systex | 8d9f470cd13cffdc8e28d27cc9d1b10c4a8f2e0fd6cd859861d4e69f99e4d1b3

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260720-rnw5mscy3p
SHA256 8d9f470cd13cffdc8e28d27cc9d1b10c4a8f2e0fd6cd859861d4e69f99e4d1b3
MD5 9a6c0d9eaf2ae119a13551d0a4e7d650
SHA1 25fc6349837818c047ffb0f1c7a426bec7dea582
SHA512 10d9843547bc3c38d80c7262d53bbb77011a203f735da1964c663336cf533ce85ec3a2a60837cc0d4b15ad6fc2fa32cbe8936da4ac688ecaddc646e17bd01bc1
SSDEEP 3072:ZuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2256	ebwtomgeywtrljdb.exe
4712	ebwtomgeywtrljdb.sys
6064	CreateProcess.exe
5396	mgebwtolge.exe
2352	CreateProcess.exe
3272	CreateProcess.exe
4868	i_mgebwtolge.exe
4140	jdayvqoigd.sys
4340	CreateProcess.exe
5784	gdyvqnlgdb.exe
4312	CreateProcess.exe
5688	CreateProcess.exe
1392	i_gdyvqnlgdb.exe
1632	sqoifdxvqk.sys
5360	CreateProcess.exe
5128	qkidavtnlf.exe
4232	CreateProcess.exe
4612	CreateProcess.exe
2676	i_qkidavtnlf.exe
3716	sqkidaysqk.sys
3720	CreateProcess.exe
5956	nhfaxspnhf.exe
1748	CreateProcess.exe
2940	CreateProcess.exe
2432	i_nhfaxspnhf.exe
4768	causqkiczx.sys
1556	CreateProcess.exe
3196	causnhfzxs.exe
4920	CreateProcess.exe
676	CreateProcess.exe
3040	i_causnhfzxs.exe
4564	xspjhfzxup.sys
5008	CreateProcess.exe
5708	zxrpkhcaus.exe
4816	CreateProcess.exe
4864	CreateProcess.exe
5612	i_zxrpkhcaus.exe
3648	pjhczurmjh.sys
1160	CreateProcess.exe
4868	pjhezwrpje.exe
3120	CreateProcess.exe
2792	CreateProcess.exe
3032	i_pjhezwrpje.exe
2920	wurpjgeczt.sys
4968	CreateProcess.exe
2800	ecztjgeywr.exe
4748	CreateProcess.exe
2376	CreateProcess.exe
4768	i_ecztjgeywr.exe
4676	geywrojhbz.sys
4652	CreateProcess.exe
6068	eywtomgeyw.exe
4552	CreateProcess.exe
1884	CreateProcess.exe
2388	i_eywtomgeyw.exe
6084	igaywqoige.sys
4380	CreateProcess.exe
5208	jdbytqljga.exe
5096	CreateProcess.exe
3384	CreateProcess.exe
3836	i_jdbytqljga.exe
2344	oigbqlidav.sys
2660	CreateProcess.exe
5016	gaysqkiday.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1490165027\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_982915043\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_982915043\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1892374813\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1892374813\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1892374813\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_979815472\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_979815472\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1892374813\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgeywtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtndxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecztjgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytqljga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqliaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuoljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytqljga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuoljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecztjgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtndxvpn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4368	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6120	ipconfig.exe
5972	ipconfig.exe
4972	ipconfig.exe
4380	ipconfig.exe
2120	ipconfig.exe
2460	ipconfig.exe
3444	ipconfig.exe
4948	ipconfig.exe
2200	ipconfig.exe
5260	ipconfig.exe
5876	ipconfig.exe
5780	ipconfig.exe
4268	ipconfig.exe
2376	ipconfig.exe
5608	ipconfig.exe
3856	ipconfig.exe
3444	ipconfig.exe
1384	ipconfig.exe
5176	ipconfig.exe
4572	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290308681472726"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{B3EABE65-BFFD-4479-89F8-E6128CCDB735}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe
2256	ebwtomgeywtrljdb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	i_mgebwtolge.exe
Token: SeDebugPrivilege	1392	i_gdyvqnlgdb.exe
Token: SeDebugPrivilege	2676	i_qkidavtnlf.exe
Token: SeDebugPrivilege	2432	i_nhfaxspnhf.exe
Token: SeDebugPrivilege	3040	i_causnhfzxs.exe
Token: SeDebugPrivilege	5612	i_zxrpkhcaus.exe
Token: SeDebugPrivilege	3032	i_pjhezwrpje.exe
Token: SeDebugPrivilege	4768	i_ecztjgeywr.exe
Token: SeDebugPrivilege	2388	i_eywtomgeyw.exe
Token: SeDebugPrivilege	3836	i_jdbytqljga.exe
Token: SeDebugPrivilege	6080	i_gaysqkiday.exe
Token: SeDebugPrivilege	4256	i_dxvtndxvpn.exe
Token: SeDebugPrivilege	6000	i_icaysqkica.exe
Token: SeDebugPrivilege	3516	i_ecxupnhfcx.exe
Token: SeDebugPrivilege	4344	i_hezxupmhec.exe
Token: SeDebugPrivilege	3972	i_rmjhczurmk.exe
Token: SeDebugPrivilege	1612	i_ebwuoljhbz.exe
Token: SeDebugPrivilege	1676	i_ywqoigbztr.exe
Token: SeDebugPrivilege	5176	i_wqoigaysqn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2256	1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1728 wrote to memory of 3016	1728	2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3016 wrote to memory of 1116	3016	iexplore.exe	91
PID 1116 wrote to memory of 2648	1116	msedge.exe	92
PID 1116 wrote to memory of 5040	1116	msedge.exe	94
PID 1116 wrote to memory of 4368	1116	msedge.exe	95
PID 1116 wrote to memory of 5040	1116	msedge.exe	94
PID 1116 wrote to memory of 5040	1116	msedge.exe	94
PID 1116 wrote to memory of 3088	1116	msedge.exe	96
PID 1116 wrote to memory of 3088	1116	msedge.exe	96
PID 1116 wrote to memory of 6136	1116	msedge.exe	98
PID 1116 wrote to memory of 6136	1116	msedge.exe	98
PID 1116 wrote to memory of 2796	1116	msedge.exe	97
PID 1116 wrote to memory of 6136	1116	msedge.exe	98
PID 1116 wrote to memory of 2796	1116	msedge.exe	97
PID 1116 wrote to memory of 2796	1116	msedge.exe	97
PID 1116 wrote to memory of 2276	1116	msedge.exe	99
PID 1116 wrote to memory of 4904	1116	msedge.exe	100
