systex | 36d66a77157745270d7226fb74135212a750fc68e0da23b1f4bc842ada1e1bb6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260720-b4vzhset3x
SHA256 36d66a77157745270d7226fb74135212a750fc68e0da23b1f4bc842ada1e1bb6
MD5 2b497c708f98e3db9aa9d305cd9fd6e9
SHA1 4c6f67c09c888245427d248dda1acc6d83c3271d
SHA512 94f388e653a8ade21e9a37d73c686a3ed50f518d6a899d12a5ad13b4d8202cf2b38a28b24a178e148c9be770994823628d85f6c0e700707c2da34efeb654ef25
SSDEEP 3072:WuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2956	rljdbvtqojgbztrl.exe
3536	rljdbvtqojgbztrl.sys
2596	CreateProcess.exe
1132	tomgeywrog.exe
1392	CreateProcess.exe
3472	CreateProcess.exe
2800	i_tomgeywrog.exe
4460	oigayvqoig.sys
5500	CreateProcess.exe
5276	idbvtnlidb.exe
4160	CreateProcess.exe
5152	CreateProcess.exe
3292	i_idbvtnlidb.exe
5428	ifdxvtnlfd.sys
2672	CreateProcess.exe
2656	fdxvtnkica.exe
124	CreateProcess.exe
2332	CreateProcess.exe
4412	i_fdxvtnkica.exe
5208	usqkicausn.sys
1428	CreateProcess.exe
3580	pnhfaxsqki.exe
2800	CreateProcess.exe
2120	CreateProcess.exe
4308	i_pnhfaxsqki.exe
5560	pkicaxspnh.sys
5008	CreateProcess.exe
3588	hczxupmkhc.exe
476	CreateProcess.exe
3592	CreateProcess.exe
2960	i_hczxupmkhc.exe
5780	smkhczusmk.sys
4184	CreateProcess.exe
6112	smkecwupmh.exe
4364	CreateProcess.exe
3028	CreateProcess.exe
3116	i_smkecwupmh.exe
1936	romhezxrpj.sys
1344	CreateProcess.exe
6048	rmkecwuomh.exe
3748	CreateProcess.exe
2344	CreateProcess.exe
5888	i_rmkecwuomh.exe
4944	jdbztromge.sys
5412	CreateProcess.exe
3756	jgeywrojhb.exe
5916	CreateProcess.exe
5976	CreateProcess.exe
5560	i_jgeywrojhb.exe
5396	qomgbztrlj.sys
3132	CreateProcess.exe
3192	dbvtnljdyw.exe
5648	CreateProcess.exe
3412	CreateProcess.exe
5572	i_dbvtnljdyw.exe
5208	dbvtolgdbv.sys
2064	CreateProcess.exe
3420	yvtnljgayt.exe
4780	CreateProcess.exe
5832	CreateProcess.exe
1328	i_yvtnljgayt.exe
5352	dbvtnigays.sys
1220	CreateProcess.exe
5164	bvtnlfdxvq.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1675289091\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_910987051\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_163628408\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_814431938\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_814431938\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_814431938\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_910987051\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_163628408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_814431938\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywrog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxupmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnljdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxupmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywrog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnljgayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnljgayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnljdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2028	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4164	ipconfig.exe
4604	ipconfig.exe
5364	ipconfig.exe
5516	ipconfig.exe
4508	ipconfig.exe
5672	ipconfig.exe
4256	ipconfig.exe
2936	ipconfig.exe
4892	ipconfig.exe
5284	ipconfig.exe
240	ipconfig.exe
2424	ipconfig.exe
4912	ipconfig.exe
4600	ipconfig.exe
5208	ipconfig.exe
6092	ipconfig.exe
5196	ipconfig.exe
3896	ipconfig.exe
1128	ipconfig.exe
4816	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289853560737559"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{ED3E141B-A313-4149-B89A-C8EFB2451A6B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe
2956	rljdbvtqojgbztrl.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	i_tomgeywrog.exe
Token: SeDebugPrivilege	3292	i_idbvtnlidb.exe
Token: SeDebugPrivilege	4412	i_fdxvtnkica.exe
Token: SeDebugPrivilege	4308	i_pnhfaxsqki.exe
Token: SeDebugPrivilege	2960	i_hczxupmkhc.exe
Token: SeDebugPrivilege	3116	i_smkecwupmh.exe
Token: SeDebugPrivilege	5888	i_rmkecwuomh.exe
Token: SeDebugPrivilege	5560	i_jgeywrojhb.exe
Token: SeDebugPrivilege	5572	i_dbvtnljdyw.exe
Token: SeDebugPrivilege	1328	i_yvtnljgayt.exe
Token: SeDebugPrivilege	6100	i_bvtnlfdxvq.exe
Token: SeDebugPrivilege	4228	i_xspnifaysq.exe
Token: SeDebugPrivilege	812	i_pnhfzxspki.exe
Token: SeDebugPrivilege	5780	i_usmkhfcxup.exe
Token: SeDebugPrivilege	1208	i_rpjhbzurpj.exe
Token: SeDebugPrivilege	4108	i_rmjebwuomg.exe
Token: SeDebugPrivilege	4572	i_romgebomge.exe
Token: SeDebugPrivilege	5780	i_wqoigbytrl.exe
Token: SeDebugPrivilege	3560	i_qoigdbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2956	5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5048 wrote to memory of 3152	5048	2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3152 wrote to memory of 4104	3152	iexplore.exe	91
PID 4104 wrote to memory of 1860	4104	msedge.exe	92
PID 4104 wrote to memory of 2868	4104	msedge.exe	93
PID 4104 wrote to memory of 2028	4104	msedge.exe	94
PID 4104 wrote to memory of 2868	4104	msedge.exe	93
PID 4104 wrote to memory of 2868	4104	msedge.exe	93
PID 4104 wrote to memory of 5156	4104	msedge.exe	95
PID 4104 wrote to memory of 5156	4104	msedge.exe	95
PID 4104 wrote to memory of 3000	4104	msedge.exe	96
PID 4104 wrote to memory of 3000	4104	msedge.exe	96
PID 4104 wrote to memory of 3000	4104	msedge.exe	96
PID 4104 wrote to memory of 1948	4104	msedge.exe	97
