e28bb30eda180d632e4bf405c284d87e672e0f7fe8c67e885c6b7231c8c4c109a8027e40fe7e624f882634da7da0b9651938fb8b5bd1241597d1873f282
SSDEEP 768:Irv+4UNbdD3icFCtkNp8+p3bd66j+4BRv86aLIiX2bwCl1:Ibsbp3dL8+p3Z6n4y90ww
TLSH
T1C203BE73F96899339CF6C644B24676437FF851A396C10AC4D5DD2B4E019A29E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2df71fdc332e612473cedff10058390ab21353d8f697aa8c0853c9642bf67239
MD5 6452349950af97d5dbb54eb55b1ffeba
SHA1 ef35147ab11b3b0d31130dff00a3a9574efbe9af
SHA512 5b297eb5360195a6c13ac9d5f2a276689820bc77106e4aa748a583d26a116fc49ca1e16c7898564e714c4c6d2181a2f95de99e44c476f077b60367ccc00ab51a
SSDEEP 768:3F1j+9H3fwge/QgbCtQ0p8+p3bd66j+4BRv86aLIWCb9M+:+9H3OU8+p3Z6n4yob++
TLSH
T16E135CF298D78937D8AD8747737E2E82AEBCD163B5800984B7C95A0DCD431BFC606825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

ffd4ef93-21f5-4c8a-bb98-270d1139a5c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ffd4ef93-21f5-4c8a-bb98-270d1139a5c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4732_1179337471\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 019be14d99aabdcea154e61fa995dee6edaa76d7cfe1afda88b63790c7411faa
MD5 dd242b35cfb47d6b11074f30136377c7
SHA1 c69fdc3a4a68087a4f73cc2eb3ceaf77b1504efa
SHA512 ce6586efaa2ce924127882d648623db2cc2983acb12cc463c0e528937783e6ebb1492c815bad2b9c831f8a26766317f585c113a30ab6ae37fc3600e0af3f383e
TLSH
T1AC71238356B8D9F2C1DA5FF402835644F5FF223C0B63702047555546AB30A7E24B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/800-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/804-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/804-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/940-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1276-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1492-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1996-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2224-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2552-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2636-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4052-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4744-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5168-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5248-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5248-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5416-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6044-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6056-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download