PID 1116 wrote to memory of 2276	1116	msedge.exe	99
PID 1116 wrote to memory of 2276	1116	msedge.exe	99
PID 1116 wrote to memory of 4904	1116	msedge.exe	100
PID 1116 wrote to memory of 4904	1116	msedge.exe	100
PID 1116 wrote to memory of 2468	1116	msedge.exe	121
PID 1116 wrote to memory of 2468	1116	msedge.exe	121
PID 1116 wrote to memory of 3008	1116	msedge.exe	105
PID 1116 wrote to memory of 4532	1116	msedge.exe	106
PID 1116 wrote to memory of 3008	1116	msedge.exe	105
PID 1116 wrote to memory of 4532	1116	msedge.exe	106
PID 2256 wrote to memory of 6064	2256	ebwtomgeywtrljdb.exe	107
PID 1116 wrote to memory of 4528	1116	msedge.exe	110
PID 5396 wrote to memory of 2352	5396	mgebwtolge.exe	112
PID 1116 wrote to memory of 3124	1116	msedge.exe	115
PID 1116 wrote to memory of 3124	1116	msedge.exe	115
PID 1116 wrote to memory of 1884	1116	msedge.exe	118
PID 1116 wrote to memory of 1884	1116	msedge.exe	118
PID 2256 wrote to memory of 3272	2256	ebwtomgeywtrljdb.exe	119
PID 2256 wrote to memory of 4340	2256	ebwtomgeywtrljdb.exe	123
PID 5784 wrote to memory of 4312	5784	gdyvqnlgdb.exe	125
PID 2256 wrote to memory of 5688	2256	ebwtomgeywtrljdb.exe	128
PID 2256 wrote to memory of 5360	2256	ebwtomgeywtrljdb.exe	132
PID 5128 wrote to memory of 4232	5128	qkidavtnlf.exe	134
PID 2256 wrote to memory of 4612	2256	ebwtomgeywtrljdb.exe	137
PID 2256 wrote to memory of 3720	2256	ebwtomgeywtrljdb.exe	142
PID 5956 wrote to memory of 1748	5956	nhfaxspnhf.exe	144
PID 2256 wrote to memory of 2940	2256	ebwtomgeywtrljdb.exe	147
PID 1116 wrote to memory of 5336	1116	msedge.exe	149
PID 1116 wrote to memory of 5780	1116	msedge.exe	150
PID 1116 wrote to memory of 3180	1116	msedge.exe	151
PID 2256 wrote to memory of 1556	2256	ebwtomgeywtrljdb.exe	154
PID 3196 wrote to memory of 4920	3196	causnhfzxs.exe	156
PID 2256 wrote to memory of 676	2256	ebwtomgeywtrljdb.exe	159
PID 2256 wrote to memory of 5008	2256	ebwtomgeywtrljdb.exe	163
PID 5708 wrote to memory of 4816	5708	zxrpkhcaus.exe	165
PID 2256 wrote to memory of 4864	2256	ebwtomgeywtrljdb.exe	168
PID 2256 wrote to memory of 1160	2256	ebwtomgeywtrljdb.exe	172
PID 4868 wrote to memory of 3120	4868	pjhezwrpje.exe	174
PID 2256 wrote to memory of 2792	2256	ebwtomgeywtrljdb.exe	177
PID 2256 wrote to memory of 4968	2256	ebwtomgeywtrljdb.exe	181
PID 2800 wrote to memory of 4748	2800	ecztjgeywr.exe	183
PID 2256 wrote to memory of 2376	2256	ebwtomgeywtrljdb.exe	186
PID 1116 wrote to memory of 5972	1116	msedge.exe	188
PID 1116 wrote to memory of 5972	1116	msedge.exe	188
PID 2256 wrote to memory of 4652	2256	ebwtomgeywtrljdb.exe	194
PID 6068 wrote to memory of 4552	6068	eywtomgeyw.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_9a6c0d9eaf2ae119a13551d0a4e7d650_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Temp\ebwtomgeywtrljdb.exe
  C:\Temp\ebwtomgeywtrljdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebwtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6064
  - - C:\Temp\mgebwtolge.exe
      C:\Temp\mgebwtolge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebwtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3272
  - - C:\Temp\i_mgebwtolge.exe
      C:\Temp\i_mgebwtolge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqnlgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4340
  - - C:\Temp\gdyvqnlgdb.exe
      C:\Temp\gdyvqnlgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqnlgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5688
  - - C:\Temp\i_gdyvqnlgdb.exe
      C:\Temp\i_gdyvqnlgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5360
  - - C:\Temp\qkidavtnlf.exe
      C:\Temp\qkidavtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Temp\i_qkidavtnlf.exe
      C:\Temp\i_qkidavtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxspnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3720
  - - C:\Temp\nhfaxspnhf.exe
      C:\Temp\nhfaxspnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxspnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2940
  - - C:\Temp\i_nhfaxspnhf.exe
      C:\Temp\i_nhfaxspnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1556
  - - C:\Temp\causnhfzxs.exe
      C:\Temp\causnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:676
  - - C:\Temp\i_causnhfzxs.exe
      C:\Temp\i_causnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5008
  - - C:\Temp\zxrpkhcaus.exe
      C:\Temp\zxrpkhcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\i_zxrpkhcaus.exe
      C:\Temp\i_zxrpkhcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwrpje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1160
  - - C:\Temp\pjhezwrpje.exe
      C:\Temp\pjhezwrpje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwrpje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2792
  - - C:\Temp\i_pjhezwrpje.exe
      C:\Temp\i_pjhezwrpje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecztjgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4968
  - - C:\Temp\ecztjgeywr.exe
      C:\Temp\ecztjgeywr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecztjgeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2376
  - - C:\Temp\i_ecztjgeywr.exe
      C:\Temp\i_ecztjgeywr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywtomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Temp\eywtomgeyw.exe
      C:\Temp\eywtomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywtomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1884
  - - C:\Temp\i_eywtomgeyw.exe
      C:\Temp\i_eywtomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytqljga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Temp\jdbytqljga.exe