PID 4104 wrote to memory of 1948	4104	msedge.exe	97
PID 4104 wrote to memory of 1948	4104	msedge.exe	97
PID 4104 wrote to memory of 3512	4104	msedge.exe	99
PID 4104 wrote to memory of 3512	4104	msedge.exe	99
PID 4104 wrote to memory of 3512	4104	msedge.exe	99
PID 4104 wrote to memory of 2284	4104	msedge.exe	100
PID 4104 wrote to memory of 2284	4104	msedge.exe	100
PID 4104 wrote to memory of 2284	4104	msedge.exe	100
PID 4104 wrote to memory of 2584	4104	msedge.exe	101
PID 4104 wrote to memory of 2584	4104	msedge.exe	101
PID 4104 wrote to memory of 2228	4104	msedge.exe	105
PID 4104 wrote to memory of 2228	4104	msedge.exe	105
PID 4104 wrote to memory of 3916	4104	msedge.exe	106
PID 4104 wrote to memory of 3916	4104	msedge.exe	106
PID 4104 wrote to memory of 2608	4104	msedge.exe	108
PID 2956 wrote to memory of 2596	2956	rljdbvtqojgbztrl.exe	109
PID 4104 wrote to memory of 5636	4104	msedge.exe	111
PID 4104 wrote to memory of 5636	4104	msedge.exe	111
PID 1132 wrote to memory of 1392	1132	tomgeywrog.exe	113
PID 4104 wrote to memory of 1508	4104	msedge.exe	116
PID 4104 wrote to memory of 1508	4104	msedge.exe	116
PID 2956 wrote to memory of 3472	2956	rljdbvtqojgbztrl.exe	119
PID 2956 wrote to memory of 5500	2956	rljdbvtqojgbztrl.exe	123
PID 5276 wrote to memory of 4160	5276	idbvtnlidb.exe	125
PID 2956 wrote to memory of 5152	2956	rljdbvtqojgbztrl.exe	128
PID 2956 wrote to memory of 2672	2956	rljdbvtqojgbztrl.exe	132
PID 2656 wrote to memory of 124	2656	fdxvtnkica.exe	134
PID 2956 wrote to memory of 2332	2956	rljdbvtqojgbztrl.exe	137
PID 2956 wrote to memory of 1428	2956	rljdbvtqojgbztrl.exe	142
PID 3580 wrote to memory of 2800	3580	pnhfaxsqki.exe	144
PID 2956 wrote to memory of 2120	2956	rljdbvtqojgbztrl.exe	147
PID 4104 wrote to memory of 5764	4104	msedge.exe	149
PID 4104 wrote to memory of 4508	4104	msedge.exe	150
PID 4104 wrote to memory of 5880	4104	msedge.exe	151
PID 2956 wrote to memory of 5008	2956	rljdbvtqojgbztrl.exe	154
PID 3588 wrote to memory of 476	3588	hczxupmkhc.exe	156
PID 2956 wrote to memory of 3592	2956	rljdbvtqojgbztrl.exe	159
PID 2956 wrote to memory of 4184	2956	rljdbvtqojgbztrl.exe	163
PID 6112 wrote to memory of 4364	6112	smkecwupmh.exe	165
PID 2956 wrote to memory of 3028	2956	rljdbvtqojgbztrl.exe	168
PID 2956 wrote to memory of 1344	2956	rljdbvtqojgbztrl.exe	172
PID 6048 wrote to memory of 3748	6048	rmkecwuomh.exe	174
PID 2956 wrote to memory of 2344	2956	rljdbvtqojgbztrl.exe	177
PID 2956 wrote to memory of 5412	2956	rljdbvtqojgbztrl.exe	181
PID 3756 wrote to memory of 5916	3756	jgeywrojhb.exe	183
PID 2956 wrote to memory of 5976	2956	rljdbvtqojgbztrl.exe	186
PID 4104 wrote to memory of 2152	4104	msedge.exe	188
PID 4104 wrote to memory of 2152	4104	msedge.exe	188
PID 2956 wrote to memory of 3132	2956	rljdbvtqojgbztrl.exe	194
PID 3192 wrote to memory of 5648	3192	dbvtnljdyw.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_2b497c708f98e3db9aa9d305cd9fd6e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Temp\rljdbvtqojgbztrl.exe
  C:\Temp\rljdbvtqojgbztrl.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgeywrog.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2596
  - - C:\Temp\tomgeywrog.exe
      C:\Temp\tomgeywrog.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgeywrog.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3472
  - - C:\Temp\i_tomgeywrog.exe
      C:\Temp\i_tomgeywrog.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Temp\idbvtnlidb.exe
      C:\Temp\idbvtnlidb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\i_idbvtnlidb.exe
      C:\Temp\i_idbvtnlidb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvtnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\fdxvtnkica.exe
      C:\Temp\fdxvtnkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvtnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2332
  - - C:\Temp\i_fdxvtnkica.exe
      C:\Temp\i_fdxvtnkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1428
  - - C:\Temp\pnhfaxsqki.exe
      C:\Temp\pnhfaxsqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\i_pnhfaxsqki.exe
      C:\Temp\i_pnhfaxsqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxupmkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5008
  - - C:\Temp\hczxupmkhc.exe
      C:\Temp\hczxupmkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxupmkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3592
  - - C:\Temp\i_hczxupmkhc.exe
      C:\Temp\i_hczxupmkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4184
  - - C:\Temp\smkecwupmh.exe
      C:\Temp\smkecwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\i_smkecwupmh.exe
      C:\Temp\i_smkecwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\rmkecwuomh.exe
      C:\Temp\rmkecwuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Temp\i_rmkecwuomh.exe
      C:\Temp\i_rmkecwuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\jgeywrojhb.exe
      C:\Temp\jgeywrojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5976
  - - C:\Temp\i_jgeywrojhb.exe
      C:\Temp\i_jgeywrojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnljdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3132
  - - C:\Temp\dbvtnljdyw.exe
      C:\Temp\dbvtnljdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnljdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\i_dbvtnljdyw.exe