      C:\Temp\jdbytqljga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytqljga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3384
  - - C:\Temp\i_jdbytqljga.exe
      C:\Temp\i_jdbytqljga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqkiday.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2660
  - - C:\Temp\gaysqkiday.exe
      C:\Temp\gaysqkiday.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqkiday.exe ups_ins
    3⤵
    PID:3124
  - - C:\Temp\i_gaysqkiday.exe
      C:\Temp\i_gaysqkiday.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvtndxvpn.exe ups_run
    3⤵
    PID:6016
  - - C:\Temp\dxvtndxvpn.exe
      C:\Temp\dxvtndxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvtndxvpn.exe ups_ins
    3⤵
    PID:3716
  - - C:\Temp\i_dxvtndxvpn.exe
      C:\Temp\i_dxvtndxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaysqkica.exe ups_run
    3⤵
    PID:1464
  - - C:\Temp\icaysqkica.exe
      C:\Temp\icaysqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaysqkica.exe ups_ins
    3⤵
    PID:4668
  - - C:\Temp\i_icaysqkica.exe
      C:\Temp\i_icaysqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupnhfcx.exe ups_run
    3⤵
    PID:1200
  - - C:\Temp\ecxupnhfcx.exe
      C:\Temp\ecxupnhfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfcx.exe ups_ins
    3⤵
    PID:6020
  - - C:\Temp\i_ecxupnhfcx.exe
      C:\Temp\i_ecxupnhfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxupmhec.exe ups_run
    3⤵
    PID:1224
  - - C:\Temp\hezxupmhec.exe
      C:\Temp\hezxupmhec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxupmhec.exe ups_ins
    3⤵
    PID:5840
  - - C:\Temp\i_hezxupmhec.exe
      C:\Temp\i_hezxupmhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjhczurmk.exe ups_run
    3⤵
    PID:1328
  - - C:\Temp\rmjhczurmk.exe
      C:\Temp\rmjhczurmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjhczurmk.exe ups_ins
    3⤵
    PID:3468
  - - C:\Temp\i_rmjhczurmk.exe
      C:\Temp\i_rmjhczurmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuoljhbz.exe ups_run
    3⤵
    PID:5336
  - - C:\Temp\ebwuoljhbz.exe
      C:\Temp\ebwuoljhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuoljhbz.exe ups_ins
    3⤵
    PID:2156
  - - C:\Temp\i_ebwuoljhbz.exe
      C:\Temp\i_ebwuoljhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbztr.exe ups_run
    3⤵
    PID:864
  - - C:\Temp\ywqoigbztr.exe
      C:\Temp\ywqoigbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbztr.exe ups_ins
    3⤵
    PID:5676
  - - C:\Temp\i_ywqoigbztr.exe
      C:\Temp\i_ywqoigbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaysqn.exe ups_run
    3⤵
    PID:4220
  - - C:\Temp\wqoigaysqn.exe
      C:\Temp\wqoigaysqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaysqn.exe ups_ins
    3⤵
    PID:2740
  - - C:\Temp\i_wqoigaysqn.exe
      C:\Temp\i_wqoigaysqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqliaysqni.exe ups_run
    3⤵
    PID:4472
  - - C:\Temp\tqliaysqni.exe
      C:\Temp\tqliaysqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4268
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd019cc188,0x7ffd019cc194,0x7ffd019cc1a0
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,13788939669673045972,4427566428269954056,262144 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,7993698066519683412,8721906503943948313,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
      4⤵
      System Time Discovery
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,4915652390283101865,18355694978304105451,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:13
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,17769064475903516837,9266868189510050012,2097152 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,14600494309047973686,14156422597939759906,2097152 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,10933065808326088879,7370853955361742206,2097152 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,11631774892391919166,8516982824389912381,2097152 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,1042043853181221014,12828108526994393541,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3123924809579912368,17319516239341430600,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5475182242546262909,3656186772318254502,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,9774473232834210847,9900463135241895071,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,9774473232834210847,9900463135241895071,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,12849319679256554768,92654929747798455,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,983234448120339786,5883494519801352282,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,10937148594192018690,1279847818630472339,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,7031027948510936549,1022569820338578173,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,8499809634568404336,10961709962903203618,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,307513153265061418,10351256897654912073,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1901118993329298271,5460337786183495441,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,11813131481906395916,5684721509116190824,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4043024560195020646,2928644960533254260,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5980,i,16600433621383945371,11468591197611787909,262144 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:10
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10579694181446327538,2294697333716791555,524288 --field-trial-handle=2488,i,2009412431319774696,1623846101885609,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4320

C:\Temp\ebwtomgeywtrljdb.sys
C:\Temp\ebwtomgeywtrljdb.sys
1⤵
- Executes dropped EXE
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5708

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2468

C:\Temp\jdayvqoigd.sys
C:\Temp\jdayvqoigd.sys
1⤵
- Executes dropped EXE
PID:4140

C:\Temp\sqoifdxvqk.sys
C:\Temp\sqoifdxvqk.sys
1⤵
- Executes dropped EXE
PID:1632

C:\Temp\sqkidaysqk.sys
C:\Temp\sqkidaysqk.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\causqkiczx.sys
C:\Temp\causqkiczx.sys
1⤵
- Executes dropped EXE
PID:4768

C:\Temp\xspjhfzxup.sys
C:\Temp\xspjhfzxup.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\pjhczurmjh.sys
C:\Temp\pjhczurmjh.sys
1⤵
- Executes dropped EXE
PID:3648

C:\Temp\wurpjgeczt.sys
C:\Temp\wurpjgeczt.sys
1⤵
- Executes dropped EXE
PID:2920

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:4676

C:\Temp\igaywqoige.sys
C:\Temp\igaywqoige.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\oigbqlidav.sys
C:\Temp\oigbqlidav.sys
1⤵
- Executes dropped EXE
PID:2344

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
PID:3048

C:\Temp\hfdxvsnkic.sys
C:\Temp\hfdxvsnkic.sys
1⤵
PID:3192

C:\Temp\fzxrpnhfzx.sys
C:\Temp\fzxrpnhfzx.sys
1⤵
PID:5152

C:\Temp\pkhczxrpjh.sys
C:\Temp\pkhczxrpjh.sys
1⤵
PID:1040

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
PID:5612

C:\Temp\jeywtrojge.sys
C:\Temp\jeywtrojge.sys
1⤵
PID:3520

C:\Temp\eywqoigbyw.sys
C:\Temp\eywqoigbyw.sys
1⤵
PID:4320

C:\Temp\dbywqoigdy.sys
C:\Temp\dbywqoigdy.sys
1⤵
PID:4776

C:\Temp\vqnifdyvqo.sys
C:\Temp\vqnifdyvqo.sys
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causnhfzxs.exe

Path C:\Temp\causnhfzxs.exe
Size 365KB
SHA256 1dda454775678ac0253602233c6e5e1566ec810e35af9140f3f8d801a06e8ab8
MD5 07b39fd82a5651156b80079c421f60cb
SHA1 5ae753256cd39dbcde1e28c80a1b0e6727fa4e62
SHA512 934e2f1b962427c008a055b476a8945f352a8c6ee646018f34fae15470261fdf1c4fe4c5413b7420c1d12d4ca19ed38d9a607a13f29d4d8723d154209af33df5
SSDEEP 3072:QuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causqkiczx.sys