      C:\Temp\i_dbvtnljdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnljgayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\yvtnljgayt.exe
      C:\Temp\yvtnljgayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnljgayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5832
  - - C:\Temp\i_yvtnljgayt.exe
      C:\Temp\i_yvtnljgayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Temp\bvtnlfdxvq.exe
      C:\Temp\bvtnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdxvq.exe ups_ins
    3⤵
    PID:1228
  - - C:\Temp\i_bvtnlfdxvq.exe
      C:\Temp\i_bvtnlfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnifaysq.exe ups_run
    3⤵
    PID:3216
  - - C:\Temp\xspnifaysq.exe
      C:\Temp\xspnifaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnifaysq.exe ups_ins
    3⤵
    PID:1292
  - - C:\Temp\i_xspnifaysq.exe
      C:\Temp\i_xspnifaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    PID:704
  - - C:\Temp\pnhfzxspki.exe
      C:\Temp\pnhfzxspki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    PID:3816
  - - C:\Temp\i_pnhfzxspki.exe
      C:\Temp\i_pnhfzxspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhfcxup.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\usmkhfcxup.exe
      C:\Temp\usmkhfcxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhfcxup.exe ups_ins
    3⤵
    PID:2960
  - - C:\Temp\i_usmkhfcxup.exe
      C:\Temp\i_usmkhfcxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzurpj.exe ups_run
    3⤵
    PID:3620
  - - C:\Temp\rpjhbzurpj.exe
      C:\Temp\rpjhbzurpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurpj.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_rpjhbzurpj.exe
      C:\Temp\i_rpjhbzurpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    PID:5844
  - - C:\Temp\rmjebwuomg.exe
      C:\Temp\rmjebwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    PID:4396
  - - C:\Temp\i_rmjebwuomg.exe
      C:\Temp\i_rmjebwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebomge.exe ups_run
    3⤵
    PID:1312
  - - C:\Temp\romgebomge.exe
      C:\Temp\romgebomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebomge.exe ups_ins
    3⤵
    PID:4828
  - - C:\Temp\i_romgebomge.exe
      C:\Temp\i_romgebomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    PID:5508
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    PID:4668
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigdbvtnl.exe ups_run
    3⤵
    PID:1164
  - - C:\Temp\qoigdbvtnl.exe
      C:\Temp\qoigdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigdbvtnl.exe ups_ins
    3⤵
    PID:4452
  - - C:\Temp\i_qoigdbvtnl.exe
      C:\Temp\i_qoigdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicavsqkic.exe ups_run
    3⤵
    PID:4412
  - - C:\Temp\kicavsqkic.exe
      C:\Temp\kicavsqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5672
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffe8b9bc188,0x7ffe8b9bc194,0x7ffe8b9bc1a0
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,16751449116255840048,17670844653839917658,262144 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17579326576912951711,7336367361217021204,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
      4⤵
      System Time Discovery
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,9981796703412992887,17507017335647744418,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,17620985456060344991,5047988485965561043,2097152 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,7209407397397445490,16520630939998655052,2097152 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,6493236060881065940,4086878345011939074,2097152 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,1914678119012562592,6310704588996182340,2097152 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,2765757465475726352,3098059214259612806,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10498655584259002803,16369507882864219245,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,6208837326769426640,16054446435604749733,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,8162981117698579756,2966784591593231624,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,8162981117698579756,2966784591593231624,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9896795011185427059,7635932982827296789,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2507675683436282498,16163278415689284799,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,18440782262569433525,4190612553696162792,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,12661393092678009669,13389541843353590510,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,6428040873997634251,553360724547345650,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,10878422288927228313,3986910920497373525,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,10686329323682991191,11241975850810372963,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=952,i,1406379268161811369,7725809517244161990,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,6000898244003923323,13161254125845008268,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6712,i,1438711353046705986,13747012157718256470,262144 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,3587273971328094386,17901871246960161838,524288 --field-trial-handle=2608,i,4901615068161091646,16602145263128128252,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3748

C:\Temp\rljdbvtqojgbztrl.sys
C:\Temp\rljdbvtqojgbztrl.sys
1⤵
- Executes dropped EXE
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1936

C:\Temp\oigayvqoig.sys
C:\Temp\oigayvqoig.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\ifdxvtnlfd.sys
C:\Temp\ifdxvtnlfd.sys
1⤵
- Executes dropped EXE
PID:5428

C:\Temp\usqkicausn.sys
C:\Temp\usqkicausn.sys
1⤵
- Executes dropped EXE
PID:5208

C:\Temp\pkicaxspnh.sys
C:\Temp\pkicaxspnh.sys
1⤵
- Executes dropped EXE
PID:5560

C:\Temp\smkhczusmk.sys
C:\Temp\smkhczusmk.sys
1⤵
- Executes dropped EXE
PID:5780

C:\Temp\romhezxrpj.sys
C:\Temp\romhezxrpj.sys
1⤵
- Executes dropped EXE
PID:1936

C:\Temp\jdbztromge.sys
C:\Temp\jdbztromge.sys
1⤵
- Executes dropped EXE
PID:4944

C:\Temp\qomgbztrlj.sys
C:\Temp\qomgbztrlj.sys
1⤵
- Executes dropped EXE
PID:5396

C:\Temp\dbvtolgdbv.sys
C:\Temp\dbvtolgdbv.sys
1⤵
- Executes dropped EXE
PID:5208

C:\Temp\dbvtnigays.sys
C:\Temp\dbvtnigays.sys
1⤵
- Executes dropped EXE
PID:5352

C:\Temp\xvsnkfdays.sys
C:\Temp\xvsnkfdays.sys
1⤵
PID:248

C:\Temp\fdavsnkfdx.sys
C:\Temp\fdavsnkfdx.sys
1⤵
PID:3808

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
PID:4828

C:\Temp\rpjhecwurm.sys
C:\Temp\rpjhecwurm.sys
1⤵
PID:5744

C:\Temp\zurmjwuomg.sys
C:\Temp\zurmjwuomg.sys
1⤵
PID:2336

C:\Temp\trljheywtr.sys
C:\Temp\trljheywtr.sys
1⤵
PID:1432

C:\Temp\wtolgeywql.sys
C:\Temp\wtolgeywql.sys
1⤵
PID:5396

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
PID:4532

C:\Temp\sqnifdyvqo.sys
C:\Temp\sqnifdyvqo.sys
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fdxvtnkica.exe

Path C:\Temp\fdxvtnkica.exe
Size 365KB
SHA256 761049696a807a7e6a73c4bab10c3b0d4ff84b06261a15533daab65a752b23d7
MD5 e2218c3dda376d66d16d20e49473b998
SHA1 09e95c5156e5eafccfa91c920e0156bf51266857
SHA512 4545f8026a7908b10bb659d0e536eb2aced6c147d7c3a115f900d39ab35b95129540643ba1a649d106a44990e40634aafab29c19cd871dc0b5d09847e12a8b45
SSDEEP 3072:8uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxupmkhc.exe