Path C:\Temp\causqkiczx.sys
Size 293KB
SHA256 799c96e66a39ab6323953ee0cc1c769ee3a53b0333b8969d5eb34be25252e628
MD5 fb296e3562f62e270bf33b5585da60b4
SHA1 55867b22fdf437159b0d9487075f803e4b440d9f
SHA512 8d75f54c8157d89fc78054b4fdcd5aab06803e606c4a65bcb8b5dee3deb706b0b7d09839a6f0f25674b58d2a6baf945f11cf935482628d93bb4a0dfde61f5a90
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeywtrljdb.exe

Path C:\Temp\ebwtomgeywtrljdb.exe
Size 365KB
SHA256 93bce13e15a67de7f72439da8c043bbe043fe2e28d3384d84f7f1f48584b0db7
MD5 8887595a302347512eb035523b83059e
SHA1 e45f520a6148daac2b5d730390b8ee55cda5392f
SHA512 fe139271a9f487af2eabb2dcdb9e2a10ad413316c4906f1d01fcd8d7c084319425814b7027fc929cf83a096919672f1766e8f3abd7a1aba5dcb9aed6263bc9c4
SSDEEP 3072:MuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeywtrljdb.sys

Path C:\Temp\ebwtomgeywtrljdb.sys
Size 293KB
SHA256 f47c808a2fa695755be54eb285081afe11a255908f161ea7eeaade9d72a16fb6
MD5 323b807c42ee984802d58b73bc52e83b
SHA1 aa4aecda5df0e65e1be59adc63669e84ae5dc7da
SHA512 734328083029784ec13e796c952aed20200e2a30bab5f9340103d7dbc1704d0ca8ad6b6c8d5efedb6e16676461408646a4a58b1fda3202ca71a2346b40095fbf
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqnlgdb.exe

Path C:\Temp\gdyvqnlgdb.exe
Size 365KB
SHA256 4c257143c0a783e85dbe30526e4814e4a580e334ac4f5f9cbd4041b7ea6b5408
MD5 319239b8f114936db34988e0d755fb16
SHA1 159986c749aa94730ee7b1a1abf6981c37d91bcc
SHA512 37560178d8ba957f96d351bcbb3e838183ee569e22c8892f4b80f0e2fe183443ca327e18f4da981695baff976944dc9f0f33799ce69adc73a67039126a237d01
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causnhfzxs.exe

Path C:\Temp\i_causnhfzxs.exe
Size 365KB
SHA256 4ec98a1469a51da806294366b39bd11f51c779d76852edb6becca9d1c46cb48d
MD5 ac180533c8b47f0941a3b93791b8c500
SHA1 c21e885dbe3d965d086348045c7861cfa58dcbe3
SHA512 22a95bc44ea50cb68d594ba031675002cd62d38cb0a835eb3f3aec6a97396702a6e25405548d5fd6f9aad50f2ed2675d89ddef04cdf96714f8516d13c2143173
SSDEEP 3072:puxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvqnlgdb.exe

Path C:\Temp\i_gdyvqnlgdb.exe
Size 365KB
SHA256 ebdf3c6c1d342705d0b0989b1528c84b2dc15a41f376c53a726fdf1fba0ab9c4
MD5 9dc6e5bbf5fb419bf10690c1fe6c1e72
SHA1 8567721af5d01dd4f61fc7d5a408052c3f09e0cf
SHA512 fccf64dfc2bf88ead426a19468967a5b4d375bd811546610a31e73fff95f5d9b937bfd43aad0e6b3e473af8f314b9c7bbb1fac98cbbcf2e4df77f92480923784
SSDEEP 3072:4uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgebwtolge.exe

Path C:\Temp\i_mgebwtolge.exe
Size 365KB
SHA256 8d38d0c363a5de980963f0f8fd53999c3088036e199b91aba2b548e73d0a0671
MD5 528d9a2b34a8159c0431064fde19d5d2
SHA1 1581d0c86dd0fd51a17c743114944dcf31f811c7
SHA512 dad8cea616f123b49d2cf97d978b3317bd4f841da0809d1ff113f7221454d05f34b3e340087713827e9670ead92acd0bce0210610cec78e89143a147d127d35b
SSDEEP 3072:ruxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfaxspnhf.exe

Path C:\Temp\i_nhfaxspnhf.exe
Size 365KB
SHA256 9d73b03356592312fe466f4530b95ccc45fbe5e99e6ea4c729ecf887a3c00c3b
MD5 ead608b255756bc9f146c81431fa15cc
SHA1 59d7317a1e64637d41ee43344ad556cedd87d9eb
SHA512 65186734287dee84a0c40eb72c919e847ea7a1c29a253afa956b7a6bd7cde84fb5e1a6914682e1db22d34ed8b946a7845fff0e013728c02f8cc1fa29f23be81f
SSDEEP 3072:quxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkidavtnlf.exe