Path C:\Temp\hczxupmkhc.exe
Size 365KB
SHA256 145ea35c700e2dbf01c082f75ad5de580120497279fce56028964bb74ebe1bcf
MD5 684df39a3fb782be320d47b1170c6355
SHA1 8b8599500bf6a84160552dd8b91d1e4677ef7ec2
SHA512 e25277518ba77db8ae8c13843c0aa214ba3e034e1654cf4abffb74ae043f5be909b17fa806d7ec465a6cbb006ff92031e270c826a34e3906254294eb159af3b3
SSDEEP 3072:quxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvtnkica.exe

Path C:\Temp\i_fdxvtnkica.exe
Size 365KB
SHA256 7b0635eb14cd651ea7e506949ccc943e478f6948a3bb6a17141689f66fdbbd13
MD5 50bef0f74b3f2c8a2e4652f0459a6589
SHA1 156c8acbba9aa9c5fe6d51aa257fcf391f145a1c
SHA512 7afed5112072200f81e903a28c2749b27d15d60c55aee0594f97b407d1c1b32980e720bea9dffec778d3f6f0e13ef882df3003dab2e1d32fd243219f47a6f86c
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczxupmkhc.exe

Path C:\Temp\i_hczxupmkhc.exe
Size 365KB
SHA256 63b4870f02cf50ca9fb0aa8b38e052baeacdc0d97777b2623b571831be73b451
MD5 b7185e13c6a9ad177e67e16223d8016c
SHA1 a9f618f4212543af56071cf3a090efebd1f058f3
SHA512 fbd44436a6966fe5371ae1ee818bad753a78e173071e0f8e9e85033a388d7e1e5d7ea895f5ec47c20922f7a82a421dc48bc17767ded38fd972562da127d6881a
SSDEEP 3072:NuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlidb.exe

Path C:\Temp\i_idbvtnlidb.exe
Size 365KB
SHA256 df93e5d40dc5d1e9d40e6a223f0aa79a4e1c86e486593982bcd5eb9120dc8e0f
MD5 86c64efdbc317b1327dd1a7e37efef84
SHA1 cc229a76c60d724270e270325630d93970c44986
SHA512 9539e9fbc916e15c4ea92022c9b1ee2da283e2577094bf4882c35d702089a8eed12fccc76d6c1dd5db0c9b14b39bed00477a6e140c843598745f1bd7254cd9fc
SSDEEP 3072:QuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfaxsqki.exe

Path C:\Temp\i_pnhfaxsqki.exe
Size 365KB
SHA256 4cd5880535fd4494c1e22f05a122fc5ee1e6fbfb6dd0f3373ee186a94de2e1a7
MD5 7ebdf6f05a0a416b954db831b0137c93
SHA1 2ef51fe715d60bea1100978dc97957f14e570e18
SHA512 fb64713929c610083e5499e04ceb906a503f2cd45368d7da18051cb4c36937c1722326669554239b9926fa95f01ee62207254dab862790dc508503340a01c9bd
SSDEEP 3072:muxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywrog.exe

Path C:\Temp\i_tomgeywrog.exe
Size 365KB
SHA256 e89a1e652a508e5fadde0c54838e6d33d97e3cb634908991b7811ea413f52abe
MD5 13f6706f7d8933b2b8b2021a27a31f1b
SHA1 61a6281a0770696b1cd05c564d6ee0b45d7b4111
SHA512 e79a45e6b6d765f342551c252e49a2094ff09666cd8125c9a1ee0307688db837eed4b048b63cf6af118e6f9d7d428b8e72c40441ba2da095c95b48898b523f54
SSDEEP 6144:KuxUxtXlIJjiJcbI03GBc3ucY5DCSjX/:KuxUxiGjSGecvX
TLSH
T171847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlidb.exe

Path C:\Temp\idbvtnlidb.exe
Size 365KB
SHA256 3fa88d5f6b1dcdc6b8a90e9d46ffcdcd8fb1cca4a5227d4d940f092fc9683d95
MD5 253df9717d3edc1c5ccd55d15a13250c
SHA1 e5dd687538429d0876bcbc5e7b9261b7d5645f04
SHA512 84c070f003e9677304447dadeb80220b593c2c02a47350ad066d6c81010883fffcad84f44269f25a665193195bfc7ba0b7c8de82de7248cd778a68c1244a4460
SSDEEP 3072:auxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvtnlfd.sys

Path C:\Temp\ifdxvtnlfd.sys
Size 293KB
SHA256 0aceb2e1266a723dc79607c4399789122b749bdac3f987c4ffd819c4ac6d6fb4
MD5 86682ababf4b844e04296b2f3c5bb944
SHA1 93296beb3091b0de79db25d12c7609aadb45c0e2
SHA512 7b19780ddd2e39769a04bb0fb9903d9abd53ac4fc4f3d074e3be215dbf3346b0e2da9d3ddd458f9626c52981a1c004495678fc38f53cf586812d2d4a712c5ded
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigayvqoig.sys

Path C:\Temp\oigayvqoig.sys
Size 293KB
SHA256 05af0074c3fed606f0e499561db74f5812e8560cb074c42fb78f9064f2b1ad29
MD5 aa9f4074fe7b385e8133750b6cbe0245
SHA1 ad980b30af19703017e656777d8a04e0000e5267
SHA512 176ad9acb844c2c69998335ac6b807eeba3bdde8adf16bc88d8ce926dec600c95c336d3e781f7d6b90e0712557c6d168d5afd5487e725e1660e8f87bb015b935
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicaxspnh.sys

Path C:\Temp\pkicaxspnh.sys
Size 293KB
SHA256 9c8e13dc695f8e364402a405dd3c8e06f230588e0b086c90460f5bef95cdc52d
MD5 bf9b314d622899765ef62e86ab2cd499
SHA1 21b24f1182a6f85c46c9d7a85d8398a33f5f25e4
SHA512 83b6403ece2f314080ca3ea500c527092bfe596e00860a64eff5ea901a9c015beb3898badd619d584c0a7ce851844c511cc40229d8f62e272da09c91be0801ff
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T199545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxsqki.exe

Path C:\Temp\pnhfaxsqki.exe
Size 365KB
SHA256 676a2ab61643327d1a53663af1e249ae6fa52d47abfed4981b2f81ae30816c7f
MD5 a6b3bdaef88e8b715bc6923e8b99ce43
SHA1 2153ffb33296b41c6fa497c18a3bf332c428a4f7
SHA512 7c207f251b206edacda2576467041e7dfb4208b667d70dea1927af99a053ea7ddec1da4968210108f00ec2faf8e52c246b74380c16485abf33b3d714c32a7879
SSDEEP 3072:7uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T181847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtqojgbztrl.exe

Path C:\Temp\rljdbvtqojgbztrl.exe
Size 365KB
SHA256 f2f7a61aaa16c000ec3446c625d966ed1d60dc8103a3a31df44546c2d3a34a17
MD5 cdd5aadf23c2818a300732d7c8a6a363
SHA1 d488405931705cb21cc1258c833e4051421d3655
SHA512 34c6619b8385a4a8d3b2c93f22e4cdd1a4ea9b5f807b498583e435b5353ed26e60dec0f2fbf0f2a5c67d0e2c222fb238208ab9221798edb00cb93377d9ca2b49
SSDEEP 3072:GuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtqojgbztrl.sys

Path C:\Temp\rljdbvtqojgbztrl.sys
Size 293KB
SHA256 9996f8576b9f6e03888e456fdc1386f9ec6ee05c267aecf51bb0ecc909c0265f
MD5 d9683ed935b4fe1ca7f45f82deb726c7
SHA1 f8978b114948a46d1737fbb58eef5177d63627df
SHA512 7435e45e1c038d8c7bbff1af9f72e8b14a42c2f60acef8e719d4dfce5a859b6e6c56a310ee6f58ff02565300ea1091312ef27a19565e256b394f6e3a969739de
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwupmh.exe

Path C:\Temp\smkecwupmh.exe
Size 365KB
SHA256 219fd6336b661a8da874430b4b3e3a37797b016596555791e83599f1e38bfb3d
MD5 a2a1a12770841a129d8e896d44388364
SHA1 604abf5adf06558d1b90a8e614311c1674be5cfe
SHA512 6ff2f5fef8c11b8702c9b0d793ed64744772aab7aa79c82fa1515d97d51b222bbf4c1475227ce9aa45a7b2b6eaa4bfef9b6152c71daa8670f2e92625fe12c97e
SSDEEP 6144:vsuxUxtXlIJjiJcbI03GBc3ucY5DCSjXJ:0uxUxiGjSGecvX
TLSH
T1A6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhczusmk.sys

Path C:\Temp\smkhczusmk.sys
Size 293KB
SHA256 3aa10350eee5cff7f4ed6b1ffe9919e690b63b8a07c9ffcc8bebfb6d8b16250e
MD5 9da8430cdc79d7802f295267dc62a293
SHA1 9bbbf1463a392330786929853fa7fd0effed5082
SHA512 c7ed7e4ae8007d15b74ecd14266fc295b6da25f5c4766ff2940a5b043f0c764d9caaca04f4b9de37ebf347ea078c52cc5b7228f5edbaf544195fcb3b5a774dc0
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywrog.exe

Path C:\Temp\tomgeywrog.exe
Size 365KB
SHA256 903709c40eb7b205b3e54bab3cce6ab6d5525a6bec749ad2727a7a2f93d1e2b8
MD5 434b24e9134f95ac6c2e073a5166801f
SHA1 d8b29fff81f9c78e768aba89930d9be0282cd499
SHA512 f87dfc827bbe07fd865ad11a72ed134c711c70df7ecc7aff5c20d103998f69a0fa0a9b54ff48c15204a38329ee8c07bd123ea07e7b0f46cd93cd32aa89fecaaf
SSDEEP 3072:puxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T177847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkicausn.sys