Path C:\Temp\i_qkidavtnlf.exe
Size 365KB
SHA256 0ba933c675e5b82ee97cf7de5ed6214df990fc443e0fa5aa68ca8a1d5bc6d96e
MD5 7ff77d8021c942a71cb615368c6933e2
SHA1 b50d32ca836ee1cc3d6b6e1a8159ed0c3667df16
SHA512 40b6277c9fddd4238202b3a0cace83f9554d678ad9abe0f634cf276e36c8d11c0a1f65d19f6c033d0699778265f472420dbb889855dbf36e380646343e40a009
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdayvqoigd.sys

Path C:\Temp\jdayvqoigd.sys
Size 293KB
SHA256 9f1669714bf8bd252c2e2c9e79d8f9d4703b4b37d0b236cd56bc326813f0c396
MD5 7c0840930c18b55f5456904d6212f34a
SHA1 43f5288ff99ec43fde1ed3fdc7605c78eb7cb894
SHA512 bc38e280e780986a7246fe2155f60af330f6d19db619bd8f07478344f8034b113673369d6ff3cc5ee0186dfa3cc09e97c9addd816679c97380423859388b81b5
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgebwtolge.exe

Path C:\Temp\mgebwtolge.exe
Size 365KB
SHA256 b9a1c850b05e941681f26648c487c58aa9e219a3b1ce0ca4c6aa6e2d4f13cd6d
MD5 b73442839407a7840a73cc1c90d5d604
SHA1 ac0c50926141fa1a19f4dd3c842b2383d6fe13b1
SHA512 ca103e80a4d9c5464d58f570005272bed6fa2382134881d45713c08c4c04ea910ef3fffbe0a8646d3edddd81b42f7a4fdb9b88dd49537da4fa5a73e5a142ab69
SSDEEP 3072:vuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspnhf.exe

Path C:\Temp\nhfaxspnhf.exe
Size 365KB
SHA256 9be0b4c27c15e4d66ede1ea7658604e16ffb2e9e25c45be0a6dcadbdc7db83a7
MD5 d6e2875b3123c5852f3691ad00333b2e
SHA1 3b0233b48979a481b689df1016ca4f8bee7a1d0b
SHA512 a93dabfd170427f55549b2319cf1c94834fb4e7138cd1a70053d9a2aee92873f565a00361b5b8c3d4612896ada03e2bd1bb79ac6238a56b0c3d94cb723a3ca97
SSDEEP 3072:buxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T111847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavtnlf.exe

Path C:\Temp\qkidavtnlf.exe
Size 365KB
SHA256 13fc21714727ffb04c6b990d6858d8c2b58b82b395a4dd13125eaac46f882b36
MD5 651cfe4ba025ff83463b10275f8ae0f2
SHA1 a8a0b3284839da7a352e5590091675e0a546ef2a
SHA512 ba40b6cc476e37bbe76a8d43d0f5047b718806e666fbca81bc6dfaaad6966fff45e3344117efc9b72f418fb406516d658f8c8c0698da20b4746fc8289ec255a0
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidaysqk.sys

Path C:\Temp\sqkidaysqk.sys
Size 293KB
SHA256 220a9592f7c50415f55878b3c8c0f174ae79b12b72f02e05eade0311cad9fbbb
MD5 a61b1024d548c44f336ec8d76b0ddfbf
SHA1 2fa0de38089942af91c97b448143359a185059e1
SHA512 8d08b5d9aa25856f012438967d42e052894e5f2f675d72578d0a0586f7428ad464d2167a96ee541c4f48845c4fdb763ae1731bd19b04da86849f1a5dc346a7d1
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqoifdxvqk.sys

Path C:\Temp\sqoifdxvqk.sys
Size 293KB
SHA256 fcad9fabe7a24a134368136ffe5d80ae5820b555f65d7554923b399b2acab9a9
MD5 8a54a6c6b8558699ed0d7582ee14d3cf
SHA1 3eca06d5223bc019b13921276e67136c50af5f38
SHA512 488077c78e9ed186af97c90e534ae283e1b13d0a9354af80fd312fb354bc4d9ee3d828567f33e3bc02b9416e3d3013108900b7dc92986ad168cf26d2b443964b
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspjhfzxup.sys

Path C:\Temp\xspjhfzxup.sys
Size 293KB
SHA256 4255adcf4643be3137e55c59d87fe1d5c0d254e12dee48188e707966ef27176a
MD5 081ac63a6eec46ab166d26cc03b9f3e4
SHA1 aeeeedab565afd1df03dc4c6d40f5aec425d2f8a
SHA512 2ad84650948453569b27edd996a3feea4a846bdb169ca62bfbb2d972e03e58f85c224c4f06261b75db272f3606818c64f01ad2a17467675994aec1bbb591995f
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcaus.exe