Path C:\Temp\usqkicausn.sys
Size 293KB
SHA256 037f9cdb0979ffde620e69d2f9e26b75672c3da14c2260430459a56f2f4d031b
MD5 97a7403e9039e9778d1122325bfdce5d
SHA1 4a2e1bede414fd5b09f68a89787368ae9f5d4b84
SHA512 ed952f618b4994802d8c1170896d1387d02d7b9bd58b11c5259eaa2b2edfeeb3db23f36a7ca130b5a2e8a393cac642f0ee0df8a77e2af475536f08a1172e6a57
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c9e52c7f3c59a13f4d4be128dfa0f7e8805b0bc1ce7eeb6f9d78c51e2b5cda1e
MD5 01ce30284785643eb3d53b64e8b33bf8
SHA1 d0612f0d8efa1fa7a01e2860653c96511d8b3238
SHA512 14d42a398645b522c2ecf2860966b29b6dda14cb5ffd7a73a10313b3c81a3ff6d874f70a7180313ad17b9d67d8aa30bcac52c547b1c2dcf7eb089aa9bc18ec41
TLSH
T1ED51BEB807B129F2CBA446765AD1E20A32F8889600B7DE5B40401DF55B07F6D16C2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c692.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c692.TMP
Size 2KB
SHA256 83531267b042001ef63e6c4f745f2f9b9cb869565982d1060cc0b233b2ed0585
MD5 98d2026bcb4d06a546cb89214182559c
SHA1 0265069ce6919197e3b4ccd5f90e4dce6d0cc919
SHA512 77d4be14731445dc5927589f969ca6656c23cb4f6e45e396dc93daf5b2f2622a0ae35fffc7c7e3ef71423c46482a671b6f448c766d55a2381252d86e7bdc2336
TLSH
T1DD51A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc375d9cfb231fb124523134d9b424a693c4e80c6d3962f36d574f73d3c9f5dc
MD5 da6a2fb73a35294fdb1190dff10ccdad
SHA1 065af093fe3b60f6a43488259cb05f4afc5d594e
SHA512 44223cf525c42430809f30460af2a488e45e2919437dcb844ffa06a51e5ef973d7bb7c4ab5a4b9a31695d9c3c3f5f2a392d24378688b28809d597c415dec9679
TLSH
T1C751CFF3C7E8866E890156F0AB147E2BCE1D0914432C7D5AC9E4AF2BA3E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 86c707810cb72ce6d8907c1ac93ef0e8384a2e2040cf990d0eb6e7ca09959064
MD5 caddd90efa223c1a0b259127b63ff0ef
SHA1 9440815512d6249c41bd91942ab3df3a3edb7b6c
SHA512 b5bf3fffcb8475f6cb71229afce72ff9183bbad1d291a4b3559b67abaa9db4d1c4e3efb3bf6f0df34b10374999ce9676f2870ce6ac0904635b8bb8e8c1042bf2
SSDEEP 192:sxRgRt2Ch/fPspkEDiZizoD8p9S/g6+WNCNR/YCVuOmGyIgtJ:sxRgDxh/fPspkqkeE/5S/5c3
TLSH
T15432B6466A289D7B9CC7D21DBA65BF53D2F95032A1D06F48A7FC8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 baa1cd469533313ea9bce52ef4087835337e99d91c781d6eb32aef8f34896eb4
MD5 856ad91bba22de8135a87a6a179ba134
SHA1 2fbadfc41d1dd54d2e0cc6ff6a39a3de48a4b511
SHA512 b423df8aa8afd486a16e8f0ea5b20205607a59e9c2a85b041fc07dcf9a090200f0eb1e52910245f2891ac5e883ed281089bd1586b7bf6171898cb91193d3adfb
SSDEEP 192:sxRjRt2Ch/fPsgkEDiZizoD8p9S/g6+WNCNR/YCVuOmGyIgDDJ:sxRjDxh/fPsgkqkeE/5S/5ch
TLSH
T11F42B6466A289D7B9CCBD31DBA55BF53D6F95032A1D02F48A7FC8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 40e3aba4a3419b1161e59094df559be07a9bdc2c2a8c8425bbb120a74a142156
MD5 e0e9cec6c4b37eb0920531cd4ed8ae0f
SHA1 fb0e0d39d048dd8776edab07af69c7d9ee4b0626
SHA512 06dd40d7d3133057bbc33780584b3f2d5d79ec30038cfed5264854a8444e8544773681e00e2252c6cab56afccb10bfffea548f205959da80b4240d9b8a6e4cde
SSDEEP 192:sxRjRt2Ch/fPsgkEkiZizoD8p9S/g6+WNCNR/YCRuOmGyIgDJJ:sxRjDxh/fPsgkVkeE/5S/Ncv
TLSH
T17442B65669289D7B9CCBD21DBA55BF53D2F95032A1952F48B7FC8B0C04EA6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5e9eae9fffd3954d14f22ae845f55e75f3b8b63dd232735ea5ab13f5e75e0043
MD5 e58eb631207d1ea0b20da4ab29e82398
SHA1 fc919a4a561c397d3baab07b92eaf3c159eb3e7b
SHA512 7ba2f8e76f4cc8f1a32f80b5410717caff70f44dee9b6eb826bd6e69047f07f93101f048db72f679e7c5ff3ac92c9aff4d4b1f104679fa156c75e6c05daf6703
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQK0QqcfroZ3:jC+vf7E7JQWgQ+f4+u1jabK0VcMN
TLSH