Path C:\Temp\zxrpkhcaus.exe
Size 365KB
SHA256 1a43996db157047225c86bcb197dcf02427526599bfaf7ebcc9cf75016e2dbd7
MD5 44cf456ff934044b01724bebc140073e
SHA1 af43e59bd87f127dff028d8e3ca520c77f3a1335
SHA512 47ed6110d82249cd249c90d09d4f4aa5e758116e83402ee07a42b405f8242410ac2375d8b17b66f6dfa997d0cd7be403e4d546c8fbc78547d33cdec543341dd1
SSDEEP 3072:2uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 723d63e3c8fa9149a1334531dc61ca32594b682a0c9312450fd36e097cb8c5f6
MD5 beac4206b89401e9215f57acbaa65c0e
SHA1 e9e7cf5c7522385c1f814db93d524a9cb533adee
SHA512 d4340c595de0e333e0d8f5154367a9661336e7669d7bd5e8b1cb4eb012d2984b7ea9cfd8133a1a4829dce79394b2b7b5b0a2f26e9eb0bdd843d57a50ddd47bc4
TLSH
T1CD61B57203360AD3EB6989BBB9F298A4B2FFC849068F1E1A01555DB79C42F0350E5CD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bc51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bc51.TMP
Size 3KB
SHA256 0d69b3277f0dd0d22f9cba86ebc56a8605a25637ed625320c1a1d755fd2cf219
MD5 7eca5f4b7abe4e1ca02afca5a70311a4
SHA1 0b76553148d3dc6a422692eaf688454db0f1bb87
SHA512 34a08da1c6a1141e37c1235fa4803ba6672e93322d11a24478ca0bd34ba20382bab8178a9e17b4b09b9b9c2199dbc8e6830c378f950fb665f80b1be648628076
TLSH
T1F361A47203360AD3EB6988BBB9F298A4B2FFC849468F1E1A01555DB79C02F0350E5CD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d9ecf49311f6eacf112c48e08eaac35a2a16d703d2e89bfad212b266fb969760
MD5 856fba520a3dae34b766ec4618393523
SHA1 f351ffec2ce4be62aa7a55c961ba38cc0a939079
SHA512 dc4a7d10c42f6db013106350c18bcc06deb99e917a36f94d426c24f132fe1456771cceb2a9ed2f7321259aed2f676bbc5ef9b96cf03f1dd5f91e2b8120e27d4b
TLSH
T199419AF3C7E8866E890156F0AA186E2BCE1D0915832C3D5AC9E4EF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 adce33decea3c8dc6c67ebd079765388635fe465516898e7217e32a1b1f171a9
MD5 ea5b1434012e3a02eef6adc48b41eb4f
SHA1 f79379fde4d4e0e1b5e0472f5b61ec2444ea9201
SHA512 0f5b12d37e9c89faa4d7d29fd9aad483834c313824350f1a404792c22f07d44ee9aaf97b94d6786db8f55bfdc23e516726aa8737023e00ec64597b80c7524b13
SSDEEP 192:sxRWR6C//fVsLFggZq2GWPzoA8p9y/g6+WNCdXZb/YoijCY/GNIgtJ:sxRWL//fVsLFg+q2Ghg/5Gpb/iGv3
TLSH
T19132A71A6D389D3B9CC7D21DBA55BF53E2F95032A1D02E58A6FC9A1C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 730f707797b1f642fdda529730cd2897059d79d26afe1c0c8e95865a8d6c8822
MD5 3695e71c53d0966d70438261537c175d
SHA1 5721cef228a6a291dfaceb87c5bb495a4e39a25c
SHA512 b2830cd2788af967e4a7d853552163272dcaf03dd49e31fe5853f87382d3e02948f0bfa977acc267a93c6ec800aee88fd20c7621b0a563f18ed0bf727b9b6ef1
SSDEEP 192:sxRNR6C//fVs1FggZq2GWPzoA8p9y/g6+WNCdXZb/YoijCY/GNIgD1J:sxRNL//fVs1Fg+q2Ghg/5Gpb/iGvr
TLSH
T1B642B61AAD389D3B9CC7D21DBA55BF53E2F95032A1D02E58A6FC9A0C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b2d1311e867fce8ab8ba1df70af3e3917b31fbdaa82f27d20b3a1355588d4f99
MD5 097231efaf7a8224a909501573ba1028
SHA1 b9dddf91ccc9ec091dee15d781c751f271b1793c
SHA512 db497ee36d2e4fa00673f76db4ffbfdffd17ac3a8342eb970dbaeef7fb547b57c25dd78062ec46771ee2f482810965b227c9b916ddc370358eafeecc8d0745ac
SSDEEP 192:sxRNR6C//fVs1FggZq2GWPzoA8p9y/g6+WNCdXZb/Yoi/CY/GNIgDHJ:sxRNL//fVs1Fg+q2Ghg/5Gpb/iKvF
TLSH
T13F42A61AAD389D3B9CC7D21DBA55BF53E2F95032A1D12E58A6FC9B0C10E6ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f632672c9751903d6881b761eedc2b36ee6607b95e7bc88ebb961881acaf6b23
MD5 16f7061139dd51d6a2eecb4ec313cf87
SHA1 c85d8ef9e765b20968cb3434cddb405b9f680be5
SHA512 d4d288ca69f887ec63cfede3431d876f9a51c20cf102b5041d63883fdb3c2862edfbc03ff3a5de8f80d3e6cb9075b2347e4671e9d0d703601baed76e314fe69c
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVTJBVuwCro9pe0e:j26HRUE7MRWgs2f02u1ja4JB4wZsl
TLSH
T179D2DB7B640DCABF4F800ADDED297E9E6D6802CB9698CD8047FD851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a594d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a594d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bbb6d739a34a74d8bce266334d22452d913fc9d1c2f738338db869db1a6ecc02