T121D2EB7B640DCB7F4F804ADDEC197A9F6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a370c7ec-6389-4c2b-a424-562f1f656feb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a370c7ec-6389-4c2b-a424-562f1f656feb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 33e6c979a6fb425173d134267c7e4a4dbc10ba5d9c0926ead219d02e56ad980d
MD5 0dcf7bcd653e48c63322c5849e812ec5
SHA1 089fd900d9d205c67708e52f2228e061f046a497
SHA512 cf108605651ad12525f5cf4a94d0e81cc1184f9909d5779bf4b347dc589fbfbe27a46da48749fc24daa315fa18b0547d5b242b61d69934c6b471c7f14f5f4f07
SSDEEP 768:Irv+4UNbdD3VcwNp8+p3bd66j+4BRv86aLIi82bwCl1:Ibsbp3rL8+p3Z6n4yG0ww
TLSH
T12803CE73F8A899739CE6C644B24676837FF850A396C10EC4D5DD2B4E419A19E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 19c0135df10dab47393e620512d2029ed4fabd34dab688b0040e2c69669fdbd6
MD5 b4614099f9267d532ead807d503b614b
SHA1 9abd6839007fe301422c44b15acad3345da2bf0b
SHA512 a0cdcf792c9c5334bcf04152907335af75be73f7b8eab0192f6e5d5dfba42e5bdc2c7325e6a07121ec2a590c85e514d0e9185907e77186f04d825dec13beea59
SSDEEP 768:Mj+9o3xQaKt6p8+p3bd66j+4BRv86aLIWCXb9Mok:L9o3wk8+p3Z6n4y+b+ok
TLSH
T1F1F2BF72E856DE738CD5C755B2963783AFF411A396C00E98E5DD6F0D00872AE670B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d5663a0a795d8ac20ea703060764bee47a532a61bc48f0d9e11f9bf90521626c
MD5 f936898b34bb0fe17b83873b0b5e29d4
SHA1 6711c79faaaca58a9e9989b5923552b1d7fac6b5
SHA512 9f2b2f8a3c3f6d68ba353e84a5dba9aa52e4ca083f24aa8b6355a66ef4fdd7623b72b07a0fed2c3716911ee0994bfbf5c230135b9cf10fdc347313d5dc44c177
SSDEEP 768:+rv+4UNbdy3eQaKtcp8+p3bd66j+4BRv86aLIWCXb9MoA:+bsbc3B68+p3Z6n4y+b+oA
TLSH
T14E13BF72F869DE738CE6C604B1967A837FF420A395C00E94E5D9AB4D05971AE270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 762aa19f8c8c1d1015f62982ed8b49ffd08a638e1518e59d37db08edeac9e933
MD5 d980fd3c4d6af1727c5c7010fa47e1f7
SHA1 fbf95a0aba3d406656f6683c4c5bed7810b4c3b4
SHA512 3bb3e2a29f62ff4c631b80ba0912f5faa9a0a7012aac55176b24107c721f06d64ec1a74352b5b10c876978c019dedc811aa2216a3184390413f7e50a530925bd
SSDEEP 768:cF1j+9U3SwgqdZnLp8+p3bd66j+4BRv86aLIWCXb9Mok:R9U3Z8+p3Z6n4y+b+ok
TLSH
T1BA1339F298D78A77D89D8747A37D2E429EBCD1A3B5845984F7C85E0CCC821BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4104_1316335582\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 03a03627616b3991c5da84c43ae14e0f80820246dd471495902b671b5ec540d1
MD5 30e540fb57acd4bf9af96682c8934327
SHA1 4fc335e441a60fc7f2158b2a38fab62f99d7769d
SHA512 09fcdd1071ea600c1d1b31d3e2871bedc3a330bc26a8f7887e12759599d6c39669f17e2b674c9e347e61ee0f7a1aded1d350a62bf0ec75971af565d3f7d94103
TLSH
T16A71048356A9D5B2C1DA9BF102835104F5BB1238072370244B615946E630A7658B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1432-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1936-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2336-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3536-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3808-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4532-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5208-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5208-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5352-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5396-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5396-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5428-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5560-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5560-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5744-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5780-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download