MD5 1842261afbee3743154cbcda4c740fce
SHA1 368bab35d96c481bcea037602f8287b43dfaa7c0
SHA512 bd78fa9b0d937ff60838f046c0542f8af2dc33ea458feff51e53a5a73281dd219f03db123b9486d91c07b1b284dc9202b41c6de63f95b64c253d67c919e130b8
SSDEEP 768:hrv+4UNbdz3Y2/TBOWRZYONXyer1IRCzniBxeVH1SK7:hbsbV3FmSIqnWEH1l
TLSH
T1D703BF36E4A89E338DE2A3C5B14777437FB86057C6800790E9EE2F4E069B59D130B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f900e7cf76bd71c8402b174efab88e598de53a6ad5ef99285b5370d5975949c9
MD5 159f89d72438317d288f1348ca8ce4db
SHA1 ed26f6b8f2754acfdfe28878ee13855eeae56e5e
SHA512 7944f613a37f0869cecb8750c521f6706bc7480bf2822428f773b5b0958082e5ebcfd082307512fc1f96ebc62c28b73b53428274a023dff24004417443b9eabd
SSDEEP 768:Aj+9b3JB/TBOWRZREONXyer1IRCzni9qb9Ma:/9b3rESIqnRb+a
TLSH
T147F2BE35E46A9E234CD29396B20737D67FF8207BC5C40A50EEE96F4E0587A6E030A41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 295de31f334e966aaec8d46573f7516802b40206d3224507020055b78f084614
MD5 017b56eb50b2a9a3d8de13629a08bafd
SHA1 cd9a5861903c87d8a117ac1faaf0649dfc1b05ec
SHA512 4b9fef3d0d3d5904124d2f1d7df93bbdffdb0df5f59fb8c7784c469beff64b498458c1bcdbfdf49c29ce5b1ce1528fd2fe7bdb75e47cd165319ceb0d1b570ff2
SSDEEP 768:Rrv+4UNbdt37B/TBOWRZRWONXyer1IRCzni9qb9M6:Rbsb33dWSIqnRb+6
TLSH
T18913CF31E46D9E338CE2A395B14776937FB82067C5C40B50EAE96F4D058B89E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7ad6ae3e439abbddc4631736d2845e40f5886833b43638f587a4080458243f67
MD5 6451167a18d14322e7ced6a9e26a1de6
SHA1 f031840f95b1fe461843d881593e09709d921fb4
SHA512 42ec74834ff4ff18071cfa54926afb0aa1da7c8217ade8c5fe1d0f3e38915f9919e5dc30ef080697fb60658f355c9d68765cfedf8add0ff770dbe1a9f15b2bcd
SSDEEP 768:nF1j+903bwg82psOWRZRDONXyer1IRCzni9qb9Ma:O903nCSIqnRb+a
TLSH
T1C21316F694D78E32C89E4383B33D6E86AABCD067B5845990BBD45E4DCC825BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8f5f8e1c5c9e2ddf954c7476bbfdbf215a652281dd42ff1d03a6289d907dd6ff
MD5 cc539cb203287dd8fc6bb28fb0dff459
SHA1 7d0eeb87f2f5af039fa91928420369e6ece6a6bb
SHA512 475a0c86b348ab490613604c9c104f90350e01530578e47258e174e9cfa2e492d25a77d1bed5e55db78254467ca648e353f3ebc340d9af2015e7bc4a5f5a762d
SSDEEP 768:Kj+9b3OB/TBOWRZREONXyer1IRCzni9qb9Ma:p9b3sESIqnRb+a
TLSH
T175F2BE35E46A9E234CD29396B20737D67FF8207BC5C41B50EEE96F4E0587A6E070B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

b7832fe6-8bd2-41c1-82bf-a94e32287369.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7832fe6-8bd2-41c1-82bf-a94e32287369.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1116_2053491136\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0b453de8b972655c8b34caf061a729d1d9c817b1ce79e8ec294a4e0c3e321500
MD5 b58f16754865857264d799bebe2b3782
SHA1 eebe9560e4ee45fbfc178179ad64aada2d190474
SHA512 43a53b550d44d8ce65155f23340a54bb86bc048cfe02df4b17aeb66080c31c0f49e60c13238b389540dff270491af6c12f5cda035202354806202d81ecb9fa83
TLSH
T13E71238357B9D9B3C1DE9BF102835644F5FB223C072370640B91598AEB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1632-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1632-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2344-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2920-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3048-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3192-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3520-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3648-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4140-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4712-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4776-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5612-